registry / @aroman22/codegraph-vba-darwin-arm64 / 1.8.0

@aroman22/codegraph-vba-darwin-arm64@1.8.0

CodeGraph self-contained bundle for darwin-arm64

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 185 file(s), 3.35 MB of source, external domains: antigravity.google, api.github.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, telemetry.getcodegraph.com

Source & flagged code

7 flagged

lib/dist/upgrade/index.jsView file

Lines 65-105javascript

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.resolveNpmGlobalRoot = resolveNpmGlobalRoot;

77exports.findOrphanStagings = findOrphanStagings;

78exports.cleanupOrphanStagings = cleanupOrphanStagings;

79exports.readInstalledPackageVersion = readInstalledPackageVersion;

80exports.hasCommand = hasCommand;

81exports.defaultRun = defaultRun;

82exports.defaultCapture = defaultCapture;

83const fs = __importStar(require("fs"));

84const path = __importStar(require("path"));

85const https = __importStar(require("https"));

86const child_process_1 = require("child_process");

87exports.REPO = 'ardelperal/codegraph-vba';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L85

88exports.NPM_PACKAGE = '@aroman22/codegraph-vba';

89const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

90exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

91function toPosix(p) {

92 return p.replace(/\\/g, '/');

93}

94/**

95 * Where the bundle installer keeps its install root, derived from the bundle

96 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

97 * the layout isn't the one the installer creates (then the installer falls

98 * back to its own default).

99 *

100 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

101 * windows: <installDir>\current (bundleRoot) → <installDir>

102 */

103function deriveInstallDir(bundleRoot, os, exists) {

104 // Use the TARGET platform's path semantics (not the host's), so this is

105 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

lib/dist/bin/codegraph.jsView file

Lines 74-114javascript

74const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

75const command_supervision_1 = require("./command-supervision");

76const extraction_version_1 =

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

lib/dist/upgrade/index.js#virtual:normalized:round1View file

84const path = __importStar(require("path")); L85: const https = __importStar(require("https")); L86: const child_process_1 = require("child_process"); L87: exports.REPO = 'ardelperal/codegraph-vba'; ... L159: const repoRoot = P.resolve(binDir, '..', '..'); L160: if (exists(P.join(repoRoot, 'package.json')) && exists(P.join(repoRoot, '.git'))) { L161: return { kind: 'source', root: repoRoot }; ... L262: const res = await httpsGet(`https://api.github.com/repos/${repo}/releases/latest`, { 'User-Agent': 'codegraph-upgrade', Accept: 'application/vnd.github+json' }, timeoutMs); L263: const tag = JSON.parse(res.body)?.tag_name; L264: if (typeof tag === 'string' && tag) ... L289: /** L290: * Returns the process exit code (0 = success / nothing to do, 1 = failure).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dist/upgrade/index.js#virtual:normalized:round1View on unpkg · L84

lib/dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

nodeView file

•path = node kind = native_binary sizeBytes = 120573328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

Source & flagged code

7 flagged · loading source

lib/dist/upgrade/index.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code