Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

markdown-explorer@0.1.3: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / markdown-explorer / 0.1.3

markdown-explorer@0.1.3

Browse and read the markdown files in any directory, in your browser. Three panes: file tree, rendered document, heading outline.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 91.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 382 KB of source, external domains: en.wikipedia.org, engelschall.com, github.com, jquery.org, lodash.com, openjsf.org, opensource.org, tldrlegal.com, underscorejs.org, www.w3.org

Oversized source lightweight scan

public/vendor/mermaid.min.js3.40 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinified

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

UrlStrings

en.wikipedia.org

engelschall.com

github.com

jquery.org

lodash.com

openjsf.org

opensource.org

tldrlegal.com

underscorejs.org

www.w3.org

Source & flagged code

4 flagged · loading source

src/tree.jsView file

120const json = JSON.stringify(tree); L121: const etag = `"${createHash('sha1').update(json).digest('base64url').slice(0, 16)}"`; L122:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tree.jsView on unpkg · L120

src/render.jsView file

8contains invisible/control Unicode U+FEFF (zero width no-break space) const FRONTMATTER_RE = /^<U+FEFF>?---[ \t]*\r?\n([\s\S]*?)^---[ \t]*(?:\r?\n|$)/m;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/render.jsView on unpkg · L8

•Trigger-reachable chain: manifest.bin -> bin/cli.js -> src/server.js -> src/render.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/render.jsView on unpkg

public/vendor/mermaid.min.jsView file

•path = public/vendor/mermaid.min.js kind = oversized_source_file sizeBytes = 3565102 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

public/vendor/mermaid.min.jsView on unpkg

Findings

2 Critical1 High3 Medium5 Low

CriticalTrojan Source Unicodesrc/render.js

CriticalTrigger Reachable Dangerous Capabilitysrc/render.js

HighOversized Source Filepublic/vendor/mermaid.min.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/tree.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

91%Warn

Verdict confidence

TypeCredential Exfiltration

Firewall policyMatched warn-list

Package metadata

npm

Maintainersluytbq43

Version0.1.4

PublishedJul 17, 2026

LicenseMIT

Dependencies2

Integrityverified

Package size1004 KB

Files17

Keywordsmarkdownviewerpreviewclimermaid

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → mdv

Runtimenode >=20

Artifact3.55 MB · 17 files1 signature(s)

Install lifecycleNo install hooks · other: start, test, test:e2e, vendor:mermaid

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsMinifiedUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

src/tree.jsView file

Lines 100-130javascript

100 const children = await walk(root, root, '', 0, state);

101 return {

102 name: path.basename(root),

103 path: '',

104 root, // the client keys its per-project ui state off this

105 type: 'dir',

106 children,

107 fileCount: state.fileCount,

108 truncated: state.truncated,

109 };

110}

111

112let cache = null;

113

114/** Cached for a second, with an ETag so the client's 10s poll costs a 304. */

115export async function getTree(root) {

116 const now = Date.now();

117 if (cache && cache.root === root && now - cache.at < CACHE_MS) return cache.value;

118

119 const tree = await buildTree(root);

120 const json = JSON.stringify(tree);

121 const etag = `"${createHash('sha1').update(json).digest('base64url').slice(0, 16)}"`;

122

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tree.jsView on unpkg · L120

123 cache = { root, at: now, value: { tree, json, etag } };

124 return cache.value;

125}

126

127export function clearTreeCache() {

128 cache = null;

129}

130

src/render.jsView file

Lines 1-28javascript

1import MarkdownIt from 'markdown-it';

2import hljs from 'highlight.js/lib/common';

3import { posix } from 'node:path';

4

5export const MARKDOWN_RE

public/vendor/mermaid.min.jsView file

•path = public/vendor/mermaid.min.js kind = oversized_source_file sizeBytes = 3565102 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

public/vendor/mermaid.min.jsView on unpkg

=

/

\.

(md

|

markdown

|

mdown

|

mkd)

$

/

i

;

6

7const SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;

8const FRONTMATTER_RE = /^?---[ \t]*\r?\n([\s\S]*?)^---[ \t]*(?:\r?\n|$)/m;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/render.jsView on unpkg · L8

9

10/**

11 * GitHub-compatible heading slug.

12 *

13 * \p{L}\p{N} with the u flag, not \w: `\w` is ASCII-only and would turn

14 * "Café Menu" into "caf-menu". Normalising to NFC here is safe and wanted,

15 * because this produces an HTML id, never a filesystem path.

16 */

17export function slugify(text) {

18 const slug = text

19 .normalize('NFC')

20 .toLowerCase()

21 .replace(/[^\p{L}\p{N}\s-]/gu, '')

22 .trim()

23 .replace(/\s+/g, '-')

24 .replace(/-{2,}/g, '-');

25 return slug || 'section';

26}

27

28export function stripFrontmatter(source) {

•Trigger-reachable chain: manifest.bin -> bin/cli.js -> src/server.js -> src/render.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/render.jsView on unpkg