registry / periderm-cli / 0.1.35

periderm-cli@0.1.35

Pre-launch scanner for web and mobile codebases. Context-aware checks for JS, TS, Flutter, React Native, and Swift.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 179 KB of source, external domains: 127.0.0.1, api.groq.com, formspree.io, registry.npmjs.org, www.w3.org, your-domain.com

Source & flagged code

1 flagged

dist/scanner/repo-checks.jsView file

Lines 279-319javascript

279 id: "unused-dependencies",

280 category: "Performance & Bundle Size",

281 severity: "medium",

282 file: "package.json", line: 1,

283 message: `${unused.length} dependenc${unused.length === 1 ? "y" : "ies"} in package.json appear unused: ${shown.join(", ")}${unused.length > shown.length ? ", …" : ""}.`,

284 why: "Unused deps still get installed, audited, and (if imported anywhere transitively) can end up in the bundle. They also slow every CI install and confuse new contributors.",

285 fix: "Verify each one, then `npm uninstall <pkg>` for the true zombies. Move build-only tools to devDependencies.",

286 aiPrompt: `The following dependencies have no import in the source tree: ${unused.join(", ")}. For each, decide whether to remove it (unused), move it to devDependencies (build/tool-only), or add the missing import (mistakenly deleted).`,

287 });

288 }

289 // Code-splitting heuristic: many routes, zero dynamic imports

290 const routeFiles = _files.filter((f) => /\/(routes|pages|app)\//.test(f) && /\.(tsx|jsx)$/.test(f));

291 const dynamicImportHits = (importHaystack.match(/\bReact\.lazy\s*$|\blazy\s*\(\s*\(\s*$\s*=>\s*import\(|\bimport\(\s*["']/g) ?? []).length;

292 if (routeFiles.length >= 12 && dynamicImportHits === 0) {

293 out.push({

294 id: "no-code-splitting",

295 category: "Performance & Bundle Size",

296 severity: "medium",

297 file: "src", line: 1,

298 message: `${routeFiles.length} routes/pages and zero dynamic imports — everything ships in one bundle.`,

299 why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature you add.",

300 fix: "Wrap heavy or rarely-used routes in React.lazy(() => import('./Route')) + <Suspense>, or use your router's built-in lazy() API. Split third-party charts, editors and 3D scenes the same way.",

301 aiPrompt: `This project has ${routeFiles.length} route files but no dynamic import()/React.lazy usage. Identify the largest / least-visited routes (admin, settings, editors, charts) and refactor them to React.lazy() + <Suspense fallback={...}> so they code-split out of the initial bundle.`,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L299

302 });

303 }

304 }

305 // ─────────────────────────────────────────────────────────────────────

306 // Unused CSS classes (skip Tailwind / CSS-modules)

307 // ─────────────────────────────────────────────────────────────────────

308 const cssFiles = await fg(["**/*.css", "!**/node_modules/**", "!**/dist/**", "!**/build/**", "!**/.next/**", "!**/.output/**", "!**/*.module.css"], { cwd: root, absolute: true, dot: false });

309 if (cssFiles.length) {

310 // Build a haystack of everything CSS classes might be referenced from.

311 let refHaystack = "";

312 for (const abs of _files) {

313 if (!/\.(tsx|jsx|ts|js|mjs|cjs|svelte|vue|astro|html?|mdx?)$/.test(abs))

314 continue;

315 const chunk = await readMaybe(abs);

316 if (chunk)

317 refHaystack += chunk + "\n";

318 }

319 for (const cssAbs of cssFiles) {

Source & flagged code

1 flagged · loading source

dist/scanner/repo-checks.jsView file

299why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature y... L300: fix: "Wrap heavy or rarely-used routes in React.lazy(() => import('./Route')) + <Suspense>, or use your router's built-in lazy() API. Split third-party charts, editors and 3D scene... L301: aiPrompt: `This project has ${routeFiles.length} route files but no dynamic import()/React.lazy usage. Identify the largest / least-visited routes (admin, settings, editors, charts...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L299

Findings

3 Medium4 Low

MediumDynamic Requiredist/scanner/repo-checks.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/scanner/repo-checks.jsView file

Lines 279-319javascript

279 id: "unused-dependencies",

280 category: "Performance & Bundle Size",

281 severity: "medium",

282 file: "package.json", line: 1,

283 message: `${unused.length} dependenc${unused.length === 1 ? "y" : "ies"} in package.json appear unused: ${shown.join(", ")}${unused.length > shown.length ? ", …" : ""}.`,

284 why: "Unused deps still get installed, audited, and (if imported anywhere transitively) can end up in the bundle. They also slow every CI install and confuse new contributors.",

285 fix: "Verify each one, then `npm uninstall <pkg>` for the true zombies. Move build-only tools to devDependencies.",

287 });

288 }

289 // Code-splitting heuristic: many routes, zero dynamic imports

290 const routeFiles = _files.filter((f) => /\/(routes|pages|app)\//.test(f) && /\.(tsx|jsx)$/.test(f));

291 const dynamicImportHits = (importHaystack.match(/\bReact\.lazy\s*$|\blazy\s*\(\s*\(\s*$\s*=>\s*import\(|\bimport\(\s*["']/g) ?? []).length;

292 if (routeFiles.length >= 12 && dynamicImportHits === 0) {

293 out.push({

294 id: "no-code-splitting",

295 category: "Performance & Bundle Size",

296 severity: "medium",

297 file: "src", line: 1,

298 message: `${routeFiles.length} routes/pages and zero dynamic imports — everything ships in one bundle.`,

299 why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature you add.",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L299

302 });

303 }

304 }

306 // Unused CSS classes (skip Tailwind / CSS-modules)

308 const cssFiles = await fg(["**/*.css", "!**/node_modules/**", "!**/dist/**", "!**/build/**", "!**/.next/**", "!**/.output/**", "!**/*.module.css"], { cwd: root, absolute: true, dot: false });

309 if (cssFiles.length) {

310 // Build a haystack of everything CSS classes might be referenced from.

311 let refHaystack = "";

312 for (const abs of _files) {

313 if (!/\.(tsx|jsx|ts|js|mjs|cjs|svelte|vue|astro|html?|mdx?)$/.test(abs))

314 continue;

315 const chunk = await readMaybe(abs);

316 if (chunk)

317 refHaystack += chunk + "\n";

318 }

319 for (const cssAbs of cssFiles) {