registry / mdview-app / 0.0.2

mdview-app@0.0.2

A lightweight Markdown viewer with themes, fonts, zoom, and local file support

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 4.70 MB of source, external domains: cdn.jsdelivr.net, cdnjs.cloudflare.com, chevrotain.io, en.wikipedia.org, fonts.googleapis.com, github.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, openjsf.org, opensource.org, reactjs.org, tldrlegal.com, underscorejs.org, www.ibm.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.0.2",

4 "description": "A lightweight Markdown viewer with themes, fonts, zoom, and local file support",

5 "main": "electron/main.js",

6 "bin": {

7 "mdview": "./bin/mdview.js"

8 },

9 "files": [

10 "dist/**/*",

11 "electron/**/*",

12 "bin/**/*",

13 "*.ps1"

14 ],

15 "scripts": {

16 "dev": "concurrently \"vite\" \"wait-on tcp:3000 -t 10000 && electron .\"",

17 "build": "vite build",

18 "build:win": "vite build && electron-builder --win",

19 "build:portable": "vite build && electron-builder --win --config.win.target=portable",

20 "build:nsis": "vite build && electron-builder --win --config.win.target=nsis",

21 "preview": "vite preview",

22 "start": "electron .",

23 "postinstall": "electron-builder install-app-deps"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "highlight.js": "^11.11.1",

27 "html2canvas": "^1.4.1",

28 "jspdf": "^4.2.1",

29 "katex": "^0.16.22",

30 "lucide-react": "^0.468.0",

31 "mermaid": "^11.4.1",

32 "react": "^18.2.0",

33 "react-dom": "^18.2.0",

34 "react-markdown": "^9.0.1",

35 "rehype-highlight": "^7.0.2",

36 "rehype-katex": "^7.0.1",

37 "rehype-raw": "^7.0.0",

38 "remark-gfm": "^4.0.0",

39 "remark-math": "^6.0.0",

40 "zustand": "^5.0.5"

41 },

42 "devDependencies": {

43 "@types/react": "^18.3.18",

bin/mdview.batView file

•path = bin/mdview.bat kind = build_helper sizeBytes = 347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mdview.batView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/cytoscape.esm-DTSO7Bv0.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/cytoscape.esm-DTSO7Bv0.jsView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code