registry  /  kumidocs  /  0.20260630.121

kumidocs@0.20260630.121

A developer-focused wiki/docs platform with zero database: all content stored in Git.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 375 KB of source, external domains: example.com, github.com, jedwatson.github.io, react.dev, reactjs.org
Oversized source lightweight scan
dist/public/chunk-t5sfmb8t.js66.1 MB file, sampled 256 KB
ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringsexample.comgithub.comjedwatson.github.ioreact.devreactjs.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = bun scripts/postinstall.ts
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = bun scripts/postinstall.ts
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
58`)?Z:`${Z} L59: `;await Bun.write(X,Q),x.set(J,Q),V0()}async function D1(J,Z){let $=p.join(Z.repoPath,J);await bZ($),x.delete(J),V0()}async function d3(J,Z){let $=p.join(Z.repoPath,J);try{let X=aw... L60: `).map((Y)=>{let[Q="",z="",V="",G="",K=""]=Y.split("\x1F");return{author:V,authorEmail:G,date:K,fullSha:Q,message:z,sha:Q.slice(0,7)}})}async function t3(J,Z,$=50){let X=await T(J....
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L58
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string> L46: * ... L50: `?J+` L51: `:J}});var I3=F((MY,x3)=>{var RZ=p0();x3.exports=function(J,Z){let $=RZ(Z);if(J.data==null)J.data={};if(typeof $.excerpt==="function")return $.excerpt(J,$);let X=J.data.excerpt_sep... L52: `+$.delimiters[1],Q=J.content;if($.language)J.language=$.language;let z=X.length;if(!g3.startsWith(Q,X,z))return f3(J,$),J;if(Q.charAt(z)===X.slice(-1))return J;Q=Q.slice(z);let V=... L53: `)J.content=J.content.slice(1)}if(f3(J,$),$.sections===!0||typeof $.section==="function")wZ(J,$.section);return J}v.engines=SZ;v.stringify=function(J,Z,$){if(typeof J==="string")J=... L54: `)}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L43
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L43
dist/public/chunk-t5sfmb8t.jsView file
•path = dist/public/chunk-t5sfmb8t.js kind = oversized_source_file sizeBytes = 69324631 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/chunk-t5sfmb8t.jsView on unpkg

Findings

4 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighCommand Output Exfiltrationdist/index.js
HighOversized Source Filedist/public/chunk-t5sfmb8t.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings