registry / @executor-js/config / 1.5.28

@executor-js/config@1.5.28

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 12.4 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 141-181javascript

141 if (!fs.existsSync(path)) return null;

142 const raw = fs.readFileSync(path, "utf8");

143 const errors = [];

144 const parsed = jsonc2.parse(raw, errors);

145 if (errors.length > 0) {

146 const msg = errors.map((e) => `offset ${e.offset}: ${jsonc2.printParseErrorCode(e.error)}`).join("; ");

147 return yield* new LoadPluginsError({

148 message: `[load-plugins] failed to parse ${path}: ${msg}`

149 });

150 }

151 const config = yield* Schema3.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(

152 Effect2.mapError(

153 (error) => new LoadPluginsError({

154 message: `[load-plugins] failed to decode ${path}: ${error.issue.toString()}`,

155 cause: error

156 })

157 )

158 );

159 const entries = config.plugins ?? null;

160 if (!entries || entries.length === 0) return null;

161 const { createJiti } = yield* Effect2.tryPromise({

162 try: () => import("jiti"),

163 catch: (cause) => new LoadPluginsError({

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L161

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L161

164 message: `[load-plugins] failed to import jiti.`,

165 cause

166 })

167 });

168 const jiti = createJiti(pathToFileURL(path).href, {

169 interopDefault: true,

170 moduleCache: false

171 });

172 const fromDir = dirname(path);

173 const require2 = createRequire(isAbsolute(path) ? path : resolvePath(fromDir, "_anchor.js"));

174 const loaded = [];

175 for (const entry of entries) {

176 const serverEntry = `${entry.package}/server`;

177 const resolved = yield* Effect2.try({

178 try: () => require2.resolve(serverEntry),

179 catch: (cause) => new LoadPluginsError({

180 message: `[load-plugins] cannot resolve "${serverEntry}" from ${fromDir}. Is "${entry.package}" installed and does it export "./server"?`,

181 cause

Source & flagged code

2 flagged · loading source

dist/index.jsView file

161package = @executor-js/config; repositoryIdentity = executor; dependency = jiti L161: const { createJiti } = yield* Effect2.tryPromise({ L162: try: () => import("jiti"), L163: catch: (cause) => new LoadPluginsError({

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L161

161const { createJiti } = yield* Effect2.tryPromise({ L162: try: () => import("jiti"), L163: catch: (cause) => new LoadPluginsError({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L161

Findings

1 High2 Medium2 Low

HighCopied Package Dependency Bridgedist/index.js

MediumDynamic Requiredist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

dist/index.jsView file

Lines 141-181javascript

141 if (!fs.existsSync(path)) return null;

142 const raw = fs.readFileSync(path, "utf8");

143 const errors = [];

144 const parsed = jsonc2.parse(raw, errors);

145 if (errors.length > 0) {

146 const msg = errors.map((e) => `offset ${e.offset}: ${jsonc2.printParseErrorCode(e.error)}`).join("; ");

147 return yield* new LoadPluginsError({

148 message: `[load-plugins] failed to parse ${path}: ${msg}`

149 });

150 }

151 const config = yield* Schema3.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(

152 Effect2.mapError(

153 (error) => new LoadPluginsError({

154 message: `[load-plugins] failed to decode ${path}: ${error.issue.toString()}`,

155 cause: error

156 })

157 )

158 );

159 const entries = config.plugins ?? null;

160 if (!entries || entries.length === 0) return null;

161 const { createJiti } = yield* Effect2.tryPromise({

162 try: () => import("jiti"),

163 catch: (cause) => new LoadPluginsError({

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L161

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L161

164 message: `[load-plugins] failed to import jiti.`,

165 cause

166 })

167 });

168 const jiti = createJiti(pathToFileURL(path).href, {

169 interopDefault: true,

170 moduleCache: false

171 });

172 const fromDir = dirname(path);

173 const require2 = createRequire(isAbsolute(path) ? path : resolvePath(fromDir, "_anchor.js"));

174 const loaded = [];

175 for (const entry of entries) {

176 const serverEntry = `${entry.package}/server`;

177 const resolved = yield* Effect2.try({

178 try: () => require2.resolve(serverEntry),

179 catch: (cause) => new LoadPluginsError({

180 message: `[load-plugins] cannot resolve "${serverEntry}" from ${fromDir}. Is "${entry.package}" installed and does it export "./server"?`,

181 cause