registry / reviewable-md / 0.1.22

reviewable-md@0.1.22

Preview a markdown file, leave inline review comments, and copy them back to an AI for the next edit.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 57 file(s), 4.15 MB of source, external domains: 127.0.0.1, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, openjsf.org, reactjs.org, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

6 flagged

dist/assets/index-B0l9AbHo.jsView file

331`},u]}}const OM=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\... L332: ]`,h={scope:"string",variants:[c,u,d,f]},g={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L333: https://github.com/highlightjs/highlight.js/issues/2277`),S=U,$=G),z===void 0&&(z=!0);const te={code:$,language:S};Q("before:highlight",te);const oe=te.result?te.result:d(te.langua...

High

Child Process

Package source references child process execution.

dist/assets/index-B0l9AbHo.jsView on unpkg · L331

server/daemon.jsView file

Lines 136-176javascript

136 '--no-open',

137 ], {

138 detached: true,

139 stdio: 'ignore',

140 })

141 child.unref?.()

142

143 const state = {

144 pid: child.pid,

145 port: selectedPort,

146 startedAt: new Date().toISOString(),

147 }

148 await writeDaemonState(state, { home })

149 await waitForHealth(selectedPort, { timeoutMs, fetchImpl })

150 return { ...state, reused: false }

151 })

152}

153

154export function openUrl(link, { spawnImpl = spawn } = {}) {

155 const opener = process.platform === 'darwin' ? 'open'

156 : process.platform === 'win32' ? 'start' : 'xdg-open'

157 spawnImpl(opener, [link], { shell: true, stdio: 'ignore', detached: true }).unref?.()

158}

High

Shell

Package source references shell execution.

server/daemon.jsView on unpkg · L156

159

160export function resolveMarkdownPath(filePath, cwd = process.cwd()) {

161 if (!filePath) throw new Error('Missing markdown file path')

162 const mdPath = path.resolve(cwd, filePath)

163 if (!/\.md$/i.test(mdPath)) throw new Error('Only .md files are supported')

164 if (!fs.existsSync(mdPath)) throw new Error(`File not found: ${mdPath}`)

165 return mdPath

166}

167

168export async function openMarkdownFile(filePath, {

169 cliPath,

170 cwd = process.cwd(),

171 open = true,

172 port = DEFAULT_PORT,

173 home = os.homedir(),

174 fetchImpl = globalThis.fetch,

175 spawnImpl = spawn,

176} = {}) {

server/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import http from 'node:http'

3import fs from 'node:fs'

4import path from 'node:path'

5import url from 'node:url'

6import { spawn } from 'node:child_process'

7import { DEFAULT_PORT, createHandler, getLanIps, parseArgs }

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

6 flagged · loading source

dist/assets/index-B0l9AbHo.jsView file

High

Child Process

Package source references child process execution.

dist/assets/index-B0l9AbHo.jsView on unpkg · L331

server/daemon.jsView file

156: process.platform === 'win32' ? 'start' : 'xdg-open' L157: spawnImpl(opener, [link], { shell: true, stdio: 'ignore', detached: true }).unref?.() L158: }

High

Shell

Package source references shell execution.

server/daemon.jsView on unpkg · L156

server/cli.jsView file

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L1: #!/usr/bin/env node L2: import http from 'node:http' L3: import fs from 'node:fs' ... L5: import url from 'node:url' L6: import { spawn } from 'node:child_process' L7: import { DEFAULT_PORT, createHandler, getLanIps, parseArgs } from './lib.js' ... L11: const CLI_PATH = url.fileURLToPath(import.meta.url) L12: const __dirname = path.dirname(CLI_PATH) L13: const ROOT = path.resolve(__dirname, '..') ... L75: if (!enabled) return L76: const opener = process.platform === 'darwin' ? 'open' L77: : process.platform === 'win32' ? 'start' : 'xdg-open'

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/cli.jsView on unpkg · L1

91const query = initialPath ? `?path=${encodeURIComponent(initialPath)}` : '' L92: const link = `http://localhost:${previewPort}${query}` L93: ... L102: if (dev) { L103: viteProc = spawn('npx', ['vite', '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], { L104: cwd: ROOT, L105: env: { ...process.env, RMD_SERVER_PORT: String(args.port) }, L106: stdio: ['ignore', 'pipe', 'inherit'],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/cli.jsView on unpkg · L91

102if (dev) { L103: viteProc = spawn('npx', ['vite', '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], { L104: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server/cli.jsView on unpkg · L102

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Findings

6 High4 Medium8 Low

HighChild Processdist/assets/index-B0l9AbHo.js

HighShellserver/daemon.js

HighEntrypoint Build Divergenceserver/cli.js

HighSame File Env Network Executionserver/cli.js

HighRuntime Package Installserver/cli.js

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/assets/index-B0l9AbHo.jsView file

High

Child Process

Package source references child process execution.

dist/assets/index-B0l9AbHo.jsView on unpkg · L331

server/daemon.jsView file

Lines 136-176javascript

136 '--no-open',

137 ], {

138 detached: true,

139 stdio: 'ignore',

140 })

141 child.unref?.()

142

143 const state = {

144 pid: child.pid,

145 port: selectedPort,

146 startedAt: new Date().toISOString(),

147 }

148 await writeDaemonState(state, { home })

149 await waitForHealth(selectedPort, { timeoutMs, fetchImpl })

150 return { ...state, reused: false }

151 })

152}

153

154export function openUrl(link, { spawnImpl = spawn } = {}) {

155 const opener = process.platform === 'darwin' ? 'open'

156 : process.platform === 'win32' ? 'start' : 'xdg-open'

157 spawnImpl(opener, [link], { shell: true, stdio: 'ignore', detached: true }).unref?.()

158}

High

Shell

Package source references shell execution.

server/daemon.jsView on unpkg · L156

159

160export function resolveMarkdownPath(filePath, cwd = process.cwd()) {

161 if (!filePath) throw new Error('Missing markdown file path')

162 const mdPath = path.resolve(cwd, filePath)

163 if (!/\.md$/i.test(mdPath)) throw new Error('Only .md files are supported')

164 if (!fs.existsSync(mdPath)) throw new Error(`File not found: ${mdPath}`)

165 return mdPath

166}

167

168export async function openMarkdownFile(filePath, {

169 cliPath,

170 cwd = process.cwd(),

171 open = true,

172 port = DEFAULT_PORT,

173 home = os.homedir(),

174 fetchImpl = globalThis.fetch,

175 spawnImpl = spawn,

176} = {}) {

server/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import http from 'node:http'

3import fs from 'node:fs'

4import path from 'node:path'

5import url from 'node:url'

6import { spawn } from 'node:child_process'

7import { DEFAULT_PORT, createHandler, getLanIps, parseArgs }

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Lines 71-122javascript

71 console.log(data.reused ? 'daemon: reused' : `daemon: started on port ${data.port}`)

72}

74function openBrowser(link, enabled) {

75 if (!enabled) return

76 const opener = process.platform === 'darwin' ? 'open'

77 : process.platform === 'win32' ? 'start' : 'xdg-open'

78 spawn(opener, [link], { shell: true, stdio: 'ignore', detached: true }).unref()

79}

81function startServer({ args, initialPath = null, dev }) {

82 if (initialPath && !fs.existsSync(initialPath)) {

83 throw new Error(`File not found: ${initialPath}`)

84 }

85 if (!dev && !fs.existsSync(DIST)) {

86 throw new Error('Built client not found. Run `npm run build` before starting the production server.')

87 }

89 const vitePort = args.port + 1

90 const previewPort = dev ? vitePort : args.port

91 const query = initialPath ? `?path=${encodeURIComponent(initialPath)}` : ''

92 const link = `http://localhost:${previewPort}${query}`

94 const server = http.createServer(createHandler({

95 dev,

96 dist: DIST,

97 vitePort,

98 port: args.port,

99 }))

100

101 let viteProc = null

102 if (dev) {

103 viteProc = spawn('npx', ['vite', '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], {

104 cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server/cli.jsView on unpkg · L102

105 env: { ...process.env, RMD_SERVER_PORT: String(args.port) },

106 stdio: ['ignore', 'pipe', 'inherit'],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/cli.jsView on unpkg · L91

107 shell: process.platform === 'win32',

108 })

109 let viteReady = false

110 viteProc.stdout.on('data', (chunk) => {

111 process.stdout.write(chunk)

112 if (!viteReady && /ready in/.test(chunk)) {

113 viteReady = true

114 openBrowser(link, args.open)

115 }

116 })

117 process.on('exit', () => viteProc?.kill())

118 process.on('SIGINT', () => { viteProc?.kill(); process.exit(0) })

119 }

120

121 server.listen(args.port, '0.0.0.0', () => {

122 const lanIps = getLanIps()