registry / @arvoretech/hub-core / 0.26.2

@arvoretech/hub-core@0.26.2

Core config loader, types, and prompt builders for hub workspaces

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 64.4 KB of source, external domains: api.github.com, api.notion.com, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 12-57javascript

12 onboarding: pi.onboarding ?? true,

13 autoMcpWiring: pi.autoMcpWiring ?? true,

14 injectCapabilities: pi.injectCapabilities ?? true,

15 hooks: pi.hooks ?? true,

16 persona: pi.persona ?? true,

17 repoContext: pi.repoContext ?? true

18 };

19}

20var configCache = /* @__PURE__ */ new Map();

21var RESOLVED_CACHE_DIR = ".hub";

22var RESOLVED_CACHE_FILE = "config-resolved.json";

23function resolveConfigPath(dir) {

24 const tsPath = join(dir, "hub.config.ts");

25 if (existsSync(tsPath)) return { path: tsPath, format: "typescript" };

26 const yamlPath = join(dir, "hub.yaml");

27 if (existsSync(yamlPath)) return { path: yamlPath, format: "yaml" };

28 throw new Error(`No hub config found in ${dir}. Expected hub.config.ts or hub.yaml`);

29}

30async function loadTypeScriptConfig(configPath) {

31 const fileUrl = pathToFileURL(configPath).href;

32 try {

33 const mod = await import(fileUrl);

34 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L32

35 } catch {

36 const { execFileSync } = await import("child_process");

37 const evalScript = `import c from ${JSON.stringify(fileUrl)}; console.log(JSON.stringify(c.default ?? c));`;

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L35

38 const json = execFileSync("npx", ["tsx", "-e", evalScript], {

39 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L37

40 cwd: dirname(configPath),

41 stdio: ["ignore", "pipe", "pipe"],

42 timeout: 15e3

43 });

44 return JSON.parse(json);

45 }

46}

47var warnedLegacyWorkflow = /* @__PURE__ */ new Set();

48function warnLegacyWorkflow(configPath, config) {

49 const legacy = config.workflow;

50 if (!legacy) return;

51 if (legacy.pipeline === void 0 && legacy.enforce_workflow === void 0) return;

52 if (warnedLegacyWorkflow.has(configPath)) return;

53 warnedLegacyWorkflow.add(configPath);

54 console.warn(

55 "[hub] 'workflow.pipeline' and 'workflow.enforce_workflow' were removed in the skills-centered model and are ignored. Migrate your agents to skills: hub skills add <name>."

56 );

57}

Source & flagged code

3 flagged · loading source

dist/index.jsView file

35} catch { L36: const { execFileSync } = await import("child_process"); L37: const evalScript = `import c from ${JSON.stringify(fileUrl)}; console.log(JSON.stringify(c.default ?? c));`;

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L35

37const evalScript = `import c from ${JSON.stringify(fileUrl)}; console.log(JSON.stringify(c.default ?? c));`; L38: const json = execFileSync("npx", ["tsx", "-e", evalScript], { L39: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L37

32try { L33: const mod = await import(fileUrl); L34: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L32

Findings

2 High4 Medium4 Low

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 12-57javascript

12 onboarding: pi.onboarding ?? true,

13 autoMcpWiring: pi.autoMcpWiring ?? true,

14 injectCapabilities: pi.injectCapabilities ?? true,

15 hooks: pi.hooks ?? true,

16 persona: pi.persona ?? true,

17 repoContext: pi.repoContext ?? true

18 };

19}

20var configCache = /* @__PURE__ */ new Map();

21var RESOLVED_CACHE_DIR = ".hub";

22var RESOLVED_CACHE_FILE = "config-resolved.json";

23function resolveConfigPath(dir) {

24 const tsPath = join(dir, "hub.config.ts");

25 if (existsSync(tsPath)) return { path: tsPath, format: "typescript" };

26 const yamlPath = join(dir, "hub.yaml");

27 if (existsSync(yamlPath)) return { path: yamlPath, format: "yaml" };

28 throw new Error(`No hub config found in ${dir}. Expected hub.config.ts or hub.yaml`);

29}

30async function loadTypeScriptConfig(configPath) {

31 const fileUrl = pathToFileURL(configPath).href;

32 try {

33 const mod = await import(fileUrl);

34 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L32

35 } catch {

36 const { execFileSync } = await import("child_process");

37 const evalScript = `import c from ${JSON.stringify(fileUrl)}; console.log(JSON.stringify(c.default ?? c));`;

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L35

38 const json = execFileSync("npx", ["tsx", "-e", evalScript], {

39 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L37

40 cwd: dirname(configPath),

41 stdio: ["ignore", "pipe", "pipe"],

42 timeout: 15e3

43 });

44 return JSON.parse(json);

45 }

46}

47var warnedLegacyWorkflow = /* @__PURE__ */ new Set();

48function warnLegacyWorkflow(configPath, config) {

49 const legacy = config.workflow;

50 if (!legacy) return;

51 if (legacy.pipeline === void 0 && legacy.enforce_workflow === void 0) return;

52 if (warnedLegacyWorkflow.has(configPath)) return;

53 warnedLegacyWorkflow.add(configPath);

54 console.warn(

55 "[hub] 'workflow.pipeline' and 'workflow.enforce_workflow' were removed in the skills-centered model and are ignored. Migrate your agents to skills: hub skills add <name>."

56 );

57}