registry / notionwiki / 0.1.4

notionwiki@0.1.4

One-way ingestion bridge: pulls a Notion workspace into the raw layer of an LLM Wiki. npm wrapper over the Python CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 181 KB of source, external domains: docs.astral.sh, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "notionwiki",

3 "version": "0.1.4",

4 "description": "One-way ingestion bridge: pulls a Notion workspace into the raw layer of an LLM Wiki. npm wrapper over the Python CLI.",

5 "keywords": ["notion", "wiki", "llm", "ingestion", "markdown", "cli"],

6 "license": "MIT",

7 "homepage": "https://github.com/HemachandranD/notionwiki#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/HemachandranD/notionwiki.git"

11 },

12 "bin": {

13 "notionwiki": "bin/notionwiki.js",

14 "nw": "bin/notionwiki.js"

15 },

16 "scripts": {

17 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 },

19 "files": [

20 "bin/",

21 "scripts/",

22 "src/**/*.py",

23 "src/notion_wiki/graph/static/*.js",

24 "pyproject.toml",

25 "uv.lock",

26 "README.md",

27 "LICENSE"

28 ],

29 "engines": {

30 "node": ">=16"

31 },

32 "os": ["darwin", "linux", "win32"]

33}

bin/notionwiki.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// npm `bin` shim for both `notionwiki` and `nw`.

3//

4// Ensures the managed Python runtime exists (bootstrapping on first run if the

5// postinstall step was skipped, e.g. `--ignore-scripts`), then execs the real

6// Python CLI with every argument passed straight through.

8"use strict";

10const { spawnSync } = require("child_process");

src/notion_wiki/schedule/macos.pyView file

•path = src/notion_wiki/schedule/macos.py kind = build_helper sizeBytes = 1666 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/notion_wiki/schedule/macos.pyView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/notionwiki.jsView file

9L10: const { spawnSync } = require("child_process"); L11: const { ensureRuntime } = require("../scripts/bootstrap.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/notionwiki.jsView on unpkg · L9

src/notion_wiki/schedule/macos.pyView file

•path = src/notion_wiki/schedule/macos.py kind = build_helper sizeBytes = 1666 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/notion_wiki/schedule/macos.pyView on unpkg

Findings

1 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/notionwiki.js

MediumEnvironment Vars

MediumShips Build Helpersrc/notion_wiki/schedule/macos.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "notionwiki",

3 "version": "0.1.4",

4 "description": "One-way ingestion bridge: pulls a Notion workspace into the raw layer of an LLM Wiki. npm wrapper over the Python CLI.",

5 "keywords": ["notion", "wiki", "llm", "ingestion", "markdown", "cli"],

6 "license": "MIT",

7 "homepage": "https://github.com/HemachandranD/notionwiki#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/HemachandranD/notionwiki.git"

11 },

12 "bin": {

13 "notionwiki": "bin/notionwiki.js",

14 "nw": "bin/notionwiki.js"

15 },

16 "scripts": {

17 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 },

19 "files": [

20 "bin/",

21 "scripts/",

22 "src/**/*.py",

23 "src/notion_wiki/graph/static/*.js",

24 "pyproject.toml",

25 "uv.lock",

26 "README.md",

27 "LICENSE"

28 ],

29 "engines": {

30 "node": ">=16"

31 },

32 "os": ["darwin", "linux", "win32"]

33}

bin/notionwiki.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// npm `bin` shim for both `notionwiki` and `nw`.

3//

4// Ensures the managed Python runtime exists (bootstrapping on first run if the

5// postinstall step was skipped, e.g. `--ignore-scripts`), then execs the real

6// Python CLI with every argument passed straight through.

8"use strict";

10const { spawnSync } = require("child_process");

src/notion_wiki/schedule/macos.pyView file

•path = src/notion_wiki/schedule/macos.py kind = build_helper sizeBytes = 1666 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/notion_wiki/schedule/macos.pyView on unpkg