registry / ultracite / 7.8.4

ultracite@7.8.4

The AI-ready formatter that helps you write and generate code faster.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEval

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 226 KB of source, external domains: github.com, registry.npmjs.org, www.ultracite.ai, www.youtube.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 58-98javascript

58 - Use semantic elements (\`<button>\`, \`<nav>\`, etc.) instead of divs with roles

60### Error Handling & Debugging

62- Remove \`console.log\`, \`debugger\`, and \`alert\` statements from production code

63- Throw \`Error\` objects with descriptive messages, not strings or other values

64- Use \`try-catch\` blocks meaningfully - don't catch errors just to rethrow them

65- Prefer early returns over nested conditionals for error cases

67### Code Organization

69- Keep functions focused and under reasonable cognitive complexity limits

70- Extract complex conditions into well-named boolean variables

71- Use early returns to reduce nesting

72- Prefer simple conditionals over nested ternary operators

73- Group related code together and separate concerns

75### Security

77- Add \`rel="noopener"\` when using \`target="_blank"\` on links

78- Avoid \`dangerouslySetInnerHTML\` unless absolutely necessary

79- Don't use \`eval()\` or assign directly to \`document.cookie\`

80- Validate and sanitize user input

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L78

82### Performance

84- Avoid spread syntax in accumulators within loops

85- Use top-level regex literals instead of creating them in loops

86- Prefer specific imports over namespace imports

87- Avoid barrel files (index files that re-export everything)

88- Use proper image components (e.g., Next.js \`<Image>\`) over \`<img>\` tags

90### Framework-Specific Guidance

92**Next.js:**

93- Use Next.js \`<Image>\` component for images

94- Use \`next/head\` or App Router metadata API for head elements

95- Use Server Components for async data fetching instead of async Client Components

97**React 19+:**

98- Use ref as a prop instead of \`React.forwardRef\`

Lines 224-264javascript

224 - "**/*.jsx"

225 - "**/*.ts"

226 - "**/*.tsx"

227 - "**/*.json"

228 - "**/*.jsonc"

229 - "**/*.css"

230 stage_fixed: true`,d=o.replace(An,`$<preCommitJobs>

Source & flagged code

2 flagged · loading source

dist/index.jsView file

244`)},kn=async(e,o)=>{let t=await ie(e,"utf-8"),i=Un(t);if(!i)return;if(se(i))return;let n=ne(i,H(o));await c(e,`${JSON.stringify(n,null,2)} L245: `)},En=(e)=>e.replaceAll(/^(?<key>[*?{[][^\n:]*):(?<rest>.*)$/gmu,(o,t,i)=>`'${t}':${i}`),In=async(e,o)=>{let t=await ie(e,"utf-8"),i=En(t),n;try{n=gt.parse(i)}catch{return}if(!n)r... L246: `;await c(e,d)},Nn=async(e,o)=>{let i=await import(`${vt(e).href}?t=${Date.now()}`),n=i.default||i;if(se(n))return;let a=ne(n,H(o)),d=`module.exports = ${JSON.stringify(a,null,2)};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L244

78- Avoid \`dangerouslySetInnerHTML\` unless absolutely necessary L79: - Don't use \`eval()\` or assign directly to \`document.cookie\` L80: - Validate and sanitize user input

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L78

Findings

2 Medium4 Low

MediumDynamic Requiredist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 58-98javascript

58 - Use semantic elements (\`<button>\`, \`<nav>\`, etc.) instead of divs with roles

60### Error Handling & Debugging

62- Remove \`console.log\`, \`debugger\`, and \`alert\` statements from production code

63- Throw \`Error\` objects with descriptive messages, not strings or other values

64- Use \`try-catch\` blocks meaningfully - don't catch errors just to rethrow them

65- Prefer early returns over nested conditionals for error cases

67### Code Organization

69- Keep functions focused and under reasonable cognitive complexity limits

70- Extract complex conditions into well-named boolean variables

71- Use early returns to reduce nesting

72- Prefer simple conditionals over nested ternary operators

73- Group related code together and separate concerns

75### Security

77- Add \`rel="noopener"\` when using \`target="_blank"\` on links

78- Avoid \`dangerouslySetInnerHTML\` unless absolutely necessary

79- Don't use \`eval()\` or assign directly to \`document.cookie\`

80- Validate and sanitize user input

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L78

82### Performance

84- Avoid spread syntax in accumulators within loops

85- Use top-level regex literals instead of creating them in loops

86- Prefer specific imports over namespace imports

87- Avoid barrel files (index files that re-export everything)

88- Use proper image components (e.g., Next.js \`<Image>\`) over \`<img>\` tags

90### Framework-Specific Guidance

92**Next.js:**

93- Use Next.js \`<Image>\` component for images

94- Use \`next/head\` or App Router metadata API for head elements

95- Use Server Components for async data fetching instead of async Client Components

97**React 19+:**

98- Use ref as a prop instead of \`React.forwardRef\`

Lines 224-264javascript

224 - "**/*.jsx"

225 - "**/*.ts"

226 - "**/*.tsx"

227 - "**/*.json"

228 - "**/*.jsonc"

229 - "**/*.css"

230 stage_fixed: true`,d=o.replace(An,`$<preCommitJobs>