registry / @encore-os/eos-spec / 0.9.0

@encore-os/eos-spec@0.9.0

Portable, config-driven spec-pipeline engine + quality harness. One canonical engine consumed as a library (with a client-safe /pure subpath) by every Encore-OS repo.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 104 file(s), 527 KB of source

Source & flagged code

2 flagged

dist/lib/exec.jsView file

Lines 1-14javascript

1import { spawnSync } from 'node:child_process';

2export function runScript(args, cwd) {

High

Child Process

Package source references child process execution.

dist/lib/exec.jsView on unpkg · L1

3 const result = spawnSync(args[0], args.slice(1), {

4 cwd,

5 encoding: 'utf8',

6 env: process.env,

7 });

8 return {

9 exitCode: result.status ?? -1,

10 stdout: result.stdout ?? '',

11 stderr: result.stderr ?? '',

12 };

13}

14//# sourceMappingURL=exec.js.map

dist/commands/verify-acs.jsView file

Lines 22-62javascript

22 return out;

23}

24/** Split backing test files into those the root Vitest can run vs. deferred lanes. */

25export function partitionBackingFiles(files) {

26 const rootVitest = [];

27 const deferred = [];

Source & flagged code

2 flagged · loading source

dist/lib/exec.jsView file

1import { spawnSync } from 'node:child_process'; L2: export function runScript(args, cwd) {

High

Child Process

Package source references child process execution.

dist/lib/exec.jsView on unpkg · L1

dist/commands/verify-acs.jsView file

42try { L43: execFileSync('bunx', ['vitest', 'run', ...relFiles, '--reporter=json', `--outputFile=${outFile}`], { L44: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/verify-acs.jsView on unpkg · L42

Findings

3 High3 Medium5 Low

HighChild Processdist/lib/exec.js

HighShell

HighRuntime Package Installdist/commands/verify-acs.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

dist/lib/exec.jsView file

Lines 1-14javascript

1import { spawnSync } from 'node:child_process';

2export function runScript(args, cwd) {

High

Child Process

Package source references child process execution.

dist/lib/exec.jsView on unpkg · L1

3 const result = spawnSync(args[0], args.slice(1), {

4 cwd,

5 encoding: 'utf8',

6 env: process.env,

7 });

8 return {

9 exitCode: result.status ?? -1,

10 stdout: result.stdout ?? '',

11 stderr: result.stderr ?? '',

12 };

13}

14//# sourceMappingURL=exec.js.map

dist/commands/verify-acs.jsView file

Lines 22-62javascript

22 return out;

23}

24/** Split backing test files into those the root Vitest can run vs. deferred lanes. */

25export function partitionBackingFiles(files) {

26 const rootVitest = [];

27 const deferred = [];