registry / girky / 1.30.0

girky@1.30.0

Create a Girk site from Markdown

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 162 KB of source, external domains: api.github.com, cdn.jsdelivr.net, google.com

Source & flagged code

3 flagged

dist/libs/render.jsView file

Lines 39-79javascript

39 }

40 const tagEnd = template.indexOf("%>", tagStart + 2);

41 if (tagEnd === -1)

42 throw new Error("Unclosed EJS tag in template");

43 const inner = template.slice(tagStart + 2, tagEnd);

44 if (inner.startsWith("%")) {

45 body.push(`__out.push("<%");`);

46 }

47 else if (inner.startsWith("=")) {

48 body.push(`__out.push(__escape(String(${inner.slice(1).trim()})));`);

49 }

50 else if (inner.startsWith("-")) {

51 body.push(`__out.push(String(${inner.slice(1).trim()}));`);

52 }

53 else {

54 body.push(inner);

55 }

56 cursor = tagEnd + 2;

57 }

58 body.push("return __out.join('');");

59 const fnBody = `with(__data) { ${body.join("\n")} }`;

60 const fn = new Function("__data", fnBody);

61 return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

62}

63const cache = new Map();

64function getCompiled(name, source) {

65 if (!cache.has(name))

66 cache.set(name, compile(source));

67 return cache.get(name);

68}

69/**

70 * Resolve and load girk-sdk template registry.

71 */

72function loadRegistryFromDisk() {

73 const candidates = [

74 (0, path_1.join)(__dirname, "../../../girk-sdk/dist/libs/templates/registry.js"),

75 (0, path_1.join)(__dirname, "../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

76 (0, path_1.join)(__dirname, "../../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

77 ];

78 for (const candidate of candidates) {

79 if ((0, fs_1.existsSync)(candidate)) {

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0;

5const

dist/libs/page.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = girky@1.29.0 matchedIdentity = npm:Z2lya3k:1.29.0 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/libs/page.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/libs/render.jsView file

59const fnBody = `with(__data) { ${body.join("\n")} }`; L60: const fn = new Function("__data", fnBody); L61: return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

dist/index.jsView file

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0; L5: const args_1 = require("@sil/args"); L6: const cli_block_1 = require("cli-block");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L4

dist/libs/page.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/libs/page.jsView on unpkg

Findings

2 High4 Medium5 Low

HighEvaldist/libs/render.js

HighPrevious Version Dangerous Deltadist/libs/page.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/libs/render.jsView file

Lines 39-79javascript

39 }

40 const tagEnd = template.indexOf("%>", tagStart + 2);

41 if (tagEnd === -1)

42 throw new Error("Unclosed EJS tag in template");

43 const inner = template.slice(tagStart + 2, tagEnd);

44 if (inner.startsWith("%")) {

45 body.push(`__out.push("<%");`);

46 }

47 else if (inner.startsWith("=")) {

48 body.push(`__out.push(__escape(String(${inner.slice(1).trim()})));`);

49 }

50 else if (inner.startsWith("-")) {

51 body.push(`__out.push(String(${inner.slice(1).trim()}));`);

52 }

53 else {

54 body.push(inner);

55 }

56 cursor = tagEnd + 2;

57 }

58 body.push("return __out.join('');");

59 const fnBody = `with(__data) { ${body.join("\n")} }`;

60 const fn = new Function("__data", fnBody);

61 return (data) => fn({ ...data, __escape: escapeHtml });

High

Eval

Package source references dynamic code evaluation.

dist/libs/render.jsView on unpkg · L59

62}

63const cache = new Map();

64function getCompiled(name, source) {

65 if (!cache.has(name))

66 cache.set(name, compile(source));

67 return cache.get(name);

68}

69/**

70 * Resolve and load girk-sdk template registry.

71 */

72function loadRegistryFromDisk() {

73 const candidates = [

74 (0, path_1.join)(__dirname, "../../../girk-sdk/dist/libs/templates/registry.js"),

75 (0, path_1.join)(__dirname, "../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

76 (0, path_1.join)(__dirname, "../../../../node_modules/girk-sdk/dist/libs/templates/registry.js"),

77 ];

78 for (const candidate of candidates) {

79 if ((0, fs_1.existsSync)(candidate)) {

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.media = exports.contentPages = exports.settingsAndConfig = exports.files = void 0;

5const

dist/libs/page.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/libs/page.jsView on unpkg