registry / @alejoamiras/aztec-benchmark / 5.0.0

@alejoamiras/aztec-benchmark@5.0.0

CLI tool and GitHub Action for Aztec contract benchmarking

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 528 KB of source, external domains: docs.github.com

Source & flagged code

5 flagged

action/dist/index.cjsView file

Lines 1-3javascript

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t

Source & flagged code

5 flagged · loading source

action/dist/index.cjsView file

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,ge... L2: /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const nor...

High

Child Process

Package source references child process execution.

action/dist/index.cjsView on unpkg · L1

High

Shell

Package source references shell execution.

action/dist/index.cjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

action/dist/index.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

action/dist/index.cjsView on unpkg · L1

dist/cli.jsView file

81try { L82: const module = await import(benchmarkFilePath); L83: const BenchmarkClass = module.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L81

Findings

5 High5 Medium4 Low

HighChild Processaction/dist/index.cjs

HighShellaction/dist/index.cjs

HighSame File Env Network Executionaction/dist/index.cjs

HighCommand Output Exfiltrationaction/dist/index.cjs

HighObfuscated

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

2/*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const normalizeLinefeeds=A=>A.replace(/\r?\n|\r/g,"\r\n");const r=[];const s=new Uint8Array([13,10]);c=0;let o=false;for(const[e,n]of A){if(typeof n==="string"){const A=F.encode(t+`; name="${escape(normalizeLinefeeds(e))}"`+`\r\n\r\n${normalizeLinefeeds(n)}\r\n`);r.push(A);c+=A.byteLength}else{const A=F.encode(`${t}; name="${escape(normalizeLinefeeds(e))}"`+(n.name?`; filename="${escape(n.name)}"`:"")+"\r\n"+`Content-Type: ${ ...

High

Child Process

Package source references child process execution.

action/dist/index.cjsView on unpkg · L1

High

Shell

Package source references shell execution.

action/dist/index.cjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

action/dist/index.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

action/dist/index.cjsView on unpkg · L1

dist/cli.jsView file

Lines 61-101javascript

61 else {

62 console.error('Error: No benchmarks specified via --contracts flag or found in the [benchmark] section of Nargo.toml.');

63 }

64 program.outputHelp();

65 process.exit(1);

66 }

67 console.log(`Found ${contractsToRunNames.length} benchmark(s) to run: ${contractsToRunNames.join(', ')}`);

68 // Iterate over the filtered contract names

69 for (const contractName of contractsToRunNames) {

70 const benchmarkFileName = availableBenchmarks[contractName];

71 const benchmarkFilePath = path.resolve(path.dirname(nargoTomlPath), benchmarkFileName);

72 const outputFilename = `${contractName}${suffix}.benchmark.json`;

73 const outputJsonPath = path.join(outputDir, outputFilename);

74 console.log(`--- Running benchmark for ${contractName}${suffix ? ` (suffix: ${suffix})` : ''} ---`);

75 console.log(` -> Benchmark file: ${benchmarkFilePath}`);

76 console.log(` -> Output report: ${outputJsonPath}`);

77 if (!fs.existsSync(benchmarkFilePath)) {

78 console.error(`Error: Benchmark file not found: ${benchmarkFilePath}`);

79 process.exit(1);

80 }

81 try {

82 const module = await import(benchmarkFilePath);

83 const BenchmarkClass = module.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L81

84 if (!BenchmarkClass ||

85 !(typeof BenchmarkClass === 'function') ||

86 !(typeof BenchmarkClass.prototype.getMethods === 'function')) {

87 console.error(`Error: ${benchmarkFilePath} does not export a default class with a getMethods method.`);

88 process.exit(1);

89 }

90 const benchmarkInstance = new BenchmarkClass();

91 let runContext = {};

92 if (typeof benchmarkInstance.setup === 'function') {

93 console.log(`Running setup for ${contractName}...`);

94 runContext = await benchmarkInstance.setup();

95 console.log(`Setup complete for ${contractName}.`);

96 }

97 if (!options.skipProving && !runContext.wallet) {

98 console.error(`Error: setup() must return a context with a 'wallet' property when proving is enabled.`);

99 process.exit(1);

100 }

101 const profiler = new Profiler(runContext.wallet, {