registry / spark-html-manifest / 0.1.0

spark-html-manifest@0.1.0

PWA manifest + icons + offline app shell for spark-html sites from a single config — a Vite plugin that generates manifest.webmanifest, resizes icons, injects the head tags, and optionally emits a minimal service worker.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 11.7 KB of source

Source & flagged code

1 flagged

src/vite.jsView file

Lines 73-113javascript

74 // Build: emit manifest + icons + worker.

75 async generateBundle() {

76 this.emitFile({

77 type: 'asset',

78 fileName: filename,

79 source: JSON.stringify(manifestJson(config), null, 2),

80 });

81 if (offline) {

82 const shellOpts = typeof offline === 'object' ? offline : {};

83 this.emitFile({ type: 'asset', fileName: swFile, source: swSource(shellOpts) });

84 }

85 if (!config.icon || config.icons) return; // explicit icons — nothing to generate

86 if (!existsSync(config.icon)) {

87 console.warn(`[spark-html-manifest] icon source not found: ${config.icon} — icons skipped`);

88 return;

89 }

90 // sharp is imported lazily so the plugin never breaks a build where

91 // native deps can't load — you just generate icons elsewhere.

92 let sharp;

93 try {

94 sharp = (await import('sharp')).default;

95 } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/vite.jsView on unpkg · L93

96 console.warn(`[spark-html-manifest] sharp unavailable — icons skipped (${e.message})`);

97 return;

98 }

99 for (const size of config.sizes || ICON_SIZES) {

100 const png = await sharp(config.icon)

101 .resize(size, size, { fit: 'cover' })

102 .png()

103 .toBuffer();

104 this.emitFile({ type: 'asset', fileName: iconPath(config, size), source: png });

105 }

106 console.log(`[spark-html-manifest] ${(config.sizes || ICON_SIZES).length} icon(s) generated from ${config.icon}`);

107 },

108

109 // After prerender wrote its pages: stamp the head tags into every page.

110 closeBundle: {

111 order: 'post',

112 async handler() {

113 const root = resolve(outDir);

Source & flagged code

1 flagged · loading source

src/vite.jsView file

93package = spark-html-manifest; repositoryIdentity = spark; dependency = sharp L93: try { L94: sharp = (await import('sharp')).default; L95: } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/vite.jsView on unpkg · L93

Findings

1 High2 Medium2 Low

HighCopied Package Dependency Bridgesrc/vite.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

1 flagged

src/vite.jsView file

Lines 73-113javascript

74 // Build: emit manifest + icons + worker.

75 async generateBundle() {

76 this.emitFile({

77 type: 'asset',

78 fileName: filename,

79 source: JSON.stringify(manifestJson(config), null, 2),

80 });

81 if (offline) {

82 const shellOpts = typeof offline === 'object' ? offline : {};

83 this.emitFile({ type: 'asset', fileName: swFile, source: swSource(shellOpts) });

84 }

85 if (!config.icon || config.icons) return; // explicit icons — nothing to generate

86 if (!existsSync(config.icon)) {

87 console.warn(`[spark-html-manifest] icon source not found: ${config.icon} — icons skipped`);

88 return;

89 }

90 // sharp is imported lazily so the plugin never breaks a build where

91 // native deps can't load — you just generate icons elsewhere.

92 let sharp;

93 try {

94 sharp = (await import('sharp')).default;

95 } catch (e) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/vite.jsView on unpkg · L93

96 console.warn(`[spark-html-manifest] sharp unavailable — icons skipped (${e.message})`);

97 return;

98 }

99 for (const size of config.sizes || ICON_SIZES) {

100 const png = await sharp(config.icon)

101 .resize(size, size, { fit: 'cover' })

102 .png()

103 .toBuffer();

104 this.emitFile({ type: 'asset', fileName: iconPath(config, size), source: png });

105 }

106 console.log(`[spark-html-manifest] ${(config.sizes || ICON_SIZES).length} icon(s) generated from ${config.icon}`);

107 },

108

109 // After prerender wrote its pages: stamp the head tags into every page.

110 closeBundle: {

111 order: 'post',

112 async handler() {

113 const root = resolve(outDir);