registry / @aztec/l1-artifacts / 5.0.1

@aztec/l1-artifacts@5.0.1

⚠ Under review

Exposes TS-importable artifacts (bytecode + ABIs) of L1 contracts.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Manifest

NoLicense

scanned 72 file(s), 3.36 MB of source

Source & flagged code

3 flagged

l1-contracts/scripts/forge_broadcast.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// forge_broadcast.js — Run `forge script --broadcast` fast and reliably on anvil.

3//

4// anvil's automine mines each deploy transaction essentially instantly, which is what we want for

5// speed. But a batched broadcast (forge's default sends many txs at once) can race the auto-miner:

6// it mines a block on the first ready tx and may leave txs that arrived just after the trigger

7// sitting in the pool, so forge waits forever for their receipts. We avoid the race without touching

8// anvil's mining mode by broadcasting one tx at a time (`--batch-size 1`) only when anvil has

9// automine ON: with a single tx in flight there is nothing for the auto-miner to strand.

10//

11// When anvil is in interval (or no) mining mode the race does not exist — the miner drains the whole

12// pool on each block — and serializing to one tx per block would stall the deploy for a full block

13// interval per transaction, blowing past the broadcast timeout. There (and on real chains) we keep a

14// larger batch size. A hard timeout guards against a broadcast hanging indefinitely.

15//

16// Usage: ./scripts/forge_broadcast.js <forge script args...>

17// (without --broadcast or --batch-size — added automatically)

19import { spawn } from "node:child_process";

20import { writeSync } from "node:fs";

High

Child Process

Package source references child process execution.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

22const log = (msg) => process.stderr.write(`[forge_broadcast] ${msg}\n`);

24async function rpc(url, method, params = []) {

25 const res = await fetch(url, {

26 method: "POST",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

27 headers: { "Content-Type": "application/json" },

28 body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),

29 signal: AbortSignal.timeout(10_000),

30 });

31 const json = await res.json();

32 if (json.error) throw new Error(json.error.message);

33 return json.result;

34}

36function extractArg(args, flag) {

37 const i = args.indexOf(flag);

38 return i >= 0 && i < args.length - 1 ? args[i + 1] : undefined;

•matchType = previous_version_dangerous_delta matchedPackage = @aztec/l1-artifacts@4.4.0 matchedIdentity = npm:QGF6dGVjL2wxLWFydGlmYWN0cw:4.4.0 similarity = 0.479 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

l1-contracts/scripts/forge_broadcast.jsView on unpkg

Source & flagged code

3 flagged · loading source

l1-contracts/scripts/forge_broadcast.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

l1-contracts/scripts/forge_broadcast.jsView on unpkg

18L19: import { spawn } from "node:child_process"; L20: import { writeSync } from "node:fs";

High

Child Process

Package source references child process execution.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

18L19: import { spawn } from "node:child_process"; L20: import { writeSync } from "node:fs"; L21: L22: const log = (msg) => process.stderr.write(`[forge_broadcast] ${msg}\n`); L23: L24: async function rpc(url, method, params = []) { L25: const res = await fetch(url, { L26: method: "POST",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

Findings

1 Critical3 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltal1-contracts/scripts/forge_broadcast.js

HighChild Processl1-contracts/scripts/forge_broadcast.js

HighShell

HighCommand Output Exfiltrationl1-contracts/scripts/forge_broadcast.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

3 flagged

l1-contracts/scripts/forge_broadcast.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// forge_broadcast.js — Run `forge script --broadcast` fast and reliably on anvil.

3//

4// anvil's automine mines each deploy transaction essentially instantly, which is what we want for

5// speed. But a batched broadcast (forge's default sends many txs at once) can race the auto-miner:

6// it mines a block on the first ready tx and may leave txs that arrived just after the trigger

7// sitting in the pool, so forge waits forever for their receipts. We avoid the race without touching

8// anvil's mining mode by broadcasting one tx at a time (`--batch-size 1`) only when anvil has

9// automine ON: with a single tx in flight there is nothing for the auto-miner to strand.

10//

11// When anvil is in interval (or no) mining mode the race does not exist — the miner drains the whole

12// pool on each block — and serializing to one tx per block would stall the deploy for a full block

13// interval per transaction, blowing past the broadcast timeout. There (and on real chains) we keep a

14// larger batch size. A hard timeout guards against a broadcast hanging indefinitely.

15//

16// Usage: ./scripts/forge_broadcast.js <forge script args...>

17// (without --broadcast or --batch-size — added automatically)

19import { spawn } from "node:child_process";

20import { writeSync } from "node:fs";

High

Child Process

Package source references child process execution.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

22const log = (msg) => process.stderr.write(`[forge_broadcast] ${msg}\n`);

24async function rpc(url, method, params = []) {

25 const res = await fetch(url, {

26 method: "POST",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

l1-contracts/scripts/forge_broadcast.jsView on unpkg · L18

27 headers: { "Content-Type": "application/json" },

28 body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),

29 signal: AbortSignal.timeout(10_000),

30 });

31 const json = await res.json();

32 if (json.error) throw new Error(json.error.message);

33 return json.result;

34}

36function extractArg(args, flag) {

37 const i = args.indexOf(flag);

38 return i >= 0 && i < args.length - 1 ? args[i + 1] : undefined;

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

l1-contracts/scripts/forge_broadcast.jsView on unpkg