registry / extension / 4.0.13

extension@4.0.13

The cross-browser extension framework. Build Chrome, Edge, Firefox, and Safari extensions with no build configuration.

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 736 KB of source, external domains: example.com, github.com, us.i.posthog.com, www.extension.dev

Source & flagged code

4 flagged

bin/extension.cjsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// ██████╗██╗ ██╗

3// ██╔════╝██║ ██║

4// ██║ ██║ ██║

5// ██║ ██║ ██║

6// ╚██████╗███████╗██║

7// ╚═════╝╚══════╝╚═╝

10'use strict'

12const fs = require('fs')

13const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L11

15const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs')

16const distEntry = path.resolve(__dirname, '../dist/cli.js')

17const sourceEntry = path.resolve(__dirname, '../index.ts')

19const run = (entry) => {

20 require(entry)

21}

23if (fs.existsSync(distCjsEntry)) {

24 run(distCjsEntry)

25} else if (fs.existsSync(distEntry)) {

26 run(distEntry)

27} else if (fs.existsSync(sourceEntry)) {

28 try {

29 const {spawnSync} = require('child_process')

30 const tsxCli = require.resolve('tsx/cli')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L14

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L28

31 const result = spawnSync(

32 process.execPath,

33 [tsxCli, sourceEntry, ...process.argv.slice(2)],

34 {stdio: 'inherit'}

35 )

36 process.exit(result.status ?? 1)

37 } catch {

38 console.error(

39 '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'

40 )

41 process.exit(1)

42 }

43} else {

44 console.error('[Extension.js] CLI entry not found.')

45 process.exit(1)

46}

dist/cli.cjsView file

Lines 4-44javascript

4}();

5"use strict";

6var __webpack_modules__ = {

7 "./browsers/browsers-lib/banner.ts" (__unused_rspack_module, __webpack_exports__, __webpack_require__) {

8 __webpack_require__.d(__webpack_exports__, {

9 ai

Source & flagged code

4 flagged · loading source

bin/extension.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code