registry  /  kumidocs  /  0.20260704.132

kumidocs@0.20260704.132

A developer-focused wiki/docs platform with zero database: all content stored in Git.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 381 KB of source, external domains: github.com, jedwatson.github.io, react.dev, reactjs.org
Oversized source lightweight scan
dist/public/chunk-rd60fdez.js16.0 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsgithub.comjedwatson.github.ioreact.devreactjs.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = bun scripts/postinstall.ts
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = bun scripts/postinstall.ts
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
52`+$.delimiters[1],Q=J.content;if($.language)J.language=$.language;let z=X.length;if(!$3.startsWith(Q,X,z))return Z3(J,$),J;if(Q.charAt(z)===X.slice(-1))return J;Q=Q.slice(z);let V=... L53: `)J.content=J.content.slice(1)}if(Z3(J,$),$.sections===!0||typeof $.section==="function")U$(J,$.section);return J}k.engines=B$;k.stringify=function(J,Z,$){if(typeof J==="string")J=... L54: `)}
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L52
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string> L46: * ... L52: `+$.delimiters[1],Q=J.content;if($.language)J.language=$.language;let z=X.length;if(!$3.startsWith(Q,X,z))return Z3(J,$),J;if(Q.charAt(z)===X.slice(-1))return J;Q=Q.slice(z);let V=... L53: `)J.content=J.content.slice(1)}if(Z3(J,$),$.sections===!0||typeof $.section==="function")U$(J,$.section);return J}k.engines=B$;k.stringify=function(J,Z,$){if(typeof J==="string")J=... L54: `)}
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L43
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string> L46: * ... L50: `?J+` L51: `:J}});var i8=F((MX,o8)=>{var Q$=i0();o8.exports=function(J,Z){let $=Q$(Z);if(J.data==null)J.data={};if(typeof $.excerpt==="function")return $.excerpt(J,$);let X=J.data.excerpt_sep... L52: `+$.delimiters[1],Q=J.content;if($.language)J.language=$.language;let z=X.length;if(!$3.startsWith(Q,X,z))return Z3(J,$),J;if(Q.charAt(z)===X.slice(-1))return J;Q=Q.slice(z);let V=... L53: `)J.content=J.content.slice(1)}if(Z3(J,$),$.sections===!0||typeof $.section==="function")U$(J,$.section);return J}k.engines=B$;k.stringify=function(J,Z,$){if(typeof J==="string")J=... L54: `)}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L43
43return `+str.trim()+`; L44: }());`;return eval(str)||{}}catch(J){if(wrap!==!1&&/(unexpected|identifier)/i.test(J.message))return parse(str,options,!1);throw SyntaxError(J)}},stringify:function(){throw Error("... L45: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L43
dist/public/chunk-rd60fdez.jsView file
•path = dist/public/chunk-rd60fdez.js kind = oversized_source_file sizeBytes = 16793008 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/chunk-rd60fdez.jsView on unpkg

Findings

5 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighOversized Source Filedist/public/chunk-rd60fdez.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings