registry / @lokascript/compilation-service / 2.7.1

@lokascript/compilation-service@2.7.1

Semantic compilation service for LokaScript - validates and compiles hyperscript from 24 languages, explicit syntax, or LLM JSON

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1013 KB of source, external domains: api.example.com

Oversized source lightweight scan

dist/dist-HSJGJ5HF.js2.81 MB file, sampled 256 KB

EnvironmentVarsEvalWebSocketHighEntropyStringsUrlStringsapi.example.com

dist/http.cjs3.29 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsEvalHighEntropyStrings

dist/index.cjs3.28 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsEvalHighEntropyStrings

Source & flagged code

2 flagged

dist/chunk-7GECANUT.jsView file

Lines 2449-2489javascript

2449 const refName = analysis.refMap.get(el.selector);

2450 if (refName) {

2451 attrs.push(`bind:this={${refName}}`);

2452 }

2453 const visState = analysis.stateMap.get(el.selector + ":visible");

2454 const contentState = analysis.stateMap.get(el.selector + ":content");

2455 const numState = analysis.stateMap.get(el.selector + ":num");

2456 const attrStr = attrs.length > 0 ? " " + attrs.join(" ") : "";

2457 const content = contentState ? `{${contentState}}` : numState ? `{${numState}}` : el.id ?? "";

2458 const elementLine = `<${el.tag}${attrStr}>${content}</${el.tag}>`;

2459 if (visState) {

2460 lines.push(`{#if ${visState}}`);

2461 lines.push(` ${elementLine}`);

2462 lines.push("{/if}");

2463 } else {

2464 lines.push(elementLine);

2465 }

2466 return lines;

2467}

2468

2469// src/input/normalize.ts

2470import { validateProtocolJSON, fromProtocolJSON } from "@lokascript/framework";

2471var _semantic = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-7GECANUT.jsView on unpkg · L2469

2472function initNormalizer(semantic) {

2473 _semantic = semantic;

2474}

2475function normalize(request) {

2476 if (!_semantic) {

2477 throw new Error("Normalizer not initialized. Call initNormalizer() first.");

2478 }

2479 if (request.semantic) {

2480 return normalizeJSON(request.semantic);

2481 }

2482 const input = request.code ?? request.explicit;

2483 if (!input) {

2484 return {

2485 node: null,

2486 confidence: 0,

2487 format: "natural",

2488 diagnostics: [

2489 {

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 3441164 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/chunk-7GECANUT.jsView file

2469package = @lokascript/compilation-service; repositoryIdentity = hyperfixi; dependency = @lokascript/framework L2469: // src/input/normalize.ts L2470: import { validateProtocolJSON, fromProtocolJSON } from "@lokascript/framework"; L2471: var _semantic = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-7GECANUT.jsView on unpkg · L2469

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 3441164 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg

Findings

2 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/chunk-7GECANUT.js

HighOversized Source Filedist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-7GECANUT.jsView file

Lines 2449-2489javascript

2449 const refName = analysis.refMap.get(el.selector);

2450 if (refName) {

2451 attrs.push(`bind:this={${refName}}`);

2452 }

2453 const visState = analysis.stateMap.get(el.selector + ":visible");

2454 const contentState = analysis.stateMap.get(el.selector + ":content");

2455 const numState = analysis.stateMap.get(el.selector + ":num");

2456 const attrStr = attrs.length > 0 ? " " + attrs.join(" ") : "";

2457 const content = contentState ? `{${contentState}}` : numState ? `{${numState}}` : el.id ?? "";

2458 const elementLine = `<${el.tag}${attrStr}>${content}</${el.tag}>`;

2459 if (visState) {

2460 lines.push(`{#if ${visState}}`);

2461 lines.push(` ${elementLine}`);

2462 lines.push("{/if}");

2463 } else {

2464 lines.push(elementLine);

2465 }

2466 return lines;

2467}

2468

2469// src/input/normalize.ts

2470import { validateProtocolJSON, fromProtocolJSON } from "@lokascript/framework";

2471var _semantic = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-7GECANUT.jsView on unpkg · L2469

2472function initNormalizer(semantic) {

2473 _semantic = semantic;

2474}

2475function normalize(request) {

2476 if (!_semantic) {

2477 throw new Error("Normalizer not initialized. Call initNormalizer() first.");

2478 }

2479 if (request.semantic) {

2480 return normalizeJSON(request.semantic);

2481 }

2482 const input = request.code ?? request.explicit;

2483 if (!input) {

2484 return {

2485 node: null,

2486 confidence: 0,

2487 format: "natural",

2488 diagnostics: [

2489 {

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 3441164 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg