registry  /  kumidocs  /  0.20260702.125

kumidocs@0.20260702.125

A developer-focused wiki/docs platform with zero database: all content stored in Git.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 376 KB of source, external domains: example.com, github.com, jedwatson.github.io, react.dev, reactjs.org
Oversized source lightweight scan
dist/public/chunk-b5xgn41v.js66.1 MB file, sampled 256 KB
ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringsexample.comgithub.comjedwatson.github.ioreact.devreactjs.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = bun scripts/postinstall.ts
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = bun scripts/postinstall.ts
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
58`)?Z:`${Z} L59: `;await Bun.write(X,Q),I.set(J,Q),G0()}async function F1(J,Z){let $=c.join(Z.repoPath,J);await h6($),I.delete(J),G0()}async function i3(J,Z){let $=c.join(Z.repoPath,J);try{let X=aw... L60: `).map((Y)=>{let[Q="",z="",V="",G="",K=""]=Y.split("\x1F");return{author:V,authorEmail:G,date:K,fullSha:Q,message:z,sha:Q.slice(0,7)}})}async function Y8(J,Z,$=50){let X=await T(J....
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L58
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string> L46: * ... L50: `?J+` L51: `:J}});var b3=F((RY,y3)=>{var _6=r0();y3.exports=function(J,Z){let $=_6(Z);if(J.data==null)J.data={};if(typeof $.excerpt==="function")return $.excerpt(J,$);let X=J.data.excerpt_sep... L52: `+$.delimiters[1],Q=J.content;if($.language)J.language=$.language;let z=X.length;if(!c3.startsWith(Q,X,z))return p3(J,$),J;if(Q.charAt(z)===X.slice(-1))return J;Q=Q.slice(z);let V=... L53: `)J.content=J.content.slice(1)}if(p3(J,$),$.sections===!0||typeof $.section==="function")k6(J,$.section);return J}v.engines=y6;v.stringify=function(J,Z,$){if(typeof J==="string")J=... L54: `)}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L43
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L43
dist/public/chunk-b5xgn41v.jsView file
•path = dist/public/chunk-b5xgn41v.js kind = oversized_source_file sizeBytes = 69325150 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/chunk-b5xgn41v.jsView on unpkg

Findings

4 High3 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighCommand Output Exfiltrationdist/index.js
HighOversized Source Filedist/public/chunk-b5xgn41v.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings