registry  /  margins-cli  /  0.12.0

margins-cli@0.12.0

CLI for Margins — sync and review Markdown in Git

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 42 file(s), 698 KB of source, external domains: 127.0.0.1, auth.example.com, datatracker.ietf.org, github.com, json-schema.org, margins.thealvistar.com, raw.githubusercontent.com

Source & flagged code

5 flagged · loading source
dist/open-Cc9SU1qE.mjsView file
1#!/usr/bin/env node L2: import childProcess, { execFile } from "node:child_process"; L3: import path from "node:path";
High
Child Process

Package source references child process execution.

dist/open-Cc9SU1qE.mjsView on unpkg · L1
87})(); L88: const powerShellPathFromWsl = async () => { L89: return `${await wslDrivesMountPoint()}[redacted].0/powershell.exe`;
High
Shell

Package source references shell execution.

dist/open-Cc9SU1qE.mjsView on unpkg · L87
dist/config-HnkTjvGH.mjsView file
3065ref: validation_error_1.default, L3066: code: (0, codegen_1._)`require("ajv/dist/runtime/validation_error").default` L3067: });
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/config-HnkTjvGH.mjsView on unpkg · L3065
3104if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3105: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3106: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/config-HnkTjvGH.mjsView on unpkg · L3104
dist/index.mjsView file
14Cross-file remote execution chain: dist/index.mjs spawns dist/config-HnkTjvGH.mjs; helper contains network access plus dynamic code execution. L14: * Constructs the CommanderError class L15: * @param {number} exitCode suggested exit code which could be used with process.exit L16: * @param {string} code an id string representing the error ... L161: * @return {string} L162: * @private L163: */ ... L177: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L178: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L179: * @typedef { import("./argument.js").Argument } Argument ... L1026: const EventEmitter = __require("node:events").EventEmitter; L1027: const childProcess = __require("node:child_process"); L1028: const path = __require("node:path");
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L14

Findings

3 High4 Medium7 Low
HighChild Processdist/open-Cc9SU1qE.mjs
HighShelldist/open-Cc9SU1qE.mjs
HighCross File Remote Execution Contextdist/index.mjs
MediumDynamic Requiredist/config-HnkTjvGH.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/config-HnkTjvGH.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License