etincel-nonfiction

What was found

The package manifest exposes one or more command-line entry points.

Why it matters

Command-line entry points indicate code intended to execute on the user's system.

Evidence snippet

No public snippet is available. It was not recorded or is withheld to protect sensitive content.

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the declared command-line entry point and its startup behavior, requested permissions and inputs before running it.

Limitations and legitimate-use context

Declaring a command-line tool is common and does not by itself indicate unsafe behavior.

What was found

The package declares a lifecycle script associated with preparation or publication.

Why it matters

Such scripts show automated code execution in the package workflow and provide useful review context.

Evidence snippet

prepublishOnly: npm run build

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Check which preparation or publication workflow invokes the script and distinguish it from consumer installation.

Limitations and legitimate-use context

Publish-oriented scripts do not normally run when a consumer installs the package.

What was found

The package declares a script that can run during consumer installation.

Why it matters

Install-time scripts execute before a user starts the tool and can modify the local environment.

Evidence snippet

postinstall: node -e "require('fs').existsSync('tsconfig.json')&&require('child_process').execSync('npm run build',{stdio:'inherit'})"

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the lifecycle command and dependencies before installation. Determine what runs on the consumer's machine and whether scripts can be disabled.

Limitations and legitimate-use context

The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.

What was found

Static analysis detected an API or option capable of launching shell commands.

Why it matters

Shell execution can interact with the host system and expands the impact of unsafe input.

Evidence snippet

"postinstall": "node -e \"require('fs').existsSync('tsconfig.json')&&require('child_process').execSync('npm run build',{stdio:'inherit'})\"",

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the command, its inputs and call path. Check input validation and whether execution is expected and explicitly authorized.

Limitations and legitimate-use context

The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.