registry / @lubab/madar / 0.30.0

@lubab/madar@0.30.0

Stop AI coding agents from rediscovering large TypeScript/Node repos. Madar compiles task-aware local context packs from what runs for this task.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 181 file(s), 2.82 MB of source, external domains: arxiv.org, example.test, github.com, graphml.graphdrawing.org, registry.npmjs.org, unpkg.com, www.w3.org

Source & flagged code

4 flagged

dist/src/runtime/semantic.jsView file

Lines 143-183javascript

143 if (fromExports) {

144 return fromExports;

145 }

146 if (typeof manifest.module === 'string') {

147 return manifest.module;

148 }

149

Source & flagged code

4 flagged · loading source

dist/src/runtime/semantic.jsView file

163const entryPath = join(packageDir, moduleEntryFromManifest(manifest)); L164: return await import(pathToFileURL(entryPath).href); L165: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/runtime/semantic.jsView on unpkg · L163

dist/src/runtime/context-pack.jsView file

120const text = `${entry.label} ${entry.snippet ?? ''}`.toLowerCase(); L121: return text.includes('process.env') || text.includes('import.meta.env'); L122: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/runtime/context-pack.jsView on unpkg · L120

dist/src/shared/security.jsView file

1import { existsSync, lstatSync, realpathSync } from 'node:fs'; L2: import { isIP } from 'node:net'; L3: import { dirname, relative, resolve, sep } from 'node:path'; ... L56: } L57: export function validateGraphOutputPath(targetPath, base = 'out', workspaceRoot = process.cwd()) { L58: const usesDefaultOutputBase = base === 'out'; ... L82: } L83: function isPrivateAddress(hostname) { L84: const normalizedHost = hostname.toLowerCase(); ... L181: export async function readResponseBytes(response, url, maxBytes) { L182: const bytes = new Uint8Array(await response.arrayBuffer()); L183: if (bytes.byteLength > maxBytes) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/shared/security.jsView on unpkg · L1

examples/quick-benchmark.shView file

•path = examples/quick-benchmark.sh kind = build_helper sizeBytes = 1467 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/quick-benchmark.shView on unpkg

Findings

1 High5 Medium5 Low

HighCloud Metadata Accessdist/src/shared/security.js

MediumDynamic Requiredist/src/runtime/semantic.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperexamples/quick-benchmark.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/src/runtime/context-pack.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/src/runtime/context-pack.jsView file

Lines 100-140javascript

100 ...categories,

101 ]) {

102 if (seen.has(category)) {

103 continue;

104 }

105 seen.add(category);

106 ordered.push(category);

107 }

108 return ordered;

109}

110function isTestEntry(entry) {

111 return classifySourceDomain(entry.source_file) === 'test';

112}

113function isConfigurationEntry(entry) {

114 if (classifySourceDomain(entry.source_file) === 'config') {

115 return true;

116 }

117 if (CONFIG_PATH_PATTERN.test(entry.source_file)) {

118 return true;

119 }

120 const text = `${entry.label} ${entry.snippet ?? ''}`.toLowerCase();

121 return text.includes('process.env') || text.includes('import.meta.env');

122}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/runtime/context-pack.jsView on unpkg · L120

123function isContractEntry(entry) {

124 return CONTRACT_PATH_PATTERN.test(entry.source_file)

125 || (typeof entry.node_kind === 'string' && CONTRACT_NODE_KINDS.has(entry.node_kind.toLowerCase()));

126}

127function isImplementationEntry(entry) {

128 return entry.file_type === 'code'

129 && !isTestEntry(entry)

130 && !isConfigurationEntry(entry)

131 && !isContractEntry(entry);

132}

133function semanticCategoryMatches(category, node) {

134 switch (category) {

135 case 'implementation':

136 return isImplementationEntry(node.entry);

137 case 'changes':

138 return node.candidate.evidence_class === 'change';

139 case 'impact':

140 return node.candidate.evidence_class === 'impact';

dist/src/shared/security.jsView file

Lines 1-21javascript

1import { existsSync, lstatSync, realpathSync } from 'node:fs';

2import { isIP } from 'node:net';

3import { dirname, relative, resolve, sep } from 'node:path';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/shared/security.jsView on unpkg · L1

4import { resolveWorkspaceGraphPath, resolveWorkspaceOutputPath } from './workspace.js';

5const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/g;

6const MAX_LABEL_LENGTH = 256;

7const ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);

8const BLOCKED_HOSTS = new Set(['metadata.google.internal', 'metadata.google.com']);

9export const MAX_FETCH_BYTES = 52_428_800;

10export const MAX_TEXT_BYTES = 10_485_760;

11function inferGraphBase(graphPath) {

12 const resolved = resolve(graphPath);

13 const parts = resolved.split(sep);

14 const outIndex = parts.lastIndexOf('out');

15 if (outIndex >= 0) {

16 const baseParts = parts.slice(0, outIndex + 1);

17 if (baseParts[0] === '') {

18 return `${sep}${baseParts.slice(1).join(sep)}`;

19 }

20 return baseParts.join(sep);

21 }