registry / markdown-matters / 0.3.5

markdown-matters@0.3.5

Token-efficient markdown analysis tool for LLM consumption

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 176 file(s), 1.79 MB of source, external domains: aider.chat, api.anthropic.com, api.openai.com, api.voyageai.com, claude.ai, custom-endpoint.example.com, developers.openai.com, docs.voyageai.com, example.com, github.com, google.com, ignore.example, ignored.example, json-schema.org, my-openai-proxy.example, my-proxy.example, ollama.com, openrouter.ai, proxy.example

Source & flagged code

7 flagged

package.jsonView file

Lines 2-42json

2 "name": "markdown-matters",

3 "version": "0.3.5",

4 "description": "Token-efficient markdown analysis tool for LLM consumption",

5 "type": "module",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/srobinson/markdown-matters.git"

9 },

10 "publishConfig": {

11 "access": "public",

12 "provenance": true

13 },

14 "main": "./dist/index.js",

15 "types": "./dist/index.d.ts",

16 "bin": {

17 "markdown-matters": "./dist/cli/main.js",

18 "mdm": "./dist/cli/main.js",

19 "mdm-mcp": "./dist/mcp/server.js"

20 },

21 "scripts": {

22 "postinstall": "node scripts/rebuild-hnswlib.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

23 "build": "tsup src/cli/main.ts src/mcp/server.ts src/index.ts --format esm --dts --external @huggingface/transformers",

24 "dev": "tsc --watch",

25 "test": "vitest run",

26 "test:all": "INCLUDE_EMBED_TESTS=true vitest run",

27 "test:rebuild": "REBUILD_TEST_INDEX=true vitest run",

28 "test:all:rebuild": "REBUILD_TEST_INDEX=true INCLUDE_EMBED_TESTS=true vitest run",

29 "test:watch": "vitest",

30 "typecheck": "tsc --noEmit",

31 "lint": "biome lint --write .",

32 "format": "biome format --write . && biome check --write .",

33 "check": "pnpm format && pnpm lint && pnpm typecheck",

34 "clean": "rm -rf dist",

35 "quality": "pnpm build && npx publint && npx attw --pack .",

36 "prepublishOnly": "pnpm build && pnpm test && pnpm typecheck",

37 "release": "npm publish --provenance --access public"

38 },

39 "keywords": [

40 "markdown",

41 "llm",

42 "ai",

dist/cli/main.jsView file

Lines 2007-2047javascript

2007 if (json) {

2008 yield* Console5.log(formatJson({ active }, pretty));

2009 } else {

2010 yield* Console5.log(`Active namespace: ${active.namespace}`

src/cli/cli.test.tsView file

Lines 5-45typescript

5 *

6 * Test fixture setup:

7 * - beforeAll:

8 * - When REBUILD_TEST_INDEX=true: Builds index (documents, sections, links)

dist/chunk-6IZ32RGY.jsView file

Lines 329-369javascript

329// src/parser/parser.ts

330var processor = unified().use(remarkParse).use(remarkGfm);

331var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n

scripts/rebuild-hnswlib.jsView file

Lines 25-59javascript

26 return null;

27}

29const hnswlibDir = findHnswlibDir();

31if (!hnswlibDir) {

scripts/setup-branch-protection.shView file

•path = scripts/setup-branch-protection.sh kind = build_helper sizeBytes = 1804 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-branch-protection.shView on unpkg

src/cli/error-handler.test.tsView file

Lines 254-294typescript

254describe('security: API key redaction in formatError output', () => {

255 it('formatError does not include raw API key in formatted output', () => {

256 const error = new EmbeddingError({

Source & flagged code

7 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code