Is @redpanda-data/docs-extensions-and-macros safe to install?

@redpanda-data/docs-extensions-and-macros was flagged as CRITICAL RISK (risk score 336) with 22 findings detected across 214 files. Review the findings before installing.

What security issues were found in @redpanda-data/docs-extensions-and-macros?

Sigil detected 22 findings in @redpanda-data/docs-extensions-and-macros, including patterns related to install_hooks, code_patterns, obfuscation, network_exfil. See the full scan report for details.

Scans/npm/@redpanda-data/docs-extensions-and-macros

@redpanda-data/docs-extensions-and-macros

npm

Summary

@redpanda-data/docs-extensions-and-macros v4.15.3 was classified as CRITICAL RISK with a risk score of 336. Sigil detected 22 findings across 214 files, covering phases including install hooks, code patterns, obfuscation, network exfiltration. Review the findings below before installing this package.

CRITICAL RISK(336)

v4.15.3

30 March 2026, 17:36 UTC

by Sigil Bot

Risk Score

336

Findings

Files Scanned

214

Provenance

Registry

https://www.npmjs.com/package/@redpanda-data/docs-extensions-and-macros/v/4.15.3

Scanned From

https://registry.npmjs.org/@redpanda-data/docs-extensions-and-macros/-/docs-extensions-and-macros-4.15.3.tgz

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

package/cli-utils/install-test-dependencies.sh:38

      log_info "You can:"
      log_info "  1. Use fnm: curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22 && fnm use 22"
      log_info "  2. Use nvm: nvm install 22 && nvm use 22"

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

package/cli-utils/install-test-dependencies.sh:48

    log_info "Please install Node.js v$required_version or later manually:"
    log_info "  1. Use fnm: curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22 && fnm use 22"
    log_info "  2. Use nvm: nvm install 22 && nvm use 22"

Why was this flagged?

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

package/cli-utils/install-test-dependencies.sh:62

    log_info "Installing Rust..."
    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y || { log_error "Failed to install Rust"; exit 1; }
    source $HOME/.cargo/env || { log_error "Failed to load Rust environment"; exit 1; }

Why was this flagged?

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/npm/@redpanda-data/docs-extensions-and-macros)](https://sigilsec.ai/scans/A2D15A84-2EA7-4660-8A4E-A101051EBA6B)

HTML

<a href="https://sigilsec.ai/scans/A2D15A84-2EA7-4660-8A4E-A101051EBA6B"><img src="https://sigilsec.ai/badge/npm/@redpanda-data/docs-extensions-and-macros" alt="Sigil Scan"></a>

Run This Scan Yourself