registry / openwriter / 0.40.1

openwriter@0.40.1

Broken package: published without bundled plugins. Use 0.40.2.

The open-source writing surface for AI agents. Markdown-native editor with pending change review — your agent writes, you accept or reject.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 2.17 MB of source, external domains: 127.0.0.1, api.fxtwitter.com, developer.x.com, example.com, git-scm.com, github.com, prosemirror.net, publish.openwriter.io, purl.org, reactjs.org, registry.npmjs.org, twemoji.maxcdn.com, unavatar.io, www.idpf.org, www.w3.org, x.com

Source & flagged code

4 flagged

dist/server/plugin-install.jsView file

Lines 1-54javascript

1/**

2 * CLI plugin management: install, remove, list user plugins.

3 * User plugins live in ~/.openwriter/plugins/ with their own package.json and node_modules.

4 */

5import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';

6import { join } from 'path';

7import { homedir } from 'os';

8import { execSync } from 'child_process';

9const PLUGINS_DIR = join(homedir(), '.openwriter', 'plugins');

High

Child Process

Package source references child process execution.

dist/server/plugin-install.jsView on unpkg · L7

10const PLUGINS_PKG = join(PLUGINS_DIR, 'package.json');

11const VALID_NAME = /^(@openwriter\/plugin-[\w-]+|openwriter-plugin-[\w-]+|@[\w-]+\/openwriter-plugin-[\w-]+)$/;

12/** Ensure ~/.openwriter/plugins/ exists with a package.json */

13export function ensureUserPluginsDir() {

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify({

19 private: true,

20 type: 'module',

21 dependencies: {}

22 }, null, 2), 'utf-8');

23 }

24}

25/** Install a plugin package into the user plugins directory */

26export function installPlugin(packageName) {

27 if (!VALID_NAME.test(packageName)) {

28 console.error(`Invalid plugin name: ${packageName}`);

29 console.error('Plugin names must match: openwriter-plugin-*, @openwriter/plugin-*, or @scope/openwriter-plugin-*');

30 process.exit(1);

31 }

32 ensureUserPluginsDir();

33 console.error(`Installing ${packageName}...`);

34 try {

35 execSync(`npm install --save ${packageName}`, {

36 cwd: PLUGINS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/plugin-install.jsView on unpkg · L34

37 stdio: 'inherit',

38 });

39 console.error(`Installed ${packageName} successfully.`);

40 }

41 catch {

42 console.error(`Failed to install ${packageName}.`);

43 process.exit(1);

44 }

45}

46/** Remove a plugin package from the user plugins directory */

47export function removePlugin(packageName) {

48 ensureUserPluginsDir();

49 const pkg = readPkg();

50 if (!pkg.dependencies?.[packageName]) {

51 console.error(`Plugin ${packageName} is not installed.`);

52 process.exit(1);

53 }

54 console.error(`Removing ${packageName}...`);

dist/server/plugin-discovery.jsView file

Lines 137-177javascript

137 });

138 // Deduplicate: bundled wins if same name exists in both

139 const seen = new Set(bundled.map(p => p.name));

140 const deduped = [...bundled];

141 for

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

Source & flagged code

4 flagged · loading source

dist/server/plugin-install.jsView file

7import { homedir } from 'os'; L8: import { execSync } from 'child_process'; L9: const PLUGINS_DIR = join(homedir(), '.openwriter', 'plugins');

High

Child Process

Package source references child process execution.

dist/server/plugin-install.jsView on unpkg · L7

34try { L35: execSync(`npm install --save ${packageName}`, { L36: cwd: PLUGINS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/plugin-install.jsView on unpkg · L34

dist/server/plugin-discovery.jsView file

157// ESM import from non-standard node_modules requires path resolution L158: const userRequire = createRequire(join(USER_PLUGINS_DIR, 'package.json')); L159: const resolved = userRequire.resolve(name);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/plugin-discovery.jsView on unpkg · L157

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

Findings

4 High4 Medium6 Low

HighChild Processdist/server/plugin-install.js

HighShell

HighRuntime Package Installdist/server/plugin-install.js

HighShips High Entropy Blobdist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2

MediumDynamic Requiredist/server/plugin-discovery.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/server/plugin-install.jsView file

Lines 1-54javascript

1/**

2 * CLI plugin management: install, remove, list user plugins.

3 * User plugins live in ~/.openwriter/plugins/ with their own package.json and node_modules.

4 */

5import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';

6import { join } from 'path';

7import { homedir } from 'os';

8import { execSync } from 'child_process';

9const PLUGINS_DIR = join(homedir(), '.openwriter', 'plugins');

High

Child Process

Package source references child process execution.

dist/server/plugin-install.jsView on unpkg · L7

10const PLUGINS_PKG = join(PLUGINS_DIR, 'package.json');

11const VALID_NAME = /^(@openwriter\/plugin-[\w-]+|openwriter-plugin-[\w-]+|@[\w-]+\/openwriter-plugin-[\w-]+)$/;

12/** Ensure ~/.openwriter/plugins/ exists with a package.json */

13export function ensureUserPluginsDir() {

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify({

19 private: true,

20 type: 'module',

21 dependencies: {}

22 }, null, 2), 'utf-8');

23 }

24}

25/** Install a plugin package into the user plugins directory */

26export function installPlugin(packageName) {

27 if (!VALID_NAME.test(packageName)) {

28 console.error(`Invalid plugin name: ${packageName}`);

29 console.error('Plugin names must match: openwriter-plugin-*, @openwriter/plugin-*, or @scope/openwriter-plugin-*');

30 process.exit(1);

31 }

32 ensureUserPluginsDir();

33 console.error(`Installing ${packageName}...`);

34 try {

35 execSync(`npm install --save ${packageName}`, {

36 cwd: PLUGINS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/plugin-install.jsView on unpkg · L34

37 stdio: 'inherit',

38 });

39 console.error(`Installed ${packageName} successfully.`);

40 }

41 catch {

42 console.error(`Failed to install ${packageName}.`);

43 process.exit(1);

44 }

45}

46/** Remove a plugin package from the user plugins directory */

47export function removePlugin(packageName) {

48 ensureUserPluginsDir();

49 const pkg = readPkg();

50 if (!pkg.dependencies?.[packageName]) {

51 console.error(`Plugin ${packageName} is not installed.`);

52 process.exit(1);

53 }

54 console.error(`Removing ${packageName}...`);

dist/server/plugin-discovery.jsView file

Lines 137-177javascript

137 });

138 // Deduplicate: bundled wins if same name exists in both

139 const seen = new Set(bundled.map(p => p.name));

140 const deduped = [...bundled];

141 for

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg