registry / vitepress-export / 0.1.0

vitepress-export@0.1.0

Publication-grade PDF export for VitePress sites

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 45.3 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 applyCjkSpacing,

4 buildPrintStyles,

5 presetStyles

6} from "./chunk-7XPFEVOR.js";

7import {

8 defaultConfig,

9 ensureDirExists,

10 resolveConfig,

11 resolveOutputPath

12} from "./chunk-GN2ZTPT3.js";

14// src/cli/index.ts

15import { Command } from "commander";

16import { existsSync as existsSync2 } from "fs";

17import { resolve as resolve2 } from "path";

18import { spawn, execSync } from "child_process";

19import { createServer as createNetServer } from "net";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L17

20import { chromium } from "playwright-core";

22// src/debug.ts

23var _debug = false;

24var setDebug = (v) => {

25 _debug = v;

26};

27var debugLog = (...args) => {

28 if (_debug) console.log("[vitepress-export] [DEBUG]", ...args);

29};

31// src/router/index.ts

32import picomatch from "picomatch";

33async function resolveRoutes(baseUrl, options) {

34 const url = baseUrl.replace(/\/$/, "") + "/hashmap.json";

35 let hashmap;

36 try {

37 const res = await fetch(url);

Lines 824-864javascript

824 outline: config.pdf?.outline,

825 outlineDepth: config.pdf?.outlineDepth,

826 watermarkText: config.pdf?.watermark

827 });

828 const { writeFile } = await import("fs/promises");

829 await writeFile(outputPath, finalPdf);

830 console.log(

dist/chunk-GN2ZTPT3.jsView file

Lines 121-161javascript

121 }

122 if (!configPath && !opts.rootDir) {

123 let dir = dirname(resolve(process.cwd()));

124 while (dir !== dirname(dir)) {

125 const found

Source & flagged code

3 flagged · loading source

dist/bin.jsView file

17import { resolve as resolve2 } from "path"; L18: import { spawn, execSync } from "child_process"; L19: import { createServer as createNetServer } from "net";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L17

844try { L845: execSync("npx vitepress build", { cwd: rootDir, stdio: "inherit" }); L846: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L844

dist/chunk-GN2ZTPT3.jsView file

141}); L142: const mod = await jiti.import(configPath); L143: const exported = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-GN2ZTPT3.jsView on unpkg · L141

Findings

3 High3 Medium5 Low

HighChild Processdist/bin.js

HighShell

HighRuntime Package Installdist/bin.js

MediumDynamic Requiredist/chunk-GN2ZTPT3.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 applyCjkSpacing,

4 buildPrintStyles,

5 presetStyles

6} from "./chunk-7XPFEVOR.js";

7import {

8 defaultConfig,

9 ensureDirExists,

10 resolveConfig,

11 resolveOutputPath

12} from "./chunk-GN2ZTPT3.js";

14// src/cli/index.ts

15import { Command } from "commander";

16import { existsSync as existsSync2 } from "fs";

17import { resolve as resolve2 } from "path";

18import { spawn, execSync } from "child_process";

19import { createServer as createNetServer } from "net";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L17

20import { chromium } from "playwright-core";

22// src/debug.ts

23var _debug = false;

24var setDebug = (v) => {

25 _debug = v;

26};

27var debugLog = (...args) => {

28 if (_debug) console.log("[vitepress-export] [DEBUG]", ...args);

29};

31// src/router/index.ts

32import picomatch from "picomatch";

33async function resolveRoutes(baseUrl, options) {

34 const url = baseUrl.replace(/\/$/, "") + "/hashmap.json";

35 let hashmap;

36 try {

37 const res = await fetch(url);

Lines 824-864javascript

824 outline: config.pdf?.outline,

825 outlineDepth: config.pdf?.outlineDepth,

826 watermarkText: config.pdf?.watermark

827 });

828 const { writeFile } = await import("fs/promises");

829 await writeFile(outputPath, finalPdf);

830 console.log(

dist/chunk-GN2ZTPT3.jsView file

Lines 121-161javascript

121 }

122 if (!configPath && !opts.rootDir) {

123 let dir = dirname(resolve(process.cwd()));

124 while (dir !== dirname(dir)) {

125 const found