registry / @dtmd/temper / 0.0.7

@dtmd/temper@0.0.7

The temper authoring face — the six-noun model as typed modules: harness(), kind<T>(), clause values, needs, and file()/text/blocks(). Emit compiles to the declaration rows the engine reads, a byte-faithful projection, and the lock.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 83.9 KB of source, external domains: agentskills.io, code.claude.com, github.com, platform.claude.com

Source & flagged code

3 flagged

bin/temper.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2/**

3 * The engine launcher — channel 2's npm face (`specs/distribution.md`,

4 * "What ships"): resolve the platform's prebuilt engine binary from its

5 * `optionalDependencies` package and exec it. Fail-loud invariant: a

6 * missing platform binary is an install error with instructions, never a

7 * silent skip — if it cannot check, it fails loud.

8 */

9import { createRequire } from "node:module";

10import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

bin/temper.jsView on unpkg · L9

12const require = createRequire(import.meta.url);

14/** platform+arch → [platform package, binary path inside it]. */

15const PLATFORMS = {

16 "linux x64": ["@dtmd/temper-linux-x64", "bin/temper"],

17 "win32 x64": ["@dtmd/temper-win32-x64", "bin/temper.exe"],

18};

20const key = `${process.platform} ${process.arch}`;

21const entry = PLATFORMS[key];

23if (!entry) {

24 const supported = Object.keys(PLATFORMS).join(", ");

25 process.stderr.write(

26 `temper: no prebuilt engine binary for ${key} yet (prebuilt: ${supported}).\n` +

27 `Build from source with a Rust 1.96+ toolchain instead:\n` +

28 ` cargo install --git https://github.com/duct-tape-and-markdown/temper\n`,

29 );

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/temper.jsView on unpkg · L9

30 process.exit(1);

31}

33const [pkg, binPath] = entry;

34let bin;

35try {

36 bin = require.resolve(`${pkg}/${binPath}`);

37} catch {

38 process.stderr.write(

39 `temper: the platform engine package ${pkg} is not installed.\n` +

40 `It ships as an optionalDependency of @dtmd/temper — an installer run\n` +

41 `with optional dependencies disabled skips it. Restore it with:\n` +

42 ` npm install ${pkg}\n`,

43 );

44 process.exit(1);

45}

47const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

48if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/temper.jsView on unpkg · L41

49 process.stderr.write(`temper: failed to run ${bin}: ${result.error.message}\n`);

50 process.exit(1);

51}

52process.exit(result.status ?? 1);

Source & flagged code

3 flagged · loading source

bin/temper.jsView file

9import { createRequire } from "node:module"; L10: import { spawnSync } from "node:child_process"; L11:

High

Child Process

Package source references child process execution.

bin/temper.jsView on unpkg · L9

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: execution+network L9: import { createRequire } from "node:module"; L10: import { spawnSync } from "node:child_process"; L11: ... L19: L20: const key = `${process.platform} ${process.arch}`; L21: const entry = PLATFORMS[key]; ... L24: const supported = Object.keys(PLATFORMS).join(", "); L25: process.stderr.write( L26: `temper: no prebuilt engine binary for ${key} yet (prebuilt: ${supported}).\n` + L27: `Build from source with a Rust 1.96+ toolchain instead:\n` + L28: ` cargo install --git https://github.com/duct-tape-and-markdown/temper\n`, L29: );

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/temper.jsView on unpkg · L9

41`with optional dependencies disabled skips it. Restore it with:\n` + L42: ` npm install ${pkg}\n`, L43: ); ... L46: L47: const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" }); L48: if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/temper.jsView on unpkg · L41

Findings

4 High1 Medium5 Low

HighChild Processbin/temper.js

HighShell

HighEntrypoint Build Divergencebin/temper.js

HighRuntime Package Installbin/temper.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/temper.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2/**

3 * The engine launcher — channel 2's npm face (`specs/distribution.md`,

4 * "What ships"): resolve the platform's prebuilt engine binary from its

5 * `optionalDependencies` package and exec it. Fail-loud invariant: a

6 * missing platform binary is an install error with instructions, never a

7 * silent skip — if it cannot check, it fails loud.

8 */

9import { createRequire } from "node:module";

10import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

bin/temper.jsView on unpkg · L9

12const require = createRequire(import.meta.url);

14/** platform+arch → [platform package, binary path inside it]. */

15const PLATFORMS = {

16 "linux x64": ["@dtmd/temper-linux-x64", "bin/temper"],

17 "win32 x64": ["@dtmd/temper-win32-x64", "bin/temper.exe"],

18};

20const key = `${process.platform} ${process.arch}`;

21const entry = PLATFORMS[key];

23if (!entry) {

24 const supported = Object.keys(PLATFORMS).join(", ");

25 process.stderr.write(

26 `temper: no prebuilt engine binary for ${key} yet (prebuilt: ${supported}).\n` +

27 `Build from source with a Rust 1.96+ toolchain instead:\n` +

28 ` cargo install --git https://github.com/duct-tape-and-markdown/temper\n`,

29 );

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/temper.jsView on unpkg · L9

30 process.exit(1);

31}

33const [pkg, binPath] = entry;

34let bin;

35try {

36 bin = require.resolve(`${pkg}/${binPath}`);

37} catch {

38 process.stderr.write(

39 `temper: the platform engine package ${pkg} is not installed.\n` +

40 `It ships as an optionalDependency of @dtmd/temper — an installer run\n` +

41 `with optional dependencies disabled skips it. Restore it with:\n` +

42 ` npm install ${pkg}\n`,

43 );

44 process.exit(1);

45}

47const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

48if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/temper.jsView on unpkg · L41

49 process.stderr.write(`temper: failed to run ${bin}: ${result.error.message}\n`);

50 process.exit(1);

51}

52process.exit(result.status ?? 1);