registry / openwriter / 0.40.0

openwriter@0.40.0

The open-source writing surface for AI agents. Markdown-native editor with pending change review — your agent writes, you accept or reject.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 2.39 MB of source, external domains: 127.0.0.1, api.fxtwitter.com, api.github.com, api.x.com, authors-voice.com, developer.x.com, example.com, git-scm.com, github.com, prosemirror.net, publish.openwriter.io, purl.org, reactjs.org, registry.npmjs.org, twemoji.maxcdn.com, unavatar.io, www.idpf.org, www.w3.org, x.com

Source & flagged code

5 flagged

dist/plugins/github/dist/blog-tools.jsView file

Lines 1-37javascript

1/**

2 * Blog publishing MCP tools — local git ops, no Worker, no PAT.

3 *

4 * Auth: piggybacks on the user's existing `gh auth login`.

5 * Persistence: blogSites in plugins['@openwriter/plugin-github'].blogSites.

6 */

7import { execFile } from 'child_process';

8import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

9import { join, extname, dirname, basename } from 'path';

10import { randomUUID } from 'crypto';

11import { homedir } from 'os';

12import { getServerModules, listBlogSites, writeBlogSites, } from './helpers.js';

13const NETWORK_TIMEOUT = 60000;

14// SECURITY (MCP-1): no shell. `git`/`gh` are spawned directly via execFile

15// with an argv array, so every element — including attacker-influenced blog

16// config values (owner/repo/branch) and slugs — is passed to the program as a

17// single literal argument and is NEVER interpreted by a shell. Do NOT add

18// `shell: true` or hand-roll arg quoting here: that reintroduces OS command

19// injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

20// validate the inputs instead.

21function exec(cmd, args, cwd, timeout = NETWORK_TIMEOUT) {

22 return new Promise((resolve, reject) => {

23 execFile(cmd, args, { cwd, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {

24 if (err)

25 reject(new Error(stderr?.trim() || err.message));

26 else

27 resolve(stdout.trim());

28 });

29 });

30}

31async function ghAuthOk(cwd) {

32 try {

33 await exec('gh', ['auth', 'status'], cwd);

34 return true;

35 }

36 catch {

37 return false;

dist/plugins/x-api/dist/server-bridge.jsView file

Lines 1-36javascript

1/**

2 * Thin runtime bridge to the OpenWriter server modules this plugin needs for

3 * article publishing — the active document, its title/metadata, the data dir,

4 * and the shared TipTap -> DraftJS converter.

5 *

6 * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so

7 * both posting paths produce identical X content_state. We import the compiled

8 * server module at runtime rather than vendoring it, resolving both the npm

9 * package layout and the monorepo layout — the same dual-path trick the publish

10 * plugin's helpers use.

11 */

dist/server/plugin-install.jsView file

Lines 14-54javascript

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

Source & flagged code

5 flagged · loading source

dist/plugins/github/dist/blog-tools.jsView file

6*/ L7: import { execFile } from 'child_process'; L8: import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

17// single literal argument and is NEVER interpreted by a shell. Do NOT add L18: // `shell: true` or hand-roll arg quoting here: that reintroduces OS command L19: // injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

dist/plugins/x-api/dist/server-bridge.jsView file

16let cached = null; L17: async function tryImport(base) { L18: const [state, helpers, draftjs] = await Promise.all([

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/x-api/dist/server-bridge.jsView on unpkg · L16

dist/server/plugin-install.jsView file

34try { L35: execSync(`npm install --save ${packageName}`, { L36: cwd: PLUGINS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/plugin-install.jsView on unpkg · L34

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

Findings

4 High4 Medium6 Low

HighChild Processdist/plugins/github/dist/blog-tools.js

HighShelldist/plugins/github/dist/blog-tools.js

HighRuntime Package Installdist/server/plugin-install.js

HighShips High Entropy Blobdist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2

MediumDynamic Requiredist/plugins/x-api/dist/server-bridge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/plugins/github/dist/blog-tools.jsView file

Lines 1-37javascript

1/**

2 * Blog publishing MCP tools — local git ops, no Worker, no PAT.

3 *

4 * Auth: piggybacks on the user's existing `gh auth login`.

5 * Persistence: blogSites in plugins['@openwriter/plugin-github'].blogSites.

6 */

7import { execFile } from 'child_process';

8import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

9import { join, extname, dirname, basename } from 'path';

10import { randomUUID } from 'crypto';

11import { homedir } from 'os';

12import { getServerModules, listBlogSites, writeBlogSites, } from './helpers.js';

13const NETWORK_TIMEOUT = 60000;

14// SECURITY (MCP-1): no shell. `git`/`gh` are spawned directly via execFile

15// with an argv array, so every element — including attacker-influenced blog

16// config values (owner/repo/branch) and slugs — is passed to the program as a

17// single literal argument and is NEVER interpreted by a shell. Do NOT add

18// `shell: true` or hand-roll arg quoting here: that reintroduces OS command

19// injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

20// validate the inputs instead.

21function exec(cmd, args, cwd, timeout = NETWORK_TIMEOUT) {

22 return new Promise((resolve, reject) => {

23 execFile(cmd, args, { cwd, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {

24 if (err)

25 reject(new Error(stderr?.trim() || err.message));

26 else

27 resolve(stdout.trim());

28 });

29 });

30}

31async function ghAuthOk(cwd) {

32 try {

33 await exec('gh', ['auth', 'status'], cwd);

34 return true;

35 }

36 catch {

37 return false;

dist/plugins/x-api/dist/server-bridge.jsView file

Lines 1-36javascript

1/**

2 * Thin runtime bridge to the OpenWriter server modules this plugin needs for

3 * article publishing — the active document, its title/metadata, the data dir,

4 * and the shared TipTap -> DraftJS converter.

5 *

6 * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so

7 * both posting paths produce identical X content_state. We import the compiled

8 * server module at runtime rather than vendoring it, resolving both the npm

9 * package layout and the monorepo layout — the same dual-path trick the publish

10 * plugin's helpers use.

11 */

dist/server/plugin-install.jsView file

Lines 14-54javascript

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg