registry / @c4a/extract / 0.6.0-beta.6

@c4a/extract@0.6.0-beta.6

Code extraction framework for Context. It owns the language-plugin protocol, repository runner, raw code snapshot contract, digest generation, and shared Tree-sitter parsing utilities.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 2 file(s), 1.06 MB of source

Source & flagged code

4 flagged

index.jsView file

2431if (typeof node_buffer.Buffer === "function") { L2432: return node_buffer.Buffer.from(src, "base64"); L2433: } else if (typeof atob === "function") { ... L4885: yield* this.next(token); L4886: yield* this.end(forceDoc, endOffset); L4887: } L4888: *next(token) { L4889: if (node_process.env.LOG_STREAM) L4890: console.dir(token, { depth: null }); ... L7144: } L7145: if (typeof process !== "undefined" && process.platform) { L7146: return process.platform === "win32";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.jsView on unpkg · L2431

9170var func = "(" + args + " ) => { " + body + "};"; L9171: ASM_CONSTS[start] = eval(func); L9172: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L9170

bin/c4a-extract-code.jsView file

Lines 8-48javascript

8var __toESM = (mod, isNodeMode, target) => {

9 target = mod != null ? __create(__getProtoOf(mod)) : {};

10 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

11 for (let key of __getOwnPropNames(mod))

12 if (!__hasOwnProp.call(to, key))

13 __defProp(to, key, {

14 get: () => mod[key],

15 enumerable: true

16 });

17 return to;

18};

19var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

20var __export = (target, all) => {

21 for (var name in all)

22 __defProp(target, name, {

23 get: all[name],

24 enumerable: true,

25 configurable: true,

26 set: (newValue) => all[name] = () => newValue

27 });

28};

29var __require = /* @__PURE__ */ createRequire(import.meta.url);

30var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/c4a-extract-code.jsView on unpkg · L28

32// ../../node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js

33var require_identity = __commonJS((exports) => {

34 var ALIAS = Symbol.for("yaml.alias");

35 var DOC = Symbol.for("yaml.document");

36 var MAP = Symbol.for("yaml.map");

37 var PAIR = Symbol.for("yaml.pair");

38 var SCALAR = Symbol.for("yaml.scalar");

39 var SEQ = Symbol.for("yaml.seq");

40 var NODE_TYPE = Symbol.for("yaml.node.type");

41 var isAlias = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === ALIAS;

42 var isDocument = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === DOC;

43 var isMap = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === MAP;

44 var isPair = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === PAIR;

45 var isScalar = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SCALAR;

46 var isSeq = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SEQ;

47 function isCollection(node2) {

48 if (node2 && typeof node2 === "object")

wasm/tree-sitter-tsx.wasmView file

•path = wasm/tree-sitter-tsx.wasm kind = wasm_module sizeBytes = 1445638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-tsx.wasmView on unpkg

Source & flagged code

4 flagged · loading source

index.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.jsView on unpkg · L2431

9170var func = "(" + args + " ) => { " + body + "};"; L9171: ASM_CONSTS[start] = eval(func); L9172: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L9170

bin/c4a-extract-code.jsView file

28}; L29: var __require = /* @__PURE__ */ createRequire(import.meta.url); L30: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/c4a-extract-code.jsView on unpkg · L28

wasm/tree-sitter-tsx.wasmView file

•path = wasm/tree-sitter-tsx.wasm kind = wasm_module sizeBytes = 1445638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-tsx.wasmView on unpkg

Findings

1 High4 Medium4 Low

HighObfuscated Payload Loaderindex.js

MediumDynamic Requirebin/c4a-extract-code.js

MediumNetwork

MediumShips Wasm Modulewasm/tree-sitter-tsx.wasm

MediumStructural Risk Force Deep Review

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

4 flagged

index.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.jsView on unpkg · L2431

9170var func = "(" + args + " ) => { " + body + "};"; L9171: ASM_CONSTS[start] = eval(func); L9172: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L9170

bin/c4a-extract-code.jsView file

Lines 8-48javascript

8var __toESM = (mod, isNodeMode, target) => {

9 target = mod != null ? __create(__getProtoOf(mod)) : {};

10 const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;

11 for (let key of __getOwnPropNames(mod))

12 if (!__hasOwnProp.call(to, key))

13 __defProp(to, key, {

14 get: () => mod[key],

15 enumerable: true

16 });

17 return to;

18};

19var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

20var __export = (target, all) => {

21 for (var name in all)

22 __defProp(target, name, {

23 get: all[name],

24 enumerable: true,

25 configurable: true,

26 set: (newValue) => all[name] = () => newValue

27 });

28};

29var __require = /* @__PURE__ */ createRequire(import.meta.url);

30var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/c4a-extract-code.jsView on unpkg · L28

32// ../../node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js

33var require_identity = __commonJS((exports) => {

34 var ALIAS = Symbol.for("yaml.alias");

35 var DOC = Symbol.for("yaml.document");

36 var MAP = Symbol.for("yaml.map");

37 var PAIR = Symbol.for("yaml.pair");

38 var SCALAR = Symbol.for("yaml.scalar");

39 var SEQ = Symbol.for("yaml.seq");

40 var NODE_TYPE = Symbol.for("yaml.node.type");

41 var isAlias = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === ALIAS;

42 var isDocument = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === DOC;

43 var isMap = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === MAP;

44 var isPair = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === PAIR;

45 var isScalar = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SCALAR;

46 var isSeq = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SEQ;

47 function isCollection(node2) {

48 if (node2 && typeof node2 === "object")

wasm/tree-sitter-tsx.wasmView file

•path = wasm/tree-sitter-tsx.wasm kind = wasm_module sizeBytes = 1445638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-tsx.wasmView on unpkg