registry  /  libghostty-bun  /  0.1.0

libghostty-bun@0.1.0

bun:ffi bindings for libghostty-vt (the zero-dependency VT parser/state library from ghostty).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystem
Supply chain
HighEntropyStringsUrlStrings
Manifest
WildcardDependency
scanned 7 file(s), 32.4 KB of source, external domains: github.com, ziglang.org

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = bun run scripts/postinstall.ts
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = bun run scripts/postinstall.ts
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
scripts/build.tsView file
38L39: const IS_WIN = process.platform === "win32"; L40: const IS_MAC = process.platform === "darwin"; ... L49: cwd: opts.cwd ?? ROOT, L50: env: { ...process.env, ...(opts.env ?? {}) }, L51: stdout: "inherit", L52: stderr: "inherit", ... L59: const proc = Bun.spawn(cmd, { cwd, stdout: "pipe", stderr: "pipe" }); L60: const out = await new Response(proc.stdout).text(); L61: await proc.exited; ... L91: mkdirSync(VENDOR, { recursive: true }); L92: const url = `https://ziglang.org/download/${ZIG_VERSION}/${name}.${ext}`;
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/build.tsView on unpkg · L38
prebuilds/ghostty_vt_shim.soView file
•path = prebuilds/ghostty_vt_shim.so kind = native_binary sizeBytes = 16416 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

prebuilds/ghostty_vt_shim.soView on unpkg

Findings

2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/build.ts
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryprebuilds/ghostty_vt_shim.so
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings