registry / @deftai/directive-core / 0.79.3

@deftai/directive-core@0.79.3

TypeScript engine core for the Directive framework.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 585 file(s), 3.16 MB of source, external domains: api.github.com, cli.github.com, docs.astral.sh, example.com, git-scm.com, github.com, taskfile.dev, www.python.org

Source & flagged code

3 flagged

dist/vbrief-validation/validation.jsView file

Lines 68-108javascript

68 return [[`${vbriefDir}: expected vbrief directory does not exist`], []];

69 }

70 const [errors, warnings] = validateAllMigration(vbriefDir);

71 return [[...errors], [...warnings]];

72}

73/** Move the emitted ``vbrief/`` tree to ``vbrief.invalid/`` on failure. */

74export function isolateInvalidOutput(projectRoot, vbriefDir) {

75 if (!existsSync(vbriefDir)) {

76 return null;

77 }

78 let target = join(projectRoot, "vbrief.invalid");

79 let idx = 1;

80 while (existsSync(target)) {

81 idx += 1;

82 target = join(projectRoot, `vbrief.invalid.${idx}`);

83 }

84 renameSync(vbriefDir, target);

85 return target;

86}

87/** Run validation + isolation as the migrator's terminal gate (#498). */

88export function finalizeMigration(projectRoot, vbriefDir, actions, options = {}) {

89 const stderrWriter = options.stderrWriter ?? ((chunk) => process.stderr.write(chunk));

90 const isolateFn = options.isolateInvalid ?? isolateInvalidOutput;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vbrief-validation/validation.jsView on unpkg · L88

91 const [errors, warnings] = validateMigrationOutput(vbriefDir);

92 if (errors.length === 0) {

93 for (const w of warnings) {

94 stderrWriter(`WARNING: ${w}\n`);

95 }

96 return [true, actions];

97 }

98 stderrWriter(`ERROR: Migration produced invalid output (${errors.length} file-level error(s)):\n`);

99 for (const err of errors) {

100 stderrWriter(` ${err}\n`);

101 }

102 const invalidDir = isolateFn(projectRoot, vbriefDir);

103 const failureActions = [...actions];

104 failureActions.push(`FAIL migration produced ${errors.length} schema validation error(s)`);

105 for (const err of errors) {

106 failureActions.push(` ${err}`);

107 }

108 if (invalidDir !== null) {

dist/scm/binary.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { BINARY_PREFERENCE } from "./constants.js";

3import { ScmStubError } from "./errors.js";

4/** Default PATH lookup mirroring Python `shutil.which`. Uses the

5 * platform-native resolver (`where` on Windows, `which` elsewhere) so

dist/capacity/backfill.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deftai/directive-core@0.79.1 matchedIdentity = npm:QGRlZnRhaS9kaXJlY3RpdmUtY29yZQ:0.79.1 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/capacity/backfill.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/vbrief-validation/validation.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code