registry / lavish-axi / 0.1.42

lavish-axi@0.1.42

HTML is the new markdown. Lavish is the new editor for your HTML artifacts.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 889 KB of source, external domains: a.kunchenguid.com, api.ht-ml.app, bugs.chromium.org, bugs.webkit.org, bugzilla.mozilla.org, cdn.jsdelivr.net, daisyui.com, en.wikipedia.org, engelschall.com, esm.sh, github.com, ht-ml.app, jquery.org, lodash.com, openjsf.org, opensource.org, player.vimeo.com, tailwindcss.com, tldrlegal.com, underscorejs.org, www.w3.org, www.youtube.com

Oversized source lightweight scan

dist/whiteboard/whiteboard.js7.29 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsTelemetryUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgplayer.vimeo.comtldrlegal.comunderscorejs.orgwww.w3.orgwww.youtube.com

Source & flagged code

7 flagged

dist/cli.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __export = (target, all) => {

4 for (var name in all)

5 __defProp(target, name, { get: all[name], enumerable: true });

6};

8// src/cli.js

9import { spawn, spawnSync } from "node:child_process";

10import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L8

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L8

11import { access, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";

12import os2 from "node:os";

13import path6 from "node:path";

14import { fileURLToPath as fileURLToPath3 } from "node:url";

15import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";

17// src/playbooks.js

18var PLAYBOOK_ROUTER_INSTRUCTION = "MUST open each matching playbook before writing HTML. Match against the use_when trigger; one artifact often combines several playbooks.";

19var PLAYBOOK_ROUTER_HELP = "One artifact often combines several playbooks (for example a plan that includes a comparison and a diagram), so MUST open each matching playbook before writing HTML.";

20var PLAYBOOKS = [

21 {

22 id: "diagram",

23 use_when: "Map relationships, flows, state, and architecture",

24 choose: [

25 "Use Mermaid when automatic node placement and edge routing matter more than rich card content.",

26 "Use CSS grid, SVG, or positioned HTML when each item needs prose, code, controls, or detailed annotations.",

27 "Use a hybrid shape for large systems: a small overview diagram followed by detailed module cards."

28 ],

Lines 7420-7460javascript

7420 hookDir: resolveCopilotHookDir(process.env, resolveHookHomeDir()),

7421 onError: (message) => errors.push(message)

7422 });

7423 if (errors.length > 0) {

7424 throw new AxiError("Failed to install lavish-axi agent hooks", "SERVER_ERROR"

Lines 7658-7698javascript

7658 await ensureStateDir();

7659 const entry = resolveServerEntry();

7660 let logFd = null;

7661 try {

7662 logFd = openSync(serverLogFile(), "a");

7663 } catch {

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View file

•path = dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2 kind = high_entropy_blob sizeBytes = 20232 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View on unpkg

dist/whiteboard/whiteboard.jsView file

•path = dist/whiteboard/whiteboard.js kind = oversized_source_file sizeBytes = 7645822 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/whiteboard/whiteboard.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/cli.mjsView file

8// src/cli.js L9: import { spawn, spawnSync } from "node:child_process"; L10: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L8

7440`const command = ${JSON.stringify(command)};`, L7441: 'const result = spawnSync(command, [], { encoding: "utf8", shell: true });', L7442: 'const detail = result.error ? result.error.message : (result.stderr || result.stdout || "exit " + (result.status ?? "unknown"));',

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L7440

7678const stdio = ( L7679: /** @type {import("node:child_process").StdioOptions} */ L7680: logFd === null ? "ignore" : ["ignore", logFd, logFd] ... L7684: stdio, L7685: env: { ...process.env, LAVISH_AXI_NO_OPEN: "1" } L7686: }; ... L7691: try { L7692: response = await fetch(url); L7693: break;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L7678

8Cross-file remote execution chain: dist/cli.mjs spawns dist/design/tailwindcss-browser.js; helper contains network access plus dynamic code execution. L8: // src/cli.js L9: import { spawn, spawnSync } from "node:child_process"; L10: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs"; ... L150: <script type="module"> L151: import { File, FileDiff } from "https://esm.sh/@pierre/diffs@1.2.10?bundle"; L152: ... L225: "Lavish is strongest when the artifact becomes a focused review surface and not just a static page.", L226: `A native single-choice question should submit the final value: \`<form data-lavish-question="plan" onsubmit="event.preventDefault(); const choice = new FormData(event.currentTarge... L227: "A custom choice UI should make option buttons update local state, then use a separate Queue answer button with data-lavish-action to queue the final selected value.", ... L967: const ctx = { L968: baseDir: options.baseDir || process.cwd(), L969: confineDir,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L8

8Detached bundled service listener: dist/cli.mjs launches a Node helper and exposes a broad-bound HTTP listener. L8: // src/cli.js L9: import { spawn, spawnSync } from "node:child_process"; L10: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs"; ... L150: <script type="module"> L151: import { File, FileDiff } from "https://esm.sh/@pierre/diffs@1.2.10?bundle"; L152: ... L225: "Lavish is strongest when the artifact becomes a focused review surface and not just a static page.", L226: `A native single-choice question should submit the final value: \`<form data-lavish-question="plan" onsubmit="event.preventDefault(); const choice = new FormData(event.currentTarge... L227: "A custom choice UI should make option buttons update local state, then use a separate Queue answer button with data-lavish-action to queue the final selected value.", ... L967: const ctx = { L968: baseDir: options.baseDir || process.cwd(), L969: confineDir,

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L8

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View file

•path = dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2 kind = high_entropy_blob sizeBytes = 20232 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View on unpkg

dist/whiteboard/whiteboard.jsView file

•path = dist/whiteboard/whiteboard.js kind = oversized_source_file sizeBytes = 7645822 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/whiteboard/whiteboard.jsView on unpkg

Findings

7 High3 Medium6 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighSame File Env Network Executiondist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

HighSpawned Bundled Service Listenerdist/cli.mjs

HighShips High Entropy Blobdist/whiteboard/Assistant-Regular-PLF2XOGW.woff2

HighOversized Source Filedist/whiteboard/whiteboard.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/cli.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __export = (target, all) => {

4 for (var name in all)

5 __defProp(target, name, { get: all[name], enumerable: true });

6};

8// src/cli.js

9import { spawn, spawnSync } from "node:child_process";

10import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L8

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L8

11import { access, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";

12import os2 from "node:os";

13import path6 from "node:path";

14import { fileURLToPath as fileURLToPath3 } from "node:url";

15import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";

17// src/playbooks.js

18var PLAYBOOK_ROUTER_INSTRUCTION = "MUST open each matching playbook before writing HTML. Match against the use_when trigger; one artifact often combines several playbooks.";

19var PLAYBOOK_ROUTER_HELP = "One artifact often combines several playbooks (for example a plan that includes a comparison and a diagram), so MUST open each matching playbook before writing HTML.";

20var PLAYBOOKS = [

21 {

22 id: "diagram",

23 use_when: "Map relationships, flows, state, and architecture",

24 choose: [

25 "Use Mermaid when automatic node placement and edge routing matter more than rich card content.",

26 "Use CSS grid, SVG, or positioned HTML when each item needs prose, code, controls, or detailed annotations.",

27 "Use a hybrid shape for large systems: a small overview diagram followed by detailed module cards."

28 ],

Lines 7420-7460javascript

7420 hookDir: resolveCopilotHookDir(process.env, resolveHookHomeDir()),

7421 onError: (message) => errors.push(message)

7422 });

7423 if (errors.length > 0) {

7424 throw new AxiError("Failed to install lavish-axi agent hooks", "SERVER_ERROR"

Lines 7658-7698javascript

7658 await ensureStateDir();

7659 const entry = resolveServerEntry();

7660 let logFd = null;

7661 try {

7662 logFd = openSync(serverLogFile(), "a");

7663 } catch {

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View file

•path = dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2 kind = high_entropy_blob sizeBytes = 20232 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/whiteboard/Assistant-Regular-PLF2XOGW.woff2View on unpkg

dist/whiteboard/whiteboard.jsView file

•path = dist/whiteboard/whiteboard.js kind = oversized_source_file sizeBytes = 7645822 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/whiteboard/whiteboard.jsView on unpkg