registry / @aroman22/codegraph-vba-win32-arm64 / 1.5.1

@aroman22/codegraph-vba-win32-arm64@1.5.1

CodeGraph self-contained bundle for win32-arm64

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 152 file(s), 2.75 MB of source, external domains: ai.getcodegraph.com, antigravity.google, api.github.com, app.getcodegraph.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, telemetry.getcodegraph.com

Source & flagged code

9 flagged

lib/dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

74exports.hasCommand = hasCommand;

75exports.defaultRun = defaultRun;

76const fs = __importStar(require("fs"));

77const path = __importStar(require("path"));

78const https = __importStar(require("https"));

79const child_process_1 = require("child_process");

80exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

81exports.NPM_PACKAGE = 'codegraph-vba';

82const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

83exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

84function toPosix(p) {

85 return p.replace(/\\/g, '/');

86}

87/**

88 * Where the bundle installer keeps its install root, derived from the bundle

89 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

90 * the layout isn't the one the installer creates (then the installer falls

91 * back to its own default).

92 *

93 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

94 * windows: <installDir>\current (bundleRoot) → <installDir>

95 */

96function deriveInstallDir(bundleRoot, os, exists) {

97 // Use the TARGET platform's path semantics (not the host's), so this is

98 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

•matchType = package_source_clone_identity_mismatch matchedPackage = codegraph-vba-win32-arm64@1.3.2 matchedPath = lib/dist/bin/command-supervision.js matchedIdentity = npm:[redacted]:1.3.2 similarity = 0.912 shingleOverlap = 73 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

lib/dist/upgrade/index.jsView on unpkg

lib/dist/bin/codegraph.jsView file

Lines 69-109javascript

69const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

70const command_supervision_1 = require("./command-supervision");

71const extraction_version_1 =

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

lib/dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken =

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 const detectionLocation = opts.location ?? 'global';

106 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

107 if

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 81025864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

Source & flagged code

9 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code