registry / @aroman22/codegraph-vba-win32-x64 / 1.3.5

@aroman22/codegraph-vba-win32-x64@1.3.5

CodeGraph self-contained bundle for win32-x64

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 149 file(s), 2.65 MB of source, external domains: ai.getcodegraph.com, antigravity.google, api.github.com, app.getcodegraph.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, telemetry.getcodegraph.com

Source & flagged code

8 flagged

lib/dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

74exports.hasCommand = hasCommand;

75exports.defaultRun = defaultRun;

76const fs = __importStar(require("fs"));

77const path = __importStar(require("path"));

78const https = __importStar(require("https"));

79const child_process_1 = require("child_process");

80exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

81exports.NPM_PACKAGE = 'codegraph-vba';

82const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

83exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

84function toPosix(p) {

85 return p.replace(/\\/g, '/');

86}

87/**

88 * Where the bundle installer keeps its install root, derived from the bundle

89 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

90 * the layout isn't the one the installer creates (then the installer falls

91 * back to its own default).

92 *

93 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

94 * windows: <installDir>\current (bundleRoot) → <installDir>

95 */

96function deriveInstallDir(bundleRoot, os, exists) {

97 // Use the TARGET platform's path semantics (not the host's), so this is

98 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

lib/dist/bin/codegraph.jsView file

Lines 69-109javascript

69const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

70const command_supervision_1 = require("./command-supervision");

71const extraction_version_1 = require("../extraction/extraction-version");

72const telemetry_1

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

lib/dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken = pollForToken;

6exports.openBrowser = openBrowser;

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 const detectionLocation = opts.location ?? 'global';

106 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

107 if (targets.length === 0) {

108 clack.

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 92279112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

Source & flagged code

8 flagged · loading source

lib/dist/upgrade/index.jsView file

78const https = __importStar(require("https")); L79: const child_process_1 = require("child_process"); L80: exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

lib/dist/bin/codegraph.jsView file

89// eslint-disable-next-line @typescript-eslint/no-implied-eval L90: const importESM = new Function('specifier', 'return import(specifier)'); L91: // Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

lib/dist/bin/codegraph.jsView on unpkg · L89

lib/dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

lib/dist/reasoning/login.jsView file

17*/ L18: const child_process_1 = require("child_process"); L19: const DEFAULT_BASE = 'https://app.getcodegraph.com'; L20: /** Dashboard base for the device-login endpoints; override for testing via CODEGRAPH_LOGIN_URL. */ L21: function loginBaseUrl() { L22: const raw = process.env.CODEGRAPH_LOGIN_URL?.trim() || DEFAULT_BASE; L23: return raw.replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/dist/reasoning/login.jsView on unpkg · L17

lib/dist/installer/index.jsView file

125try { L126: (0, child_process_1.execSync)('npm install -g @colbymchenry/codegraph', { stdio: 'pipe', windowsHide: true }); L127: s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L125

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 92279112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

Findings

5 High7 Medium3 Low

HighChild Processlib/dist/upgrade/index.js

HighShell

HighEvallib/dist/bin/codegraph.js

HighSame File Env Network Executionlib/dist/reasoning/login.js

HighRuntime Package Installlib/dist/installer/index.js

MediumDynamic Requirelib/dist/ui/shimmer-worker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarynode.exe

MediumShips Wasm Modulelib/dist/extraction/wasm/tree-sitter-scala.wasm

MediumShips Build Helperbin/codegraph.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

lib/dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

74exports.hasCommand = hasCommand;

75exports.defaultRun = defaultRun;

76const fs = __importStar(require("fs"));

77const path = __importStar(require("path"));

78const https = __importStar(require("https"));

79const child_process_1 = require("child_process");

80exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L78

81exports.NPM_PACKAGE = 'codegraph-vba';

82const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

83exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

84function toPosix(p) {

85 return p.replace(/\\/g, '/');

86}

87/**

88 * Where the bundle installer keeps its install root, derived from the bundle

89 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

90 * the layout isn't the one the installer creates (then the installer falls

91 * back to its own default).

92 *

93 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

94 * windows: <installDir>\current (bundleRoot) → <installDir>

95 */

96function deriveInstallDir(bundleRoot, os, exists) {

97 // Use the TARGET platform's path semantics (not the host's), so this is

98 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

lib/dist/bin/codegraph.jsView file

Lines 69-109javascript

69const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

70const command_supervision_1 = require("./command-supervision");

71const extraction_version_1 = require("../extraction/extraction-version");

72const telemetry_1

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

lib/dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken = pollForToken;

6exports.openBrowser = openBrowser;

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 const detectionLocation = opts.location ?? 'global';

106 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

107 if (targets.length === 0) {

108 clack.

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 92279112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg