registry / @happyvertical/smrt-core / 0.37.10

@happyvertical/smrt-core@0.37.10

Core AI agent framework with standardized collections, object-relational mapping, and code generators

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 154 file(s), 3.13 MB of source, external domains: github.com, rolldown.rs

Source & flagged code

2 flagged

dist/registry.jsView file

Lines 39-79javascript

39* api: { exclude: ['delete'] },

40* cli: true

41* });

42* ```

43*

44* @example Using the decorator (recommended)

45* ```typescript

46* import { smrt, field } from '@happyvertical/smrt-core';

47*

48* @smrt({ api: { exclude: ['delete'] } })

49* class Product extends SmrtObject {

50* @field({ required: true })

51* name: string = '';

52* }

53* ```

54*/

55var logger = createLogger({ level: "info" });

56function getManifestLoaderSpecifier() {

57 return import.meta.url.endsWith(".ts") ? "./manifest/index.ts" : "./manifest/index.js";

58}

59async function importManifestLoader() {

60 return await import(getManifestLoaderSpecifier());

61}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/registry.jsView on unpkg · L59

62function getReferenceKindFromFieldOptions(fieldOptions) {

63 if (fieldOptions?.__tenancy?.isTenantIdField || fieldOptions?._meta?.__tenancy?.isTenantIdField) return "tenantId";

64 if (fieldOptions?.type === "foreignKey") return "foreignKey";

65 if (fieldOptions?.type === "crossPackageRef") return "crossPackageRef";

66}

67function applyManifestFieldColumnMetadata(columns, fieldEntries) {

68 if (!fieldEntries) return;

69 for (const [fieldName, fieldOptions] of fieldEntries) {

70 const sqlType = fieldOptions?.sqlType ?? fieldOptions?._meta?.sqlType;

71 const referenceKind = getReferenceKindFromFieldOptions(fieldOptions);

72 if (!sqlType && !referenceKind) continue;

73 const columnName = toSnakeCase(fieldName);

74 const existingColumn = columns[columnName];

75 if (!existingColumn) continue;

76 columns[columnName] = {

77 ...existingColumn,

78 ...sqlType ? { type: String(sqlType).toUpperCase() } : {},

79 ...referenceKind ? { referenceKind } : {}

dist/vite-plugin/index.jsView file

Lines 141-181javascript

141 async function resolveKnowledgeConfig(rootDir, m) {

142 if (knowledge === false) return { enabled: false };

143 const packageName = m.packageName ?? readPackageName(rootDir);

144

Source & flagged code

2 flagged · loading source

dist/registry.jsView file

59async function importManifestLoader() { L60: return await import(getManifestLoaderSpecifier()); L61: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/registry.jsView on unpkg · L59

dist/vite-plugin/index.jsView file

161package = @happyvertical/smrt-core; repositoryIdentity = smrt; dependency = @happyvertical/smrt-config L161: try { L162: const { loadConfig } = await import("@happyvertical/smrt-config"); L163: const config = await loadConfig({ cache: false });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/vite-plugin/index.jsView on unpkg · L161

Findings

1 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/vite-plugin/index.js

MediumDynamic Requiredist/registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/registry.jsView file

Lines 39-79javascript

39* api: { exclude: ['delete'] },

40* cli: true

41* });

42* ```

43*

44* @example Using the decorator (recommended)

45* ```typescript

46* import { smrt, field } from '@happyvertical/smrt-core';

47*

48* @smrt({ api: { exclude: ['delete'] } })

49* class Product extends SmrtObject {

50* @field({ required: true })

51* name: string = '';

52* }

53* ```

54*/

55var logger = createLogger({ level: "info" });

56function getManifestLoaderSpecifier() {

57 return import.meta.url.endsWith(".ts") ? "./manifest/index.ts" : "./manifest/index.js";

58}

59async function importManifestLoader() {

60 return await import(getManifestLoaderSpecifier());

61}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/registry.jsView on unpkg · L59

62function getReferenceKindFromFieldOptions(fieldOptions) {

63 if (fieldOptions?.__tenancy?.isTenantIdField || fieldOptions?._meta?.__tenancy?.isTenantIdField) return "tenantId";

64 if (fieldOptions?.type === "foreignKey") return "foreignKey";

65 if (fieldOptions?.type === "crossPackageRef") return "crossPackageRef";

66}

67function applyManifestFieldColumnMetadata(columns, fieldEntries) {

68 if (!fieldEntries) return;

69 for (const [fieldName, fieldOptions] of fieldEntries) {

70 const sqlType = fieldOptions?.sqlType ?? fieldOptions?._meta?.sqlType;

71 const referenceKind = getReferenceKindFromFieldOptions(fieldOptions);

72 if (!sqlType && !referenceKind) continue;

73 const columnName = toSnakeCase(fieldName);

74 const existingColumn = columns[columnName];

75 if (!existingColumn) continue;

76 columns[columnName] = {

77 ...existingColumn,

78 ...sqlType ? { type: String(sqlType).toUpperCase() } : {},

79 ...referenceKind ? { referenceKind } : {}

dist/vite-plugin/index.jsView file

Lines 141-181javascript

141 async function resolveKnowledgeConfig(rootDir, m) {

142 if (knowledge === false) return { enabled: false };

143 const packageName = m.packageName ?? readPackageName(rootDir);

144