registry / mdview-app / 0.0.3

mdview-app@0.0.3

A lightweight Markdown viewer with themes, fonts, zoom, and local file support

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 4.70 MB of source, external domains: cdn.jsdelivr.net, cdnjs.cloudflare.com, chevrotain.io, en.wikipedia.org, fonts.googleapis.com, github.com, jquery.org, jspdf.default.namespaceuri, langium.org, lodash.com, openjsf.org, opensource.org, reactjs.org, tldrlegal.com, underscorejs.org, www.ibm.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-41json

2 "name": "mdview-app",

3 "version": "0.0.3",

4 "description": "A lightweight Markdown viewer with themes, fonts, zoom, and local file support",

5 "main": "electron/main.js",

6 "bin": "./bin/mdview.js",

7 "files": [

8 "dist/**/*",

9 "electron/**/*",

10 "bin/**/*",

11 "*.ps1"

12 ],

13 "scripts": {

14 "dev": "concurrently \"vite\" \"wait-on tcp:3000 -t 10000 && electron .\"",

15 "build": "vite build",

16 "build:win": "vite build && electron-builder --win",

17 "build:portable": "vite build && electron-builder --win --config.win.target=portable",

18 "build:nsis": "vite build && electron-builder --win --config.win.target=nsis",

19 "preview": "vite preview",

20 "start": "electron .",

21 "postinstall": "electron-builder install-app-deps"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "dependencies": {

24 "highlight.js": "^11.11.1",

25 "html2canvas": "^1.4.1",

26 "jspdf": "^4.2.1",

27 "katex": "^0.16.22",

28 "lucide-react": "^0.468.0",

29 "mermaid": "^11.4.1",

30 "react": "^18.2.0",

31 "react-dom": "^18.2.0",

32 "react-markdown": "^9.0.1",

33 "rehype-highlight": "^7.0.2",

34 "rehype-katex": "^7.0.1",

35 "rehype-raw": "^7.0.0",

36 "remark-gfm": "^4.0.0",

37 "remark-math": "^6.0.0",

38 "zustand": "^5.0.5"

39 },

40 "devDependencies": {

41 "@types/react": "^18.3.18",

bin/mdview.batView file

•path = bin/mdview.bat kind = build_helper sizeBytes = 347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mdview.batView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/cytoscape.esm-DTSO7Bv0.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/cytoscape.esm-DTSO7Bv0.jsView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code