registry / expo-libghostty / 0.2.0

expo-libghostty@0.2.0

Ghostty terminal view for Expo / React Native, powered by libghostty

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 4.71 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-33json

2 "name": "expo-libghostty",

3 "version": "0.2.0",

4 "description": "Ghostty terminal view for Expo / React Native, powered by libghostty",

5 "main": "build/index.js",

6 "types": "build/index.d.ts"

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/download-xcframework.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/download-xcframework.mjsView file

13Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: execution+network L13: import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'; L14: import { execFileSync } from 'node:child_process'; L15: import { dirname, join } from 'node:path'; ... L18: const root = dirname(dirname(fileURLToPath(import.meta.url))); L19: const manifest = JSON.parse(await readFile(join(root, 'vendor-manifest.json'), 'utf8')); L20: const { url, sha256 } = manifest['libghostty-spm'].xcframework; ... L34: console.log(`[expo-libghostty] downloading GhosttyKit.xcframework (${url})`); L35: const response = await fetch(url, { redirect: 'follow' }); L36: if (!response.ok) throw new Error(`download failed: HTTP ${response.status}`);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/download-xcframework.mjsView on unpkg · L13

scripts/sync-vendor.shView file

•path = scripts/sync-vendor.sh kind = build_helper sizeBytes = 2515 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-vendor.shView on unpkg

Findings

2 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/download-xcframework.mjs

MediumNetwork

MediumShips Build Helperscripts/sync-vendor.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

scripts/download-xcframework.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Fetch the pre-built libghostty XCFramework pinned in vendor-manifest.json

3// into ios/vendor/Frameworks/. Runs on postinstall; idempotent (skips when the

4// extracted framework already matches the pinned checksum). The zip is

5// SHA256-verified against the same checksum the upstream SPM binary target pins.

6//

7// pnpm users: pnpm blocks dependency postinstall scripts by default — allow

8// `expo-libghostty` (e.g. `allowBuilds` in pnpm-workspace.yaml) or run

9// `node node_modules/expo-libghostty/scripts/download-xcframework.mjs` manually.

11import { createHash } from 'node:crypto';

12import { existsSync } from 'node:fs';

13import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';

14import { execFileSync } from 'node:child_process';

15import { dirname, join } from 'node:path';

16import { fileURLToPath } from 'node:url';

18const root = dirname(dirname(fileURLToPath(import.meta.url)));

19const manifest = JSON.parse(await readFile(join(root, 'vendor-manifest.json'), 'utf8'));

20const { url, sha256 } = manifest['libghostty-spm'].xcframework;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/download-xcframework.mjsView on unpkg · L13

22const frameworksDir = join(root, 'ios', 'vendor', 'Frameworks');

23const frameworkDir = join(frameworksDir, 'GhosttyKit.xcframework');

24const stampFile = join(frameworksDir, '.checksum');

26if (existsSync(frameworkDir) && existsSync(stampFile)) {

27 const stamp = (await readFile(stampFile, 'utf8')).trim();

28 if (stamp === sha256) {

29 console.log('[expo-libghostty] GhosttyKit.xcframework up to date');

30 process.exit(0);

31 }

32}