registry / zsh-history-enquirer / 1.3.2

zsh-history-enquirer@1.3.2

zsh history search plugin by enquirer

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 172 KB of source, external domains: css-tricks.com, ecma-international.org, github.com, qntm.org, www.ecma-international.org, www.xfree86.org

Source & flagged code

4 flagged

package.jsonView file

Lines 4-45json

4 "description": "zsh history search plugin by enquirer",

5 "repository": "zthxxx/zsh-history-enquirer",

6 "publishConfig": {

7 "registry": "https://registry.npmjs.org"

8 },

9 "main": "index.js",

10 "bin": {

11 "zsh-history-enquirer": "bin/index.js"

12 },

13 "scripts": {

14 "clean": "rimraf dist public coverage debug.log",

15 "test": "jest tests",

16 "test:zsh": "tests/zsh-widget.test.zsh",

17 "build": "npm-run-all clean build:rollup build:site",

18 "build:rollup": "rollup -c",

19 "build:dev": "npm run clean && rollup -c -w",

20 "docs": "eloc open intro.md -i 'images/**' --progress",

21 "build:site": "eloc build intro.md -i '{CNAME,images/**}' --title 'zsh-history-enquirer' --progress",

22 "record": "scripts/record.zsh",

23 "render": "scripts/render-record.zsh",

24 "preinstall": "command -v zsh || (npm run warn:zsh && exit 1)",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "postinstall": "env zsh -il scripts/postinstall.zsh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "postuninstall": "npm run rm-plugin:config && npm run rm-plugin:file",

27 "postpublish": "npm run clean",

28 "warn:zsh": "echo '\\n\\n!! this is a plugin for zsh, please install zsh at first \\n\\n' >&2",

29 "benchmark": "scripts/benchmark.zsh",

30 "rm-plugin:config": "perl -i -pe 's/.*zsh-history-enquirer.*//gms' ${HOME}/.zshrc",

31 "rm-plugin:file": "rm -rf ${ZSH_CUSTOM:-${ZSH}/custom}/plugins/zsh-history-enquirer"

32 },

33 "keywords": [

34 "zsh",

35 "zsh-history",

36 "history",

37 "search",

38 "history-search",

39 "history-enhance",

40 "plugin",

41 "zsh-plugin",

42 "enquirer",

43 "inquirer"

44 ],

45 "author": "zthxxx",

dist/history.zshView file

•path = dist/history.zsh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/history.zshView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = env zsh -il scripts/postinstall.zsh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = command -v zsh || (npm run warn:zsh && exit 1)

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = env zsh -il scripts/postinstall.zsh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/history.zshView file

•path = dist/history.zsh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/history.zshView on unpkg

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperdist/history.zsh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 4-45json

4 "description": "zsh history search plugin by enquirer",

5 "repository": "zthxxx/zsh-history-enquirer",

6 "publishConfig": {

7 "registry": "https://registry.npmjs.org"

8 },

9 "main": "index.js",

10 "bin": {

11 "zsh-history-enquirer": "bin/index.js"

12 },

13 "scripts": {

14 "clean": "rimraf dist public coverage debug.log",

15 "test": "jest tests",

16 "test:zsh": "tests/zsh-widget.test.zsh",

17 "build": "npm-run-all clean build:rollup build:site",

18 "build:rollup": "rollup -c",

19 "build:dev": "npm run clean && rollup -c -w",

20 "docs": "eloc open intro.md -i 'images/**' --progress",

21 "build:site": "eloc build intro.md -i '{CNAME,images/**}' --title 'zsh-history-enquirer' --progress",

22 "record": "scripts/record.zsh",

23 "render": "scripts/render-record.zsh",

24 "preinstall": "command -v zsh || (npm run warn:zsh && exit 1)",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "postinstall": "env zsh -il scripts/postinstall.zsh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "postuninstall": "npm run rm-plugin:config && npm run rm-plugin:file",

27 "postpublish": "npm run clean",

28 "warn:zsh": "echo '\\n\\n!! this is a plugin for zsh, please install zsh at first \\n\\n' >&2",

29 "benchmark": "scripts/benchmark.zsh",

30 "rm-plugin:config": "perl -i -pe 's/.*zsh-history-enquirer.*//gms' ${HOME}/.zshrc",

31 "rm-plugin:file": "rm -rf ${ZSH_CUSTOM:-${ZSH}/custom}/plugins/zsh-history-enquirer"

32 },

33 "keywords": [

34 "zsh",

35 "zsh-history",

36 "history",

37 "search",

38 "history-search",

39 "history-enhance",

40 "plugin",

41 "zsh-plugin",

42 "enquirer",

43 "inquirer"

44 ],

45 "author": "zthxxx",

dist/history.zshView file

•path = dist/history.zsh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/history.zshView on unpkg