registry / extension / 4.0.7

extension@4.0.7

⚠ Under review

The cross-browser extension framework. Build Chrome, Edge, Firefox, and Safari extensions with no build configuration.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 687 KB of source, external domains: example.com, github.com, us.i.posthog.com, www.extension.dev

Source & flagged code

5 flagged

bin/extension.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

7const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs')

8const distEntry = path.resolve(__dirname, '../dist/cli.js')

9const sourceEntry = path.resolve(__dirname, '../index.ts')

11const run = (entry) => {

12 require(entry)

13}

15if (fs.existsSync(distCjsEntry)) {

16 run(distCjsEntry)

17} else if (fs.existsSync(distEntry)) {

18 run(distEntry)

19} else if (fs.existsSync(sourceEntry)) {

20 try {

21 const {spawnSync} = require('child_process')

22 const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

23 const result = spawnSync(

24 process.execPath,

25 [tsxCli, sourceEntry, ...process.argv.slice(2)],

26 {stdio: 'inherit'}

27 )

28 process.exit(result.status ?? 1)

29 } catch {

30 console.error(

31 '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'

32 )

33 process.exit(1)

34 }

35} else {

36 console.error('[Extension.js] CLI entry not found.')

37 process.exit(1)

38}

dist/cli.cjsView file

Lines 4-44javascript

4}();

5"use strict";

6var __webpack_modules__ = {

7 "./browsers/browsers-lib/banner.ts" (__unused_rspack_module, __webpack_exports__, __webpack_require__) {

8 __webpack_require__.d(__webpack_exports__, {

9 ai: ()=>printDevBannerOnce,

10 MK: ()

dist/browsers.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = extension@4.0.4 matchedIdentity = npm:ZXh0ZW5zaW9u:4.0.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browsers.cjsView on unpkg

Source & flagged code

5 flagged · loading source

bin/extension.cjsView file

20try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

6Cross-file remote execution chain: bin/extension.cjs spawns dist/cli.cjs; helper contains network access plus dynamic code execution. L6: L7: const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs') L8: const distEntry = path.resolve(__dirname, '../dist/cli.js') ... L20: try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

3L4: const fs = require('fs') L5: const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

dist/cli.cjsView file

24function readUpdateSuffixOnce() { L25: const suffix = process.env.EXTENSION_CLI_UPDATE_SUFFIX; L26: if (!suffix) return null; ... L41: try { L42: return JSON.parse(external_fs_.readFileSync(readyPath, 'utf-8')); L43: } catch { ... L78: const absolute = external_path_.resolve(extensionPath); L79: const isWindows = 'win32' === process.platform; L80: const seedBuffer = isWindows ? Buffer.from(absolute.replace(/\//g, '\\'), 'utf16le') : Buffer.from(absolute, 'utf8'); ... L132: const message = { L133: data: { L134: id: extensionId,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L24

dist/browsers.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browsers.cjsView on unpkg

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/browsers.cjs

HighChild Processbin/extension.cjs

HighCredential Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextbin/extension.cjs

MediumDynamic Requirebin/extension.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/extension.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

7const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs')

8const distEntry = path.resolve(__dirname, '../dist/cli.js')

9const sourceEntry = path.resolve(__dirname, '../index.ts')

11const run = (entry) => {

12 require(entry)

13}

15if (fs.existsSync(distCjsEntry)) {

16 run(distCjsEntry)

17} else if (fs.existsSync(distEntry)) {

18 run(distEntry)

19} else if (fs.existsSync(sourceEntry)) {

20 try {

21 const {spawnSync} = require('child_process')

22 const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

23 const result = spawnSync(

24 process.execPath,

25 [tsxCli, sourceEntry, ...process.argv.slice(2)],

26 {stdio: 'inherit'}

27 )

28 process.exit(result.status ?? 1)

29 } catch {

30 console.error(

31 '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'

32 )

33 process.exit(1)

34 }

35} else {

36 console.error('[Extension.js] CLI entry not found.')

37 process.exit(1)

38}

dist/cli.cjsView file

Lines 4-44javascript

4}();

5"use strict";

6var __webpack_modules__ = {

7 "./browsers/browsers-lib/banner.ts" (__unused_rspack_module, __webpack_exports__, __webpack_require__) {

8 __webpack_require__.d(__webpack_exports__, {

9 ai: ()=>printDevBannerOnce,

10 MK: ()

dist/browsers.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browsers.cjsView on unpkg