registry / muon-ui / 0.13.0

muon-ui@0.13.0

A multi-platform GUI application framework that uses CEF as its backend

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 463 KB of source

Source & flagged code

4 flagged

dist/vite-internals-6HS7FULY.cjsView file

Lines 12-52javascript

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __getProtoOf = Object.getPrototypeOf;

16var __hasOwnProp = Object.prototype.hasOwnProperty;

17var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

18var __copyProps = (to, from, except, desc) => {

19 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

20 key = keys[i];

21 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

22 get: ((k) => from[k]).bind(null, key),

23 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

24 });

25 }

26 return to;

27};

28var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

29 value: mod,

30 enumerable: true

31}) : target, mod));

32//#endregion

33let node_child_process = require("node:child_process");

34let node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/vite-internals-6HS7FULY.cjsView on unpkg · L32

35let node_fs_promises = require("node:fs/promises");

36let node_url = require("node:url");

37let node_path = require("node:path");

38let node_crypto = require("node:crypto");

39let node_os = require("node:os");

40let adm_zip = require("adm-zip");

41adm_zip = __toESM(adm_zip, 1);

42let sharp = require("sharp");

43sharp = __toESM(sharp, 1);

44//#region src/targets.ts

45/**

46* Supported public muon targets in deterministic build order.

47*/

48var allMuonTargets = [

49 "linux-amd64",

50 "linux-armhf",

51 "linux-arm64",

52 "windows-i686",

dist/vite.mjsView file

Lines 1-26javascript

1/*!

2* name: muon-ui

3* version: 0.13.0

4* description: A multi-platform GUI application framework that uses CEF as its backend

5* author: Kouji Matsui (@kekyo@mi.kekyo.net)

6* license: MIT

7* repository.url: https://github.com/kekyo/muon-ui.git

8* git.commit.hash: 8eedbe10e5a89eef8f7061d528518353bd09083e

9*/

10import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";

11import { constants, existsSync, readFileSync, writeFileSync } from "node:fs";

12import { access, chmod, copyFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";

13import { createHash, randomBytes } from "node:crypto";

14import { tmpdir } from "node:os";

15import { fileURLToPath } from "node:url";

16import __screwUpDefaultImportModule0 from "adm-zip";

17import { spawn } from "node:child_process";

18import * as __screwUpDefaultImportModule0$1 from "sharp";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vite.mjsView on unpkg · L6

19//#region \0rolldown/runtime.js

20var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

21//#endregion

22//#region src/embed-config.ts

23var import_dist = (/* @__PURE__ */ __commonJSMin(((exports, module) => {

24 (function(global, factory) {

25 typeof exports === "object" && typeof module !== "undefined" ? module.exports = factory() : typeof define === "function" && define.amd ? define(factory) : global.JSON5 = factory();

26 })(exports, (function() {

dist/cli.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/*!

3* name: muon-ui

4* version: 0.13.0

5* description: A multi-platform GUI application framework that uses CEF as its backend

6* author: Kouji Matsui (@kekyo@mi.kekyo.net)

7* license: MIT

8* repository.url: https://github.com/kekyo/muon-ui.git

9* git.commit.hash: 8eedbe10e5a89eef8f7061d528518353bd09083e

10*/

11const require_vite_internals = require("./vite-internals-6HS7FULY.cjs");

12let commander = require("commander");

13let node_child_process = require("node:child_process");

14let node_fs = require("node:fs");

15let node_fs_promises = require("node:fs/promises");

16let node_path = require("node:path");

17let adm_zip = require("adm-zip");

18adm_zip = require_vite_internals.__toESM(adm_zip, 1);

19let tar_vern = require("tar-vern");

20//#region src/dev.ts

21var import_dist = require_vite_internals.require_dist();

22var muonRecycleExitCode = 88;

23var defaultProjectConfigFileNames = [

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L7

24 "muon.json5",

25 "muon.jsonc",

26 "muon.json"

27];

dist/native/linux-armhf/muon-builderView file

•path = dist/native/linux-armhf/muon-builder kind = native_binary sizeBytes = 1030284 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-armhf/muon-builderView on unpkg

Source & flagged code

4 flagged · loading source

dist/vite-internals-6HS7FULY.cjsView file

32//#endregion L33: let node_child_process = require("node:child_process"); L34: let node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/vite-internals-6HS7FULY.cjsView on unpkg · L32

dist/vite.mjsView file

6* license: MIT L7: * repository.url: https://github.com/kekyo/muon-ui.git L8: * git.commit.hash: [redacted] ... L16: import __screwUpDefaultImportModule0 from "adm-zip"; L17: import { spawn } from "node:child_process"; L18: import * as __screwUpDefaultImportModule0$1 from "sharp"; ... L214: if (i < 0 || i >= l) return TO_STRING ? "" : void 0; L215: a = s.charCodeAt(i); L216: return a < 55296 || a > 56319 || i + 1 === l || (b = s.charCodeAt(i + 1)) < 56320 || b > 57343 ? TO_STRING ? s.charAt(i) : a : TO_STRING ? s.slice(i, i + 2) : (a - 55296 << 10) + (... ... L1744: const writeRaw = (chunk) => { L1745: process.stderr.write(chunk); L1746: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vite.mjsView on unpkg · L6

dist/cli.cjsView file

7Cross-file remote execution chain: dist/cli.cjs spawns dist/vite-internals-6HS7FULY.cjs; helper contains network access plus dynamic code execution. L7: * license: MIT L8: * repository.url: https://github.com/kekyo/muon-ui.git L9: * git.commit.hash: [redacted] ... L12: let commander = require("commander"); L13: let node_child_process = require("node:child_process"); L14: let node_fs = require("node:fs"); ... L21: var import_dist = require_vite_internals.require_dist(); L22: var muonRecycleExitCode = 88; L23: var defaultProjectConfigFileNames = [ ... L90: }; L91: const previous = process.env[require_vite_internals.[redacted]]; L92: process.env[require_vite_internals.[redacted]] = "1";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L7

dist/native/linux-armhf/muon-builderView file

•path = dist/native/linux-armhf/muon-builder kind = native_binary sizeBytes = 1030284 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-armhf/muon-builderView on unpkg

Findings

3 High3 Medium4 Low

HighChild Processdist/vite-internals-6HS7FULY.cjs

HighShell

HighCross File Remote Execution Contextdist/cli.cjs

MediumEnvironment Vars

MediumShips Native Binarydist/native/linux-armhf/muon-builder

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/vite.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/vite-internals-6HS7FULY.cjsView file

Lines 12-52javascript

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __getProtoOf = Object.getPrototypeOf;

16var __hasOwnProp = Object.prototype.hasOwnProperty;

17var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

18var __copyProps = (to, from, except, desc) => {

19 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

20 key = keys[i];

21 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

22 get: ((k) => from[k]).bind(null, key),

23 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

24 });

25 }

26 return to;

27};

28var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

29 value: mod,

30 enumerable: true

31}) : target, mod));

32//#endregion

33let node_child_process = require("node:child_process");

34let node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/vite-internals-6HS7FULY.cjsView on unpkg · L32

35let node_fs_promises = require("node:fs/promises");

36let node_url = require("node:url");

37let node_path = require("node:path");

38let node_crypto = require("node:crypto");

39let node_os = require("node:os");

40let adm_zip = require("adm-zip");

41adm_zip = __toESM(adm_zip, 1);

42let sharp = require("sharp");

43sharp = __toESM(sharp, 1);

44//#region src/targets.ts

45/**

46* Supported public muon targets in deterministic build order.

47*/

48var allMuonTargets = [

49 "linux-amd64",

50 "linux-armhf",

51 "linux-arm64",

52 "windows-i686",

dist/vite.mjsView file

Lines 1-26javascript

1/*!

2* name: muon-ui

3* version: 0.13.0

4* description: A multi-platform GUI application framework that uses CEF as its backend

5* author: Kouji Matsui (@kekyo@mi.kekyo.net)

6* license: MIT

7* repository.url: https://github.com/kekyo/muon-ui.git

8* git.commit.hash: 8eedbe10e5a89eef8f7061d528518353bd09083e

9*/

10import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";

11import { constants, existsSync, readFileSync, writeFileSync } from "node:fs";

12import { access, chmod, copyFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";

13import { createHash, randomBytes } from "node:crypto";

14import { tmpdir } from "node:os";

15import { fileURLToPath } from "node:url";

16import __screwUpDefaultImportModule0 from "adm-zip";

17import { spawn } from "node:child_process";

18import * as __screwUpDefaultImportModule0$1 from "sharp";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vite.mjsView on unpkg · L6

19//#region \0rolldown/runtime.js

20var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

21//#endregion

22//#region src/embed-config.ts

23var import_dist = (/* @__PURE__ */ __commonJSMin(((exports, module) => {

24 (function(global, factory) {

25 typeof exports === "object" && typeof module !== "undefined" ? module.exports = factory() : typeof define === "function" && define.amd ? define(factory) : global.JSON5 = factory();

26 })(exports, (function() {

dist/cli.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/*!

3* name: muon-ui

4* version: 0.13.0

5* description: A multi-platform GUI application framework that uses CEF as its backend

6* author: Kouji Matsui (@kekyo@mi.kekyo.net)

7* license: MIT

8* repository.url: https://github.com/kekyo/muon-ui.git

9* git.commit.hash: 8eedbe10e5a89eef8f7061d528518353bd09083e

10*/

11const require_vite_internals = require("./vite-internals-6HS7FULY.cjs");

12let commander = require("commander");

13let node_child_process = require("node:child_process");

14let node_fs = require("node:fs");

15let node_fs_promises = require("node:fs/promises");

16let node_path = require("node:path");

17let adm_zip = require("adm-zip");

18adm_zip = require_vite_internals.__toESM(adm_zip, 1);

19let tar_vern = require("tar-vern");

20//#region src/dev.ts

21var import_dist = require_vite_internals.require_dist();

22var muonRecycleExitCode = 88;

23var defaultProjectConfigFileNames = [

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L7

24 "muon.json5",

25 "muon.jsonc",

26 "muon.json"

27];

dist/native/linux-armhf/muon-builderView file

•path = dist/native/linux-armhf/muon-builder kind = native_binary sizeBytes = 1030284 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-armhf/muon-builderView on unpkg