registry / @eldrex/core / 1.0.5

@eldrex/core@1.0.5

Core engine for DevDiff — intelligent, privacy-first changelog generation

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 386 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.groq.com, api.openai.com, devdiff.vercel.app, fonts.googleapis.com, fonts.gstatic.com, git-scm.com, github.com, nodejs.org, ollama.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 13-53javascript

13 // e.g. 'ollama://llama3.2:3b', 'openai://gpt-4o-mini'

14 apiKey: z.string().optional(),

15 maxTokens: z.number().int().positive().optional(),

16 priority: z.number().int().nonnegative().default(1),

17 maxDailyCost: z.number().nonnegative().optional()

18});

19var RoutingSchema = z.object({

20 strategy: z.enum(["priority", "cost-aware", "latency"]).default("priority"),

21 complexityThreshold: z.number().min(0).max(1).default(0.6),

22 localOnly: z.boolean().default(false)

23});

24var ConfigSchema = z.object({

25 ai: z.object({

26 providers: z.array(ProviderSchema).default([]),

27 routing: RoutingSchema.default({}),

28 cloudProviders: z.string().optional(),

29 allowedCloudRegions: z.array(z.string()).optional()

30 }).default({}),

31 exclude: z.array(z.string()).default([

32 "node_modules/**",

33 "dist/**",

34 "package-lock.json",

35 "pnpm-lock.yaml",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L33

36 "yarn.lock"

37 ]),

38 cache: z.object({

39 enabled: z.boolean().default(true),

40 path: z.string().default(".devdiff/cache.json")

41 }).default({}),

42 format: z.enum(["markdown", "json", "html"]).default("markdown"),

43 privacy: z.record(z.any()).optional(),

44 monitoring: z.record(z.any()).optional(),

45 security: z.record(z.any()).optional()

46}).passthrough();

48// src/config/defaults.ts

49var DEFAULTS = {

50 ai: {

51 providers: [

52 {

53 name: "local-ollama",

Lines 540-580javascript

540 const secretIndex = match.lastIndexOf(secret);

541 const prefixPart = match.substring(0, secretIndex);

542 const suffixPart = match.substring(secretIndex + secret.length);

543 return `${prefixPart}[REDACTED]${

Lines 662-702javascript

662 for (const line of lines) {

663 try {

664 this.decrypt(line.trim(), key);

665 } catch {

666 corrupted++;

667 }

668 }

669 return { valid: corrupted ===

Lines 5389-5429javascript

5389 */

5390 static async checkRequirements() {

5391 const platform = this.detect();

5392 const issues = [];

5393 try {

5394 execSync2("git --version", { stdio: "pipe" });

5395

Lines 6277-6317javascript

6277 analyzed.add(deleted.path);

6278 }

6279 }

6280 const changedFilesContent = /* @__PURE__ */ new Map();

6281 for (const change of changes) {

6282 const content = change.content ||

Source & flagged code

5 flagged · loading source

dist/index.jsView file

560// src/security/shell-sandbox.ts L561: import { exec } from "child_process"; L562:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L560

682}; L683: function execAsync(command, args, options) { L684: return new Promise((resolve9, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L682

5409message: `Node.js ${nodeVersion} is too old (need >= 20.0.0)`, L5410: fix: "Install from https://nodejs.org" L5411: }); ... L5415: try { L5416: execSync2('powershell -Command "Write-Host test"', { stdio: "pipe" }); L5417: } catch { ... L5424: } L5425: if (!process.env.WT_SESSION) { L5426: issues.push({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L5409

33"dist/**", L34: "package-lock.json", L35: "pnpm-lock.yaml", ... L560: // src/security/shell-sandbox.ts L561: import { exec } from "child_process"; L562: ... L568: static getLogPath() { L569: return process.env.DEVDIFF_AUDIT_PATH || path2.resolve(process.cwd(), ".devdiff/security-audit.enc"); L570: } ... L587: const authTag = cipher.getAuthTag(); L588: return Buffer.concat([iv, authTag, encrypted]).toString("base64"); L589: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L33

6297${references.map((r) => ` - ${r}`).join("\n")}` : `Removed ${path14.basename(deleted.path)} (no imports detected)`, L6298: evidence: references.length > 0 ? [`${references.length} dangling import(s) found`] : ["No imports found referencing this file"] L6299: });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L6297

Findings

4 High4 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 13-53javascript

13 // e.g. 'ollama://llama3.2:3b', 'openai://gpt-4o-mini'

14 apiKey: z.string().optional(),

15 maxTokens: z.number().int().positive().optional(),

16 priority: z.number().int().nonnegative().default(1),

17 maxDailyCost: z.number().nonnegative().optional()

18});

19var RoutingSchema = z.object({

20 strategy: z.enum(["priority", "cost-aware", "latency"]).default("priority"),

21 complexityThreshold: z.number().min(0).max(1).default(0.6),

22 localOnly: z.boolean().default(false)

23});

24var ConfigSchema = z.object({

25 ai: z.object({

26 providers: z.array(ProviderSchema).default([]),

27 routing: RoutingSchema.default({}),

28 cloudProviders: z.string().optional(),

29 allowedCloudRegions: z.array(z.string()).optional()

30 }).default({}),

31 exclude: z.array(z.string()).default([

32 "node_modules/**",

33 "dist/**",

34 "package-lock.json",

35 "pnpm-lock.yaml",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L33

36 "yarn.lock"

37 ]),

38 cache: z.object({

39 enabled: z.boolean().default(true),

40 path: z.string().default(".devdiff/cache.json")

41 }).default({}),

42 format: z.enum(["markdown", "json", "html"]).default("markdown"),

43 privacy: z.record(z.any()).optional(),

44 monitoring: z.record(z.any()).optional(),

45 security: z.record(z.any()).optional()

46}).passthrough();

48// src/config/defaults.ts

49var DEFAULTS = {

50 ai: {

51 providers: [

52 {

53 name: "local-ollama",

Lines 540-580javascript

540 const secretIndex = match.lastIndexOf(secret);

541 const prefixPart = match.substring(0, secretIndex);

542 const suffixPart = match.substring(secretIndex + secret.length);

543 return `${prefixPart}[REDACTED]${

Lines 662-702javascript

662 for (const line of lines) {

663 try {

664 this.decrypt(line.trim(), key);

665 } catch {

666 corrupted++;

667 }

668 }

669 return { valid: corrupted ===

Lines 5389-5429javascript

5389 */

5390 static async checkRequirements() {

5391 const platform = this.detect();

5392 const issues = [];

5393 try {

5394 execSync2("git --version", { stdio: "pipe" });

5395

Lines 6277-6317javascript

6277 analyzed.add(deleted.path);

6278 }

6279 }

6280 const changedFilesContent = /* @__PURE__ */ new Map();

6281 for (const change of changes) {

6282 const content = change.content ||