registry / @lensmcp/node-instrumentation / 1.16.0

@lensmcp/node-instrumentation@1.16.0

Zero-touch Node.js runtime instrumentation for LensMCP — fs/network/exec/db/redis/queue taps + NestJS auto-graft, injected by the runner, never imported by host source.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 57.7 KB of source

Source & flagged code

1 flagged

lib/flow-context.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.primeFlowContext = primeFlowContext;

4exports.runInFlowContext = runInFlowContext;

5exports.liveFlowContext = liveFlowContext;

6exports.flowContext = flowContext;

7let getCtx = null;

8let runWith = null;

9function primeFlowContext() {

10 import('@lensmcp/nest-instrumentation')

11 .then((m) => {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/flow-context.jsView on unpkg · L9

12 getCtx = m.currentLensmcpContext;

13 runWith = m.runInLensmcpContext;

14 })

15 .catch(() => {

16 /* nest instrumentation absent — tap events stay un-correlated */

17 });

18}

19/**

20 * Run `fn` inside a fresh flow context (queue workers, timers — async

21 * entry points that aren't HTTP requests). Inner taps then inherit the

22 * flowId exactly like they do inside a traced request.

23 */

24function runInFlowContext(ctx, fn) {

25 if (!runWith)

26 return fn();

27 try {

28 return runWith({ sessionId: 'pending', requestId: ctx.requestId, ...(ctx.flowId ? { flowId: ctx.flowId } : {}) }, fn);

29 }

Source & flagged code

1 flagged · loading source

lib/flow-context.jsView file

9package = @lensmcp/node-instrumentation; repositoryIdentity = lensmcp; dependency = @lensmcp/nest-instrumentation L9: function primeFlowContext() { L10: import('@lensmcp/nest-instrumentation') L11: .then((m) => {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/flow-context.jsView on unpkg · L9

Findings

1 High2 Medium1 Low

HighCopied Package Dependency Bridgelib/flow-context.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

Source & flagged code

1 flagged

lib/flow-context.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.primeFlowContext = primeFlowContext;

4exports.runInFlowContext = runInFlowContext;

5exports.liveFlowContext = liveFlowContext;

6exports.flowContext = flowContext;

7let getCtx = null;

8let runWith = null;

9function primeFlowContext() {

10 import('@lensmcp/nest-instrumentation')

11 .then((m) => {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/flow-context.jsView on unpkg · L9

12 getCtx = m.currentLensmcpContext;

13 runWith = m.runInLensmcpContext;

14 })

15 .catch(() => {

16 /* nest instrumentation absent — tap events stay un-correlated */

17 });

18}

19/**

20 * Run `fn` inside a fresh flow context (queue workers, timers — async

21 * entry points that aren't HTTP requests). Inner taps then inherit the

22 * flowId exactly like they do inside a traced request.

23 */

24function runInFlowContext(ctx, fn) {

25 if (!runWith)

26 return fn();

27 try {

28 return runWith({ sessionId: 'pending', requestId: ctx.requestId, ...(ctx.flowId ? { flowId: ctx.flowId } : {}) }, fn);

29 }