registry / girky / 1.29.0

girky@1.29.0

Create a Girk site from Markdown

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 160 KB of source, external domains: api.github.com, google.com

Source & flagged code

2 flagged

dist/libs/render.jsView file

Lines 39-79javascript

39 }

40 const tagEnd = template.indexOf("%>", tagStart + 2);

41 if (tagEnd === -1)

42 throw new Error("Unclosed EJS tag in template");

43 const inner = template.slice(tagStart + 2, tagEnd);

44 if (inner.startsWith("%")) {

45 body.push(`__out.push("<%");`);

46 }

47 else if (inner.startsWith("=")) {

48 body.push(`__out.push(__escape(String(${inner.slice(1).trim()})));`);

49 }

50 else if (inner.startsWith("-")) {

51 body.push(`__out.push(String(${inner.slice(1).trim()}));`);

52 }

53 else {

54 body.push(inner);

55 }

56 cursor = tagEnd + 2;

57 }

58 body.push("return __out.join('');");

59 const fnBody = `with(__data) { ${body.join("\n")} }`;

60 const fn = new Function("__data", fnBody);

61 return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

62}

63const cache = new Map();

64function getCompiled(name, source) {

65 if (!cache.has(name))

66 cache.set(name, compile(source));

67 return cache.get(name);

68}

69/**

70 * Resolve and load girk-sdk template registry.

71 */

72function loadRegistryFromDisk() {

73 const candidates = [

74 (0, path_1.join)(__dirname, "../../../girk-sdk/dist/libs/templates/registry.js"),

75 (0, path_1.join)(__dirname, "../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

76 (0, path_1.join)(__dirname, "../../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

77 ];

78 for (const candidate of candidates) {

79 if ((0, fs_1.existsSync)(candidate)) {

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0;

5const

Source & flagged code

2 flagged · loading source

dist/libs/render.jsView file

59const fnBody = `with(__data) { ${body.join("\n")} }`; L60: const fn = new Function("__data", fnBody); L61: return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

dist/index.jsView file

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0; L5: const args_1 = require("@sil/args"); L6: const cli_block_1 = require("cli-block");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L4

Findings

1 High4 Medium5 Low

HighEvaldist/libs/render.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/libs/render.jsView file

Lines 39-79javascript

39 }

40 const tagEnd = template.indexOf("%>", tagStart + 2);

41 if (tagEnd === -1)

42 throw new Error("Unclosed EJS tag in template");

43 const inner = template.slice(tagStart + 2, tagEnd);

44 if (inner.startsWith("%")) {

45 body.push(`__out.push("<%");`);

46 }

47 else if (inner.startsWith("=")) {

48 body.push(`__out.push(__escape(String(${inner.slice(1).trim()})));`);

49 }

50 else if (inner.startsWith("-")) {

51 body.push(`__out.push(String(${inner.slice(1).trim()}));`);

52 }

53 else {

54 body.push(inner);

55 }

56 cursor = tagEnd + 2;

57 }

58 body.push("return __out.join('');");

59 const fnBody = `with(__data) { ${body.join("\n")} }`;

60 const fn = new Function("__data", fnBody);

61 return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

62}

63const cache = new Map();

64function getCompiled(name, source) {

65 if (!cache.has(name))

66 cache.set(name, compile(source));

67 return cache.get(name);

68}

69/**

70 * Resolve and load girk-sdk template registry.

71 */

72function loadRegistryFromDisk() {

73 const candidates = [

74 (0, path_1.join)(__dirname, "../../../girk-sdk/dist/libs/templates/registry.js"),

75 (0, path_1.join)(__dirname, "../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

76 (0, path_1.join)(__dirname, "../../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

77 ];

78 for (const candidate of candidates) {

79 if ((0, fs_1.existsSync)(candidate)) {

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0;

5const