registry / hdoc-tools / 0.55.0

hdoc-tools@0.55.0

Hornbill HDocBook Development Support Tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 680 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, docs.hornbill.com, en.wikipedia.org, engelschall.com, github.com, hdoc-mermaid-intercept.invalid, jquery.org, lodash.com, openjsf.org, opensource.org, tldrlegal.com, underscorejs.org, www.w3.org

Oversized source lightweight scan

ui/js/mermaid.min.js4.49 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedTelemetryUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 21-61json

21 "hdoc-init.js",

22 "hdoc-install-browser.js",

23 "hdoc-mermaid.js",

24 "hdoc-module.js",

25 "hdoc-serve.js",

26 "hdoc-stats.js",

27 "hdoc-validate.js",

28 "hdoc-validate-config.js",

29 "hdoc-ver.js",

30 "validateNodeVer.js",

31 ".puppeteerrc.cjs",

32 "ui",

33 "custom_modules",

34 "schemas",

35 "templates",

36 "templates/init/.npmignore",

37 "templates/init/gitignore",

38 "npm-shrinkwrap.json"

39 ],

40 "scripts": {

41 "preinstall": "node validateNodeVer",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "test": "echo \"Error: no test specified\" && exit 1",

43 "postinstall": "node hdoc-install-browser.js"

44 },

45 "author": "Hornbill Technologies Ltd",

46 "license": "ISC",

47 "dependencies": {

48 "@mermaid-js/layout-elk": "0.2.1",

49 "american-british-english-translator": "0.2.1",

50 "archiver": "8.0.0",

51 "better-sqlite3": "12.11.1",

52 "cheerio": "1.2.0",

53 "compression": "1.8.1",

54 "express": "5.2.1",

55 "markdown-it": "14.2.0",

56 "markdown-it-container": "4.0.0",

57 "markdown-it-front-matter": "0.2.4",

58 "mermaid": "11.15.0",

59 "puppeteer": "25.1.0"

60 }

61}

hdoc-install-browser.jsView file

Lines 1-41javascript

1// Resilient browser provisioning for hdoc-tools.

2//

3// Replaces the old `puppeteer browsers install ...` one-liner postinstall.

4// Puppeteer's own bundled download (install.mjs) is disabled via

5// .puppeteerrc.cjs (skipDownload), so this script is the single, controlled

6// place Chrome + chrome-headless-shell are fetched.

7//

8// Why: on some Windows Server 2019 build agents the Chrome archive extracts

9// only partially (Defender quarantining binaries mid-extract, or a truncated

10// download behind a proxy). The first failure leaves the version folder on

11// disk, after which Puppeteer refuses to re-extract and every later install

hdoc-edit.jsView file

Lines 2-42javascript

2//

3// This is the write-capable sibling of `hdoc serve`. It reuses the SAME

4// /_books/* content + render pipeline (via hdoc-content-routes.js) so the

5// editor's live preview is byte-identical to published output, and it serves

6// a SEPARATE UI surface from editor/ (React + Vite, built to editor/dist).

7//

8// Key differences from `hdoc serve`:

9// - binds 127.0.0.1 only (it has write access; must not be reachable on the LAN)

10// - serves the editor SPA, not the Vue viewer in ui/

11// - will host write routes (/api/toc, /api/page/:id, /api/move) in later phases

12//

ui/css/theme-default/fonts/inter-roman-greek.woff2View file

•path = ui/css/theme-default/fonts/inter-roman-greek.woff2 kind = high_entropy_blob sizeBytes = 21776 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/css/theme-default/fonts/inter-roman-greek.woff2View on unpkg

ui/js/mermaid.min.jsView file

•path = ui/js/mermaid.min.js kind = oversized_source_file sizeBytes = 4712175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/js/mermaid.min.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node validateNodeVer

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node validateNodeVer

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hdoc-install-browser.jsView file

21(async () => { L22: const fs = require("node:fs"); L23: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hdoc-install-browser.jsView on unpkg · L21

hdoc-edit.jsView file

22const os = require("node:os"); L23: const { execFile } = require("node:child_process"); L24: const hdoc = require(path.join(__dirname, "hdoc-module.js")); L25: L26: const sha1 = (data) => L27: crypto.createHash("sha1").update(Buffer.from(data)).digest("hex"); L28: const { create_content_handler, build_nav_inline } = require( ... L92: const broadcast = (evt) => { L93: const data = `data: ${JSON.stringify(evt)}\n\n`; L94: for (const c of sse_clients) { ... L618: : 4096; L619: const AI_ENDPOINT = "https://api.anthropic.com/v1/messages";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hdoc-edit.jsView on unpkg · L22

ui/css/theme-default/fonts/inter-roman-greek.woff2View file

•path = ui/css/theme-default/fonts/inter-roman-greek.woff2 kind = high_entropy_blob sizeBytes = 21776 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/css/theme-default/fonts/inter-roman-greek.woff2View on unpkg

ui/js/mermaid.min.jsView file

•path = ui/js/mermaid.min.js kind = oversized_source_file sizeBytes = 4712175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/js/mermaid.min.jsView on unpkg

Findings

3 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobui/css/theme-default/fonts/inter-roman-greek.woff2

HighOversized Source Fileui/js/mermaid.min.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirehdoc-install-browser.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptohdoc-edit.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 21-61json

21 "hdoc-init.js",

22 "hdoc-install-browser.js",

23 "hdoc-mermaid.js",

24 "hdoc-module.js",

25 "hdoc-serve.js",

26 "hdoc-stats.js",

27 "hdoc-validate.js",

28 "hdoc-validate-config.js",

29 "hdoc-ver.js",

30 "validateNodeVer.js",

31 ".puppeteerrc.cjs",

32 "ui",

33 "custom_modules",

34 "schemas",

35 "templates",

36 "templates/init/.npmignore",

37 "templates/init/gitignore",

38 "npm-shrinkwrap.json"

39 ],

40 "scripts": {

41 "preinstall": "node validateNodeVer",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "test": "echo \"Error: no test specified\" && exit 1",

43 "postinstall": "node hdoc-install-browser.js"

44 },

45 "author": "Hornbill Technologies Ltd",

46 "license": "ISC",

47 "dependencies": {

48 "@mermaid-js/layout-elk": "0.2.1",

49 "american-british-english-translator": "0.2.1",

50 "archiver": "8.0.0",

51 "better-sqlite3": "12.11.1",

52 "cheerio": "1.2.0",

53 "compression": "1.8.1",

54 "express": "5.2.1",

55 "markdown-it": "14.2.0",

56 "markdown-it-container": "4.0.0",

57 "markdown-it-front-matter": "0.2.4",

58 "mermaid": "11.15.0",

59 "puppeteer": "25.1.0"

60 }

61}

hdoc-install-browser.jsView file

Lines 1-41javascript

1// Resilient browser provisioning for hdoc-tools.

2//

3// Replaces the old `puppeteer browsers install ...` one-liner postinstall.

4// Puppeteer's own bundled download (install.mjs) is disabled via

5// .puppeteerrc.cjs (skipDownload), so this script is the single, controlled

6// place Chrome + chrome-headless-shell are fetched.

7//

8// Why: on some Windows Server 2019 build agents the Chrome archive extracts

9// only partially (Defender quarantining binaries mid-extract, or a truncated

10// download behind a proxy). The first failure leaves the version folder on

11// disk, after which Puppeteer refuses to re-extract and every later install

hdoc-edit.jsView file

Lines 2-42javascript

2//

3// This is the write-capable sibling of `hdoc serve`. It reuses the SAME

4// /_books/* content + render pipeline (via hdoc-content-routes.js) so the

5// editor's live preview is byte-identical to published output, and it serves

6// a SEPARATE UI surface from editor/ (React + Vite, built to editor/dist).

7//

8// Key differences from `hdoc serve`:

9// - binds 127.0.0.1 only (it has write access; must not be reachable on the LAN)

10// - serves the editor SPA, not the Vue viewer in ui/

11// - will host write routes (/api/toc, /api/page/:id, /api/move) in later phases

12//

ui/css/theme-default/fonts/inter-roman-greek.woff2View file

•path = ui/css/theme-default/fonts/inter-roman-greek.woff2 kind = high_entropy_blob sizeBytes = 21776 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/css/theme-default/fonts/inter-roman-greek.woff2View on unpkg

ui/js/mermaid.min.jsView file

•path = ui/js/mermaid.min.js kind = oversized_source_file sizeBytes = 4712175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/js/mermaid.min.jsView on unpkg