registry / @hasna/contracts / 0.4.2

@hasna/contracts@0.4.2

Shared schemas and validators for Hasna open-source agent infrastructure contracts.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 1.82 MB of source, external domains: github.com, json-schema.org, truststore.pki.rds.amazonaws.com, www.postgresql.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 5421-5461javascript

5421 message: "Contract object must include a known embedded schema id",

5422 path: ["schema"]

5423 }

5424 ]

5425 };

5426 }

5427 const result = validateContract(schemaId, value);

5428 if (result.success) {

5429 return { success: true, schemaId, data: result.data };

5430 }

5431 return { success: false, schemaId, issues: result.error.issues };

5432}

5433function parseEmbeddedContract(value) {

5434 const result = validateEmbeddedContract(value);

5435 if (!result.success) {

5436 throw new ContractValidationError(result.schemaId ?? "unknown", result.issues);

5437 }

5438 return result.data;

5439}

5440

5441// src/no-cloud.ts

5442import { execFileSync } from "child_process";

5443import { readdirSync, readFileSync, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5441

5444import { basename, join, relative, resolve } from "path";

5445var SKIP_DIRS = new Set([".git", "node_modules", ".cache", ".next", ".turbo", "coverage", "docs", "examples", "tests"]);

5446var LOCKFILES = new Set(["bun.lock", "package-lock.json", "pnpm-lock.yaml", "yarn.lock"]);

5447var SOURCE_DIRS = new Set(["src", "bin", "cli", "mcp", "server", "lib", "scripts", "config", "infra", "hooks", ".github", "dist"]);

5448var MAX_TEXT_BYTES = 5 * 1024 * 1024;

5449var RUNTIME_PATTERNS = [

5450 { pattern: "@hasna/cloud", message: "Shared @hasna/cloud runtime reference is forbidden" },

5451 { pattern: "open-cloud", message: "Shared open-cloud runtime reference is forbidden" },

5452 { pattern: "cloud-mcp", message: "Legacy cloud-mcp runtime surface is forbidden" },

5453 { pattern: "registerCloudTools", message: "Legacy registerCloudTools runtime surface is forbidden" },

5454 { pattern: "registerCloudCommands", message: "Legacy registerCloudCommands runtime surface is forbidden" },

5455 { pattern: ".hasna/cloud", message: "Legacy .hasna/cloud runtime config is forbidden" },

5456 { pattern: "HASNA_CLOUD_", message: "Shared HASNA_CLOUD_* runtime config is forbidden" },

5457 { pattern: "HASNA_RDS_PASSWORD", message: "Legacy shared RDS credential config is forbidden" }

5458];

5459var DECLARATION_FILE_MARKERS = [

5460 "FORBIDDEN_SHARED_CLOUD_RUNTIMES",

5461 "RUNTIME_PATTERNS",

dist/cli/index.jsView file

Lines 32-72javascript

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(

Source & flagged code

3 flagged · loading source

dist/index.jsView file

5441// src/no-cloud.ts L5442: import { execFileSync } from "child_process"; L5443: import { readdirSync, readFileSync, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5441

dist/cli/index.jsView file

1202} L1203: const execArgv = process2.execArgv ?? []; L1204: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L1202

52Cross-file remote execution chain: dist/cli/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L52: class CommanderError extends Error { L53: constructor(exitCode, code, message) { L54: super(message); ... L756: var EventEmitter = __require("events").EventEmitter; L757: var childProcess = __require("child_process"); L758: var path = __require("path"); ... L802: this._outputConfiguration = { L803: writeOut: (str) => process2.stdout.write(str), L804: writeErr: (str) => process2.stderr.write(str), ... L2389: var require_postgres_bytea = __commonJS((exports, module) => { L2390: var bufferFrom = Buffer.from || Buffer; L2391: module.exports = function parseBytea(input) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L52

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighShelldist/cli/index.js

HighCross File Remote Execution Contextdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings