registry / spark-html-manifest / 0.1.4

spark-html-manifest@0.1.4

PWA manifest + icons + offline app shell for spark-html sites from a single config — a spark-html-bun build step that generates manifest.webmanifest, resizes icons, injects the head tags, and optionally emits a minimal service worker.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 11.9 KB of source

Source & flagged code

1 flagged

src/bun.jsView file

Lines 44-84javascript

44 name: 'spark-html-manifest',

46 async run({ outDir }) {

47 const root = resolve(outDir);

48 if (!existsSync(root)) return;

50 // Emit manifest + worker.

51 await writeFile(join(root, filename), JSON.stringify(manifestJson(config), null, 2), 'utf8');

52 if (offline) {

53 await writeFile(join(root, swFile), swSource(typeof offline === 'object' ? offline : {}), 'utf8');

54 }

56 // Icons (unless the author supplied explicit ones).

57 if (config.icon && !config.icons) {

58 if (!existsSync(config.icon)) {

59 console.warn(`[spark-html-manifest] icon source not found: ${config.icon} — icons skipped`);

60 } else {

61 // sharp is imported lazily so the plugin never breaks a build where

62 // native deps can't load — you just generate icons elsewhere.

63 let sharp;

64 try {

65 sharp = (await import('sharp')).default;

66 } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/bun.jsView on unpkg · L64

67 console.warn(`[spark-html-manifest] sharp unavailable — icons skipped (${e.message})`);

68 sharp = null;

69 }

70 if (sharp) {

71 const sizes = config.sizes || ICON_SIZES;

72 for (const size of sizes) {

73 const dest = join(root, iconPath(config, size));

74 await mkdir(dirname(dest), { recursive: true });

75 await sharp(config.icon).resize(size, size, { fit: 'cover' }).png().toFile(dest);

76 }

77 console.log(`[spark-html-manifest] ${sizes.length} icon(s) generated from ${config.icon}`);

78 }

79 }

80 }

82 // Stamp head tags into every page (after prerender wrote its pages).

83 const block = headBlock();

84 let pages = 0;

Source & flagged code

1 flagged · loading source

src/bun.jsView file

64package = spark-html-manifest; repositoryIdentity = spark-html; dependency = sharp L64: try { L65: sharp = (await import('sharp')).default; L66: } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/bun.jsView on unpkg · L64

Findings

1 High2 Medium2 Low

HighCopied Package Dependency Bridgesrc/bun.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

1 flagged

src/bun.jsView file

Lines 44-84javascript

44 name: 'spark-html-manifest',

46 async run({ outDir }) {

47 const root = resolve(outDir);

48 if (!existsSync(root)) return;

50 // Emit manifest + worker.

51 await writeFile(join(root, filename), JSON.stringify(manifestJson(config), null, 2), 'utf8');

52 if (offline) {

53 await writeFile(join(root, swFile), swSource(typeof offline === 'object' ? offline : {}), 'utf8');

54 }

56 // Icons (unless the author supplied explicit ones).

57 if (config.icon && !config.icons) {

58 if (!existsSync(config.icon)) {

59 console.warn(`[spark-html-manifest] icon source not found: ${config.icon} — icons skipped`);

60 } else {

61 // sharp is imported lazily so the plugin never breaks a build where

62 // native deps can't load — you just generate icons elsewhere.

63 let sharp;

64 try {

65 sharp = (await import('sharp')).default;

66 } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/bun.jsView on unpkg · L64

67 console.warn(`[spark-html-manifest] sharp unavailable — icons skipped (${e.message})`);

68 sharp = null;

69 }

70 if (sharp) {

71 const sizes = config.sizes || ICON_SIZES;

72 for (const size of sizes) {

73 const dest = join(root, iconPath(config, size));

74 await mkdir(dirname(dest), { recursive: true });

75 await sharp(config.icon).resize(size, size, { fit: 'cover' }).png().toFile(dest);

76 }

77 console.log(`[spark-html-manifest] ${sizes.length} icon(s) generated from ${config.icon}`);

78 }

79 }

80 }

82 // Stamp head tags into every page (after prerender wrote its pages).

83 const block = headBlock();

84 let pages = 0;