registry / @aroman22/codegraph-vba-win32-arm64 / 1.4.0

@aroman22/codegraph-vba-win32-arm64@1.4.0

CodeGraph self-contained bundle for win32-arm64

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 151 file(s), 2.66 MB of source, external domains: ai.getcodegraph.com, antigravity.google, api.github.com, app.getcodegraph.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, telemetry.getcodegraph.com

Source & flagged code

9 flagged

lib/dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE

Source & flagged code

9 flagged · loading source

lib/dist/upgrade/index.js

View file

78const https = __importStar(require("https")); L79: const child_process_1 = require("child_process"); L80: exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

•matchType = package_source_clone_identity_mismatch matchedPackage = codegraph-vba-win32-arm64@1.3.2 matchedPath = lib/dist/bin/command-supervision.js matchedIdentity = npm:[redacted]:1.3.2 similarity = 0.963 shingleOverlap = 77 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

lib/dist/upgrade/index.jsView on unpkg

lib/dist/bin/codegraph.jsView file

89// eslint-disable-next-line @typescript-eslint/no-implied-eval L90: const importESM = new Function('specifier', 'return import(specifier)'); L91: // Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

lib/dist/bin/codegraph.jsView on unpkg · L89

lib/dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

lib/dist/reasoning/login.jsView file

17*/ L18: const child_process_1 = require("child_process"); L19: const DEFAULT_BASE = 'https://app.getcodegraph.com'; L20: /** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */ L21: function loginBaseUrl() { L22: const raw = process.env.CODEGRAPH_LOGIN_URL?.trim() || DEFAULT_BASE; L23: return raw.replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/dist/reasoning/login.jsView on unpkg · L17

lib/dist/installer/index.jsView file

125try { L126: (0, child_process_1.execSync)('npm install -g @colbymchenry/codegraph', { stdio: 'pipe', windowsHide: true }); L127: s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L125

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 81025864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

Findings

6 High7 Medium3 Low

HighChild Processlib/dist/upgrade/index.js

HighShell

HighEvallib/dist/bin/codegraph.js

HighSame File Env Network Executionlib/dist/reasoning/login.js

HighRuntime Package Installlib/dist/installer/index.js

HighPackage Source Clone Identity Mismatchlib/dist/upgrade/index.js

MediumDynamic Requirelib/dist/ui/shimmer-worker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarynode.exe

MediumShips Wasm Modulelib/dist/extraction/wasm/tree-sitter-scala.wasm

MediumShips Build Helperbin/codegraph.cmd

MediumStructural Risk Force Deep Review

LPM CLI

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

lib/dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE

=

exports

.

REPO

=

void

0

;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

74exports.hasCommand = hasCommand;

75exports.defaultRun = defaultRun;

76const fs = __importStar(require("fs"));

77const path = __importStar(require("path"));

78const https = __importStar(require("https"));

79const child_process_1 = require("child_process");

80exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

81exports.NPM_PACKAGE = 'codegraph-vba';

82const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

83exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

84function toPosix(p) {

85 return p.replace(/\\/g, '/');

86}

87/**

88 * Where the bundle installer keeps its install root, derived from the bundle

89 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

90 * the layout isn't the one the installer creates (then the installer falls

91 * back to its own default).

92 *

93 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

94 * windows: <installDir>\current (bundleRoot) → <installDir>

95 */

96function deriveInstallDir(bundleRoot, os, exists) {

97 // Use the TARGET platform's path semantics (not the host's), so this is

98 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

•matchType = package_source_clone_identity_mismatch matchedPackage = codegraph-vba-win32-arm64@1.3.2 matchedPath = lib/dist/bin/command-supervision.js matchedIdentity = npm:[redacted]:1.3.2 similarity = 0.963 shingleOverlap = 77 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

lib/dist/upgrade/index.jsView on unpkg

lib/dist/bin/codegraph.jsView file

Lines 69-109javascript

69const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

70const command_supervision_1 = require("./command-supervision");

71const extraction_version_1 =

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

lib/dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken =

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 const detectionLocation = opts.location ?? 'global';

106 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

107 if

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 81025864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

require

(

"../extraction/extraction-version"

);

72const telemetry_1 = require("../telemetry");

73// Lazy-load heavy modules (CodeGraph, runInstaller) to keep CLI startup fast.

74async function loadCodeGraph() {

75 try {

76 return await Promise.resolve().then(() => __importStar(require('../index')));

77 }

78 catch (err) {

79 const msg = err instanceof Error ? err.message : String(err);

80 console.error(`\x1b[31m${(0, glyphs_1.getGlyphs)().err}\x1b[0m Failed to load CodeGraph modules.`);

81 console.error(`\n Node: ${process.version} Platform: ${process.platform} ${process.arch}`);

82 console.error(`\n Error: ${msg}`);

83 console.error('\n Try reinstalling with: npm install -g @colbymchenry/codegraph\n');

84 process.exit(1);

85 }

86}

87// Dynamic import helper — tsc compiles import() to require() in CJS mode,

88// which fails for ESM-only packages. This bypasses the transformation.

89// eslint-disable-next-line @typescript-eslint/no-implied-eval

90const importESM = new Function('specifier', 'return import(specifier)');

91// Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

lib/dist/bin/codegraph.jsView on unpkg · L89

92// allocator bug that reliably crashes when compiling tree-sitter

93// grammars (see #54, #81, #140). The previous behaviour was a soft

94// console.warn that scrolls off-screen before the OOM crash 30 seconds

95// later, leading to a steady stream of "what is this OOM" reports.

96// Hard-exit before any WASM work; allow override via env var for users

97// who patched V8 themselves or want to test a future fix.

98const nodeVersion = process.versions.node;

99const nodeMajor = parseInt(nodeVersion.split('.')[0] ?? '0', 10);

100if (nodeMajor >= 25) {

101 process.env.CODEGRAPH_ALLOW_UNSAFE_NODE = '1';

102}

103// Enforce the supported Node floor. `engines` in package.json only *warns* on

104// install (unless engine-strict), so hard-block here to actually keep users off

105// unsupported versions. Mirrors the 25+ block above. See package.json `engines`.

106if ((0, node_version_check_1.isBelowMinimumNodeVersion)(nodeVersion)) {

107 process.stderr.write((0, node_version_check_1.buildNodeTooOldBanner)(nodeVersion) + '\n');

108 if (!process.env.CODEGRAPH_ALLOW_UNSAFE_NODE) {

109 process.exit(1);

=

require

(

"fs"

);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

5const glyphs_1 = require("./glyphs");

6// Write directly to fd 1 (stdout) instead of writeStdout().

7// In Node.js worker threads, process.stdout is proxied through the main

8// thread's event loop — so if the main thread is blocked (e.g. SQLite),

9// stdout writes from the worker queue up and the animation freezes.

10// fs.writeSync(1, ...) is a direct kernel syscall that bypasses this.

11//

12// Side effect: bypasses Node's TTY-aware encoding conversion on Windows,

13// so UTF-8 bytes hit the console raw and mojibake on OEM codepages.

14// `getGlyphs()` returns ASCII fallbacks on Windows to avoid this (#168).

15function writeStdout(s) {

16 (0, fs_1.writeSync)(1, s);

17}

18const G = (0, glyphs_1.getGlyphs)();

19const SPINNER_GLYPHS = G.spinner;

20const ANIM_INTERVAL = 150;

21const FRAMES_PER_GLYPH = 3;

22const RST = '\x1b[0m';

pollForToken;

6exports.openBrowser = openBrowser;

7/**

8 * Managed-login device flow for `codegraph login`.

9 *

10 * Opens the user's browser to the CodeGraph dashboard, where they authorize with

11 * their account; the CLI meanwhile polls for the minted, org-scoped token and

12 * stores it (see ./credentials + ./config) to turn on managed reasoning.

13 *

14 * This talks to the DASHBOARD (app.getcodegraph.com), not the metered gateway —

15 * it's a plain OAuth-style device handshake (RFC 8628 shape), nothing proprietary.

16 * The resulting token is what authenticates the managed reasoning calls (./reasoner).

17 */

18const child_process_1 = require("child_process");

19const DEFAULT_BASE = 'https://app.getcodegraph.com';

20/** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */

21function loginBaseUrl() {

22 const raw = process.env.CODEGRAPH_LOGIN_URL?.trim() || DEFAULT_BASE;

23 return raw.replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/dist/reasoning/login.jsView on unpkg · L17

24}

25/** Begin a device-authorization request. */

26async function startDeviceLogin() {

27 const base = loginBaseUrl();

28 const res = await fetch(`${base}/api/cli/device/start`, {

29 method: 'POST',

30 headers: { 'content-type': 'application/json' },

31 body: '{}',

32 }).catch(() => null);

33 if (!res)

34 throw new Error(`couldn't reach ${base} — check your connection`);

35 if (!res.ok)

36 throw new Error(`couldn't start login (HTTP ${res.status})`);

37 const j = (await res.json().catch(() => null));

(targets.

length

===

0

) {

108 clack.outro('No agent targets selected — nothing to do.');

109 return;

110 }

111 // Step 2: install the codegraph npm package on PATH (always offered;

112 // matches existing behavior). Skipped when --yes (assume present).

113 if (!useDefaults) {

114 const shouldInstallGlobally = await clack.confirm({

115 message: 'Install the codegraph CLI on your PATH? (Required so agents can launch the MCP server)',

116 initialValue: true,

117 });

118 if (clack.isCancel(shouldInstallGlobally)) {

119 clack.cancel('Installation cancelled.');

120 process.exit(0);

121 }

122 if (shouldInstallGlobally) {

123 const s = clack.spinner();

124 s.start('Installing codegraph CLI...');

125 try {

126 (0, child_process_1.execSync)('npm install -g @colbymchenry/codegraph', { stdio: 'pipe', windowsHide: true });

127 s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L125

128 }

129 catch {

130 s.stop('Could not install (permission denied)');

131 clack.log.warn('Try: sudo npm install -g @colbymchenry/codegraph');

132 }

133 }

134 else {

135 clack.log.info('Skipped CLI install — agents will not be able to launch the MCP server without it');

136 }

137 }

138 // Step 3: where the per-agent config files should land.

139 let location;

140 if (opts.location) {

141 location = opts.location;

142 }

143 else if (useDefaults) {

144 location = 'global';

145 }