registry / gittydocs / 0.0.5

gittydocs@0.0.5

Turn a GitHub folder of Markdown/MDX into a fast, searchable docs site

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 226 KB of source, external domains: api.github.com, bun.sh, chatgpt.com, claude.ai, github.com, json-schema.org, raw.githubusercontent.com, tweakcn.com, www.w3.org

Source & flagged code

2 flagged

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView file

Lines 8-39tsx

9type MdxRuntimeProps = Record<string, unknown> | undefined

11const Fragment = (props: { children?: JSX.Element }) => props.children as JSX.Element

13function normalizeProps(props: MdxRuntimeProps) {

14 if (!props) return props

15 if ("className" in props) {

16 const { className, ...rest } = props as { className?: string } & Record<string, unknown>

17 return { ...rest, class: className }

18 }

19 return props

20}

22function mdxJsx(type: unknown, props: MdxRuntimeProps) {

23 if (typeof type === "function") return type(props ?? {})

24 const normalized = normalizeProps(props) ?? {}

25 return createComponent(Dynamic as any, mergeProps(normalized, { component: type }))

26}

28function useMDXComponent(code: string) {

29 const fn = new Function(code) as (rt: any) => { default: any }

30 return fn({ Fragment, jsx: mdxJsx, jsxs: mdxJsx }).default

Low

Eval

Package source references a known benign dynamic code generation pattern.

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView on unpkg · L28

31}

33export function MdxContentStatic(props: MdxProps): JSX.Element {

34 const Component = useMDXComponent(props.code)

35 const components: any = useMDXComponents({})

37 return <Component components={components} />

38}

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3// src/cli/index.ts

4import { cac } from "cac";

6// src/cli/commands/build.ts

7import path6 from "path";

9// src/cli/lib/env.ts

10import path2 from "path";

Source & flagged code

2 flagged · loading source

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView file

28function useMDXComponent(code: string) { L29: const fn = new Function(code) as (rt: any) => { default: any } L30: return fn({ Fragment, jsx: mdxJsx, jsxs: mdxJsx }).default

Low

Eval

Package source references a known benign dynamic code generation pattern.

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView on unpkg · L28

dist/cli.jsView file

14function fail(message) { L15: process.stderr.write(`${message} L16: `); ... L105: if (input.explicitEnvPath) { L106: const p = path2.resolve(process.cwd(), input.explicitEnvPath); L107: if (!await pathExists(p)) { ... L119: // src/cli/lib/exec.ts L120: import { spawn } from "child_process"; L121: import readline from "readline"; ... L183: async function resolveSource(input) { L184: const raw = (input ?? process.env.GITTYDOCS_SOURCE ?? ".").trim(); L185: if (!raw) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L14

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaltemplates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsx

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView file

Lines 8-39tsx

9type MdxRuntimeProps = Record<string, unknown> | undefined

11const Fragment = (props: { children?: JSX.Element }) => props.children as JSX.Element

13function normalizeProps(props: MdxRuntimeProps) {

14 if (!props) return props

15 if ("className" in props) {

16 const { className, ...rest } = props as { className?: string } & Record<string, unknown>

17 return { ...rest, class: className }

18 }

19 return props

20}

22function mdxJsx(type: unknown, props: MdxRuntimeProps) {

23 if (typeof type === "function") return type(props ?? {})

24 const normalized = normalizeProps(props) ?? {}

25 return createComponent(Dynamic as any, mergeProps(normalized, { component: type }))

26}

28function useMDXComponent(code: string) {

29 const fn = new Function(code) as (rt: any) => { default: any }

30 return fn({ Fragment, jsx: mdxJsx, jsxs: mdxJsx }).default

Low

Eval

Package source references a known benign dynamic code generation pattern.

templates/web-runtime/src/gittydocs/lib/velite/mdx-content.tsxView on unpkg · L28

31}

33export function MdxContentStatic(props: MdxProps): JSX.Element {

34 const Component = useMDXComponent(props.code)

35 const components: any = useMDXComponents({})

37 return <Component components={components} />

38}

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3// src/cli/index.ts

4import { cac } from "cac";

6// src/cli/commands/build.ts

7import path6 from "path";

9// src/cli/lib/env.ts

10import path2 from "path";