registry / extension / 4.0.1

extension@4.0.1

Create cross-browser extensions with no build configuration.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 5 file(s), 762 KB of source, external domains: example.com, github.com, us.i.posthog.com, www.extension.dev

Source & flagged code

4 flagged

bin/extension.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

7const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs')

8const distEntry = path.resolve(__dirname, '../dist/cli.js')

9const sourceEntry = path.resolve(__dirname, '../index.ts')

11const run = (entry) => {

12 require(entry)

13}

15if (fs.existsSync(distCjsEntry)) {

16 run(distCjsEntry)

17} else if (fs.existsSync(distEntry)) {

18 run(distEntry)

19} else if (fs.existsSync(sourceEntry)) {

20 try {

21 const {spawnSync} = require('child_process')

22 const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

23 const result = spawnSync(

24 process.execPath,

25 [tsxCli, sourceEntry, ...process.argv.slice(2)],

26 {stdio: 'inherit'}

27 )

28 process.exit(result.status ?? 1)

29 } catch {

30 console.error(

31 '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'

32 )

33 process.exit(1)

34 }

35} else {

36 console.error('[Extension.js] CLI entry not found.')

37 process.exit(1)

38}

dist/cli.cjsView file

Lines 3-43javascript

3 return "u" < typeof document ? new (require('url'.replace('', ''))).URL('file:' + __filename).href : document.currentScript && document.currentScript.src || new URL('main.js', document.baseURI).href;

Source & flagged code

4 flagged · loading source

bin/extension.cjsView file

20try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

6Cross-file remote execution chain: bin/extension.cjs spawns dist/cli.cjs; helper contains network access plus dynamic code execution. L6: L7: const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs') L8: const distEntry = path.resolve(__dirname, '../dist/cli.js') ... L20: try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

3L4: const fs = require('fs') L5: const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

dist/cli.cjsView file

23function readUpdateSuffixOnce() { L24: const suffix = process.env.EXTENSION_CLI_UPDATE_SUFFIX; L25: if (!suffix) return null; ... L40: try { L41: return JSON.parse(external_fs_.readFileSync(readyPath, 'utf-8')); L42: } catch { ... L77: const absolute = external_path_.resolve(extensionPath); L78: const isWindows = 'win32' === process.platform; L79: const seedBuffer = isWindows ? Buffer.from(absolute.replace(/\//g, '\\'), 'utf16le') : Buffer.from(absolute, 'utf8'); ... L131: const message = { L132: data: { L133: id: extensionId,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L23

Findings

3 High5 Medium5 Low

HighChild Processbin/extension.cjs

HighCredential Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextbin/extension.cjs

MediumDynamic Requirebin/extension.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/extension.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

7const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs')

8const distEntry = path.resolve(__dirname, '../dist/cli.js')

9const sourceEntry = path.resolve(__dirname, '../index.ts')

11const run = (entry) => {

12 require(entry)

13}

15if (fs.existsSync(distCjsEntry)) {

16 run(distCjsEntry)

17} else if (fs.existsSync(distEntry)) {

18 run(distEntry)

19} else if (fs.existsSync(sourceEntry)) {

20 try {

21 const {spawnSync} = require('child_process')

22 const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

23 const result = spawnSync(

24 process.execPath,

25 [tsxCli, sourceEntry, ...process.argv.slice(2)],

26 {stdio: 'inherit'}

27 )

28 process.exit(result.status ?? 1)

29 } catch {

30 console.error(

31 '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'

32 )

33 process.exit(1)

34 }

35} else {

36 console.error('[Extension.js] CLI entry not found.')

37 process.exit(1)

38}

dist/cli.cjsView file

Lines 3-43javascript