registry / extension / 4.0.8

extension@4.0.8

The cross-browser extension framework. Build Chrome, Edge, Firefox, and Safari extensions with no build configuration.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 692 KB of source, external domains: example.com, github.com, us.i.posthog.com, www.extension.dev

Source & flagged code

4 flagged

bin/extension.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjs

Source & flagged code

4 flagged · loading source

bin/extension.cjsView file

20try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Child Process

Package source references child process execution.

bin/extension.cjsView on unpkg · L20

6Cross-file remote execution chain: bin/extension.cjs spawns dist/cli.cjs; helper contains network access plus dynamic code execution. L6: L7: const distCjsEntry = path.resolve(__dirname, '../dist/cli.cjs') L8: const distEntry = path.resolve(__dirname, '../dist/cli.js') ... L20: try { L21: const {spawnSync} = require('child_process') L22: const tsxCli = require.resolve('tsx/cli')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/extension.cjsView on unpkg · L6

3L4: const fs = require('fs') L5: const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/extension.cjsView on unpkg · L3

dist/cli.cjsView file

24function readUpdateSuffixOnce() { L25: const suffix = process.env.EXTENSION_CLI_UPDATE_SUFFIX; L26: if (!suffix) return null; ... L41: try { L42: return JSON.parse(external_fs_.readFileSync(readyPath, 'utf-8')); L43: } catch { ... L78: const absolute = external_path_.resolve(extensionPath); L79: const isWindows = 'win32' === process.platform; L80: const seedBuffer = isWindows ? Buffer.from(absolute.replace(/\//g, '\\'), 'utf16le') : Buffer.from(absolute, 'utf8'); ... L132: const message = { L133: data: { L134: id: extensionId,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L24

Findings

3 High5 Medium5 Low

HighChild Processbin/extension.cjs

HighCredential Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextbin/extension.cjs

MediumDynamic Requirebin/extension.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/cli.cjsView file

Lines 4-44javascript

4}();

5"use strict";

6var __webpack_modules__ = {

7 "./browsers/browsers-lib/banner.ts" (__unused_rspack_module, __webpack_exports__, __webpack_require__) {

8 __webpack_require__.d(__webpack_exports__, {

9 ai: ()=>printDevBannerOnce,

10 MK: ()=>printProdBannerOnce

11 });

12 var external_fs_ = __webpack_require__("fs");

13 var external_path_ = __webpack_require__("path");

14 const external_crypto_namespaceObject = require("crypto");

15 var external_pintor_ = __webpack_require__("pintor");

16 var external_pintor_default = /*#__PURE__*/ __webpack_require__.n(external_pintor_);

17 var messages = __webpack_require__("./browsers/browsers-lib/messages.ts");

18 var browser_family = __webpack_require__("./browsers/browsers-lib/browser-family.ts");

19 const BANNER_PRINTED_EVENT = 'extensionjs:banner-printed';

20 function markBannerPrinted() {

21 process.emit(BANNER_PRINTED_EVENT);

22 }

23 const printedKeys = new Set();

24 function readUpdateSuffixOnce() {

25 const suffix = process.env.EXTENSION_CLI_UPDATE_SUFFIX;

26 if (!suffix) return null;

27 delete process.env.EXTENSION_CLI_UPDATE_SUFFIX;

28 return suffix;

29 }

30 function keyFor(browser, outPath, hp) {

31 const host = (hp?.host || '127.0.0.1').toString();

32 const port = hp?.port == null ? '' : String(hp.port);

33 return `${browser}::${external_path_.resolve(outPath)}::${host}:${port}`;

34 }

35 function toNormalizedId(value) {

36 if ('string' != typeof value) return '';

37 return value.trim();

38 }

39 function readReadyMetadata(readyPath) {

40 if (!readyPath) return null;

41 try {

42 return JSON.parse(external_fs_.readFileSync(readyPath, 'utf-8'));

43 } catch {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L24

44 return null;