registry / reviewable-md / 0.1.21

reviewable-md@0.1.21

Preview a markdown file, leave inline review comments, and copy them back to an AI for the next edit.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 57 file(s), 4.15 MB of source, external domains: 127.0.0.1, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, openjsf.org, reactjs.org, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

6 flagged

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView file

Lines 1-28javascript

1import{r as Xt,j as _f}from"./index-BceTR6f4.js";let Wn=[],va=[];(()=>{let r="lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,7,2,6,2,2,,4,z,,u,r,2j,b,1m,9,9,,o,4,,9,,3,,5,17,3,3b,f,,w,1j,,,,4,8,4,,3,7,a,2,t,,1m,,,,2,4,8,,9,,a,2,q,,2,2,1l,,4,2,4,2,2,3,3,,u,2,3,,b,2,1l,,4,5,,2,4,,k,2,m,6,,,1m,,,2,,4,8,,7,3,a,2,u,,1n,,,,c,,9,,14,,3,,1l,3,5,3,,4,7,2,b,2,t,,1m,,2,,2,,3,,5,2,7,2,b,2,s,2,1l,2,,,2,4,8,,9,,a,2,t,,20,,4,,2,3,,,8,,29,,2,7,c,8,2q,,2,9,b,6,22,2,r,,,,,,1j,e,,5,,2,5,b,,10,9,,2u,4,,6,,2,2,2,p,2,4,3,g,4,d,,2,2,6,,f,,jj,3,qa,3,t,3,t,2,u,2,1s,2,,7,8,,2,b,9,,19,3,3b,2,y,,3a,3,4,2,9,,6,3,63,2,2,,1m,,, ...

2`){[e,t]=Wt(this,e,t);let n="";for(let s=0,o=0;s<=t&&o<this.text.length;o++){let l=this.text[o],a=s+l.length;s>e&&o&&(n+=i),e<a&&t>s&&(n+=l.slice(Math.max(0,e-s),t-s)),s=a+1}return n}flatten(e){for(let t of this.text)e.push(t)}scanIdentical(){return 0}static split(e,t){let i=[],n=-1;for(let s of e)i.push(s),n+=s.length+1,i.length==32&&(t.push(new K(i,n)),i=[],n=-1);return n>-1&&t.push(new K(i,n)),t}}class _e extends Y{constructor(e,t){super(),this.children=e,this.length=t,this.lines=0;for(let i of e)this.lines+=i.lines}lineInner(e,t,i,n){for(let s=0;;s++){let o=this.children[s],l=n+o.length,a= ...

3`){[e,t]=Wt(this,e,t);let n="";for(let s=0,o=0;s<this.children.length&&o<=t;s++){let l=this.children[s],a=o+l.length;o>e&&s&&(n+=i),e<

4`,this;e--}else if(n instanceof K){let a=n.text[o+(t<0?-1:0)];if(this.offsets[i]+=t,a.length>Math.max(0,e))return this.value=e==0?a:t>0?a.slice(e):a.slice(0,a.length-e),this;e-=a.length}else{let a=n.children[o+(t<0?-1:0)];e>a.length?(e-=a.length,this.offsets[i]+=t):(t<0&&this.offsets[i]--,this.nodes.push(a),this.offsets.push(t>0?1:(a instanceof K?a.text.length:a.children.length)<<1))}}}next(e=0){return e<0&&(this.nextInner(-e,-this.dir),e=this.value.length),this.nextInner(e,this.dir)}}class Ca{constructor(e,t,i){this.value="",this.done=!1,this.cursor=new ui(e,t>i?-1:1),this.pos=t>i?e.length:0, ...

5`}get readOnly(){return this.facet(Wa)}phrase(e,...t){for(let i of this.facet(z.phrases))if(Object.prototype.hasOwnProperty.call(i,e)){e=i[e];break}return t.length&&(e=e.replace(/\$(\$|\d*)/g,(i,n)=>{if(n=="$")

6`)}static newName(){let e=Co[Xo]||1;return Co[Xo]=e+1,Jn+e.toString(36)}static mount(e,t,i){let n=e[es],s=i&&i.nonce;n?s&&n.setNonce(s):n=new hO(e,s),n.mount(Array.isArray(t)?t:[t],e)}}let Ao=new Map;class hO{constructor(e,t){let i=e.ownerDocument||e,n=i.defaultView;if(!e.head&&e.adoptedStyleSheets&&n.CSSStyleSheet){let s=Ao.get(i);if(s)return e[es]=s;this.sheet=new n.CSSStyleSheet,Ao.set(i,this)}else this.styleTag=i.createElement("style"),t&&this.styleTag.setAttribute("nonce",t);this.modules=[],e[es]=this}mount(e,t){let i=this.sheet,n=0,s=0;for(let o=0;o<e.length;o++){let l=e[o],a=this.module ...

7`;this.styleTag.textContent=o;let l=t.head||t;this.styleTag.parentNode!=l&&l.insertBefore(this.styleTag,l.firstChild)}}setNonce(e){this.styleTag&&this.styleTag.getAttribute("nonce")!=e&&this.styleTag.setAttribute("nonce",e)}}var ct={8:"Backspace",9:"Tab",10:"Enter",12:"NumLock",13:"Enter",16:"Shift",17:"Control",18:"Alt",20:"CapsLock",27:"Escape"

8`,n=r.state.doc.line(n.number+(t?1:-1)),s=r.bidiSpans(n),h=r.visualLineSide(n,!t)}if(a){if(!a(c))return l}else{if(!i)return h;a=i(c)}l=h}}function nu(r,e,t){let i=

9 `&&r.lineWrapping&&(i&&(i=S.single(i.main.anchor-1,i.main.head-1)),t={from:s.from,to:s.to,insert:Y.of([" "])}),t)return Is(r,t,i,o);if(i&&!Ar(i,s)){let l=!1,a="select";return r.inputState.lastSelectionTime>Date.now()-50&&(r.inputState.lastSelectionOrigin=="select"&&(l=!0),a=r.inputState.lastSelectionOrigin,a=="select.pointer"&&(i=kh(n.facet(Wi).map(h=>h(r)),i))),r.dispatch({selection:i,scrollIntoView:l,userEvent:a}),!0}else return!1}function Is(r,e,t,i=-1){if($.ios&&r.inputState.flushIOSKey(e))return!0;let n=r.state.selection.main;if($.android&&(e.to==n.to&&(e.from==n.from||e.from==n.from-1&& ...

10`))};if(($.mac||$.android)&&f.from==o-1&&/^\. ?$/.test(i.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(f={from:l,to:a,insert:Y.of([i.text.replace("."," ")])}),this.pendingContextChange=f,!e.state.readOnly){

11`+t.scrub(),s=this.advance(n);return s>-1&&s<n.length?this.complete(e,i,s):!1}finish(e,t){return(this.stage==2||this.stage==3)&&Qi(t.content,this.pos)==t.content.length?this.complete(e,t,t.content.length):!1}complete(e,t,i){return e.addLeafElement(t,j(k.LinkReference,this.start,this.start+i,this.elts)),!0}nextStage(e){return e?(this.pos=e.to-this.start,this.elts.push(e),this.stage++,!0):(e===!1&&(this.stage=-1),!1)}advance(e){for(;;){if(this.stage==-1)return-1;if(this.stage==0){if(!this.nextStage(bc(e,this.pos,this.start,!0)))return-1;if(e.charCodeAt(this.pos)!=58)return this.stage=-1;this.elt ...

High

Child Process

Package source references child process execution.

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView on unpkg · L9

12`+e.scrub();for(let i of e.markers)t.marks.push(i)}return this.finishLeaf(t),null}stopAt(e){if(this.stoppedAt!=null&&this.stoppedAt<e)throw new RangeError("Can't move stoppedAt forward");this.stoppedAt=e}reuseFragment(e){if(!this.fragments.moveTo(this.absoluteLineStart+e,this.absoluteLineStart)||!this.fragments.matches(this.block.hash))return!1;let t=this.fragments.takeNodes(this);return t?(this

13`?"":t;else{let n=t.indexOf(`

14`);i=n<0?t:t.slice(0,n)}return e+i.length>this.to?i.slice(0,this.to-e):i}prevLineEnd(){return this.atEnd?this.lineStart:this.lineStart-1}startContext(e,t,i=0){this.block=Er.create(e,i,this.lineStart+t,this.block.hash,this.lineStart+this.line.text.length),this.stack.push(this.block)}startComposite(e,t,i=0){this.startContext(this.parser.getNodeType(e),t,i)}addNode(e,t,i){typeof e=="number"&&(e=new _(this.parser.nodeSet.types[e],Nt,Nt,(i??this.prevLineEnd())-t)),this.block.addChild(e,t-this.block.from)}addElement(e){this.block.addChild(e.toTree(this.parser.nodeSet),e.from-this.block.from)}addLeaf ...

15`;)s--;this.fragmentEnd=s?s-1:0}let i=this.cursor;i||(i=this.cursor=this.fragment.tree.cursor(),i.firstChild());let n=e+this.fragment.offset;for(;i.to<=n;)if(!i.parent())return!1;for(;;){if

16 \${}

17} catch (\${error}) {

18 \${}

19}`,{label:"try",detail:"/ catch block",type:"keyword"}),ue("if (${}) {\n ${}\n}",{label:"if",detail:"block",type:"keyword"}),ue(`if (\${}) {

20 \${}

21} else {

22 \${}

23}`,{label:"if",detail:"/ else block",type:"keyword"}),ue(`class \${name} {

24 constructor(\${params}) {

25 \${}

26 }

27}`,{label:"class",detail:"definition",type:"keyword"}),ue('import {${names}} from "${module}"\n${}',{label:"import",detail:"named",type:"keyword"}),ue('import ${name} from "${module}"\n${}',{label:"import",detail:"default",type:"keyword"})],Fm=Vc.concat([ue("interface ${name} {\n ${}\n}",{label:"interface",detail:"definition",type:"keyword"}),ue("type ${name} = ${type}",{label:"type",detail:"definition",type:"keyword"}),ue("enum ${name} {\n ${}\n}",{label:"enum",detail:"definition",type:"keyword"})]),ha=new Vh,qc=new Set(["Script","Block","FunctionExpression","FunctionDeclaration","ArrowFuncti ...

Long lines were clipped for display.

server/daemon.jsView file

Lines 136-176javascript

136 '--no-open',

137 ], {

138 detached: true,

139 stdio: 'ignore',

140 })

141 child.unref?.()

142

143 const state = {

144 pid: child.pid,

server/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import http from 'node:http'

3import fs from 'node:fs'

4import path from 'node:path'

5import url from 'node:url'

6import { spawn } from 'node:child_process'

7import { DEFAULT_PORT, createHandler, getLanIps, parseArgs }

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

6 flagged · loading source

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView file

9`&&r.lineWrapping&&(i&&(i=S.single(i.main.anchor-1,i.main.head-1)),t={from:s.from,to:s.to,insert:Y.of([" "])}),t)return Is(r,t,i,o);if(i&&!Ar(i,s)){let l=!1,a="select";return r.inp... L10: `))};if(($.mac||$.android)&&f.from==o-1&&/^\. ?$/.test(i.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(f={from:l,to:a,insert:Y.of([i.text.replace("."," ")])}),this.pendi... L11: `+t.scrub(),s=this.advance(n);return s>-1&&s<n.length?this.complete(e,i,s):!1}finish(e,t){return(this.stage==2||this.stage==3)&&Qi(t.content,this.pos)==t.content.length?this.comple...

High

Child Process

Package source references child process execution.

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView on unpkg · L9

server/daemon.jsView file

156: process.platform === 'win32' ? 'start' : 'xdg-open' L157: spawnImpl(opener, [link], { shell: true, stdio: 'ignore', detached: true }).unref?.() L158: }

High

Shell

Package source references shell execution.

server/daemon.jsView on unpkg · L156

server/cli.jsView file

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L1: #!/usr/bin/env node L2: import http from 'node:http' L3: import fs from 'node:fs' ... L5: import url from 'node:url' L6: import { spawn } from 'node:child_process' L7: import { DEFAULT_PORT, createHandler, getLanIps, parseArgs } from './lib.js' ... L11: const CLI_PATH = url.fileURLToPath(import.meta.url) L12: const __dirname = path.dirname(CLI_PATH) L13: const ROOT = path.resolve(__dirname, '..') ... L75: if (!enabled) return L76: const opener = process.platform === 'darwin' ? 'open' L77: : process.platform === 'win32' ? 'start' : 'xdg-open'

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/cli.jsView on unpkg · L1

91const query = initialPath ? `?path=${encodeURIComponent(initialPath)}` : '' L92: const link = `http://localhost:${previewPort}${query}` L93: ... L102: if (dev) { L103: viteProc = spawn('npx', ['vite', '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], { L104: cwd: ROOT, L105: env: { ...process.env, RMD_SERVER_PORT: String(args.port) }, L106: stdio: ['ignore', 'pipe', 'inherit'],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/cli.jsView on unpkg · L91

102if (dev) { L103: viteProc = spawn('npx', ['vite', '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], { L104: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server/cli.jsView on unpkg · L102

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Findings

6 High4 Medium8 Low

HighChild Processdist/assets/CodeMirrorEditor-C5hqNCdn.js

HighShellserver/daemon.js

HighEntrypoint Build Divergenceserver/cli.js

HighSame File Env Network Executionserver/cli.js

HighRuntime Package Installserver/cli.js

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView file

Lines 1-28javascript

3`){[e,t]=Wt(this,e,t);let n="";for(let s=0,o=0;s<this.children.length&&o<=t;s++){let l=this.children[s],a=o+l.length;o>e&&s&&(n+=i),e<

8`,n=r.state.doc.line(n.number+(t?1:-1)),s=r.bidiSpans(n),h=r.visualLineSide(n,!t)}if(a){if(!a(c))return l}else{if(!i)return h;a=i(c)}l=h}}function nu(r,e,t){let i=

High

Child Process

Package source references child process execution.

dist/assets/CodeMirrorEditor-C5hqNCdn.jsView on unpkg · L9

13`?"":t;else{let n=t.indexOf(`

15`;)s--;this.fragmentEnd=s?s-1:0}let i=this.cursor;i||(i=this.cursor=this.fragment.tree.cursor(),i.firstChild());let n=e+this.fragment.offset;for(;i.to<=n;)if(!i.parent())return!1;for(;;){if

16 \${}

17} catch (\${error}) {

18 \${}

19}`,{label:"try",detail:"/ catch block",type:"keyword"}),ue("if (${}) {\n ${}\n}",{label:"if",detail:"block",type:"keyword"}),ue(`if (\${}) {

20 \${}

21} else {

22 \${}

23}`,{label:"if",detail:"/ else block",type:"keyword"}),ue(`class \${name} {

24 constructor(\${params}) {

25 \${}

26 }

Long lines were clipped for display.

server/daemon.jsView file

Lines 136-176javascript

136 '--no-open',

137 ], {

138 detached: true,

139 stdio: 'ignore',

140 })

141 child.unref?.()

142

143 const state = {

144 pid: child.pid,

server/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import http from 'node:http'

3import fs from 'node:fs'

4import path from 'node:path'

5import url from 'node:url'

6import { spawn } from 'node:child_process'

7import { DEFAULT_PORT, createHandler, getLanIps, parseArgs }

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg