registry / notionwiki / 0.1.4

notionwiki@0.1.4

One-way ingestion bridge: pulls a Notion workspace into the raw layer of an LLM Wiki. npm wrapper over the Python CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 181 KB of source, external domains: docs.astral.sh, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "notionwiki",

3 "version": "0.1.4",

4 "description": "One-way ingestion bridge: pulls a Notion workspace into the raw layer of an LLM Wiki. npm wrapper over the Python CLI.",

5 "keywords": ["notion", "wiki", "llm", "ingestion"

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/notionwiki.jsView file

9L10: const { spawnSync } = require("child_process"); L11: const { ensureRuntime } = require("../scripts/bootstrap.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/notionwiki.jsView on unpkg · L9

src/notion_wiki/schedule/macos.pyView file

•path = src/notion_wiki/schedule/macos.py kind = build_helper sizeBytes = 1666 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/notion_wiki/schedule/macos.pyView on unpkg

Findings

1 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/notionwiki.js

MediumEnvironment Vars

MediumShips Build Helpersrc/notion_wiki/schedule/macos.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

bin/notionwiki.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// npm `bin` shim for both `notionwiki` and `nw`.

3//

4// Ensures the managed Python runtime exists (bootstrapping on first run if the

5// postinstall step was skipped, e.g. `--ignore-scripts`), then execs the real

6// Python CLI with every argument passed straight through.

8"use strict";

10const { spawnSync } = require("child_process");

11const { ensureRuntime } = require("../scripts/bootstrap.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/notionwiki.jsView on unpkg · L9

13let executable;

14try {

15 executable = ensureRuntime();

16} catch (err) {

17 process.stderr.write(`notionwiki: ${err.message}\n`);

18 process.exit(1);

19}

21const result = spawnSync(executable, process.argv.slice(2), { stdio: "inherit" });

23if (result.error) {

24 process.stderr.write(`notionwiki: failed to launch runtime: ${result.error.message}\n`);

25 process.exit(1);

26}

27process.exit(result.status === null ? 1 : result.status);