registry / forgr / 0.5.0

forgr@0.5.0

Convert Markdown files into polished PDFs

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 25.6 KB of source

Source & flagged code

3 flagged

scripts/postinstall.jsView file

Lines 1-22javascript

1import { existsSync, readdirSync } from 'fs';

2import { rm } from 'fs/promises';

3import { execSync } from 'child_process';

4import { homedir } from 'os';

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L2

5import { join } from 'path';

7const BROWSERS_PATH = join(homedir(), '.forgr', 'browsers');

9async function removeFfmpeg() {

10 let entries;

11 try {

12 entries = readdirSync(BROWSERS_PATH);

13 } catch {

14 return;

15 }

16 for (const entry of entries) {

17 if (entry.startsWith('ffmpeg-')) {

18 await rm(join(BROWSERS_PATH, entry), { recursive: true, force: true });

19 }

20 }

21}

Lines 32-72javascript

32 console.error(' Run: npm install');

33 process.exit(1);

34 }

36 const isolatedExecPath = playwright.chromium.executablePath();

38 if (existsSync(isolatedExecPath)) {

39 console.log('');

src/assets/fonts/IBMPlexMono-600.woff2View file

•path = src/assets/fonts/IBMPlexMono-600.woff2 kind = high_entropy_blob sizeBytes = 50600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/fonts/IBMPlexMono-600.woff2View on unpkg

Source & flagged code

3 flagged · loading source

scripts/postinstall.jsView file

2import { rm } from 'fs/promises'; L3: import { execSync } from 'child_process'; L4: import { homedir } from 'os';

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L2

52try { L53: execSync('npx playwright-core install chromium-headless-shell', { L54: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L52

src/assets/fonts/IBMPlexMono-600.woff2View file

•path = src/assets/fonts/IBMPlexMono-600.woff2 kind = high_entropy_blob sizeBytes = 50600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/fonts/IBMPlexMono-600.woff2View on unpkg

Findings

4 High2 Medium4 Low

HighChild Processscripts/postinstall.js

HighShell

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobsrc/assets/fonts/IBMPlexMono-600.woff2

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

scripts/postinstall.jsView file

Lines 1-22javascript

1import { existsSync, readdirSync } from 'fs';

2import { rm } from 'fs/promises';

3import { execSync } from 'child_process';

4import { homedir } from 'os';

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L2

5import { join } from 'path';

7const BROWSERS_PATH = join(homedir(), '.forgr', 'browsers');

9async function removeFfmpeg() {

10 let entries;

11 try {

12 entries = readdirSync(BROWSERS_PATH);

13 } catch {

14 return;

15 }

16 for (const entry of entries) {

17 if (entry.startsWith('ffmpeg-')) {

18 await rm(join(BROWSERS_PATH, entry), { recursive: true, force: true });

19 }

20 }

21}

Lines 32-72javascript

32 console.error(' Run: npm install');

33 process.exit(1);

34 }

36 const isolatedExecPath = playwright.chromium.executablePath();

38 if (existsSync(isolatedExecPath)) {

39 console.log('');

src/assets/fonts/IBMPlexMono-600.woff2View file

•path = src/assets/fonts/IBMPlexMono-600.woff2 kind = high_entropy_blob sizeBytes = 50600 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/fonts/IBMPlexMono-600.woff2View on unpkg