registry / @lyku/lockstep-core / 1.6.0

@lyku/lockstep-core@1.6.0

Schema-driven code generation: PostgreSQL models → TypeScript types, Kysely types, API handlers, and typed clients

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 208 file(s), 144 KB of source, external domains: api.example.com

Source & flagged code

4 flagged

diagrams/generate.jsView file

Lines 1-31javascript

1/* eslint-disable security/detect-non-literal-fs-filename, security/detect-object-injection */

2/**

3 * Generates per-package pipeline diagrams from the master pipeline.mmd.

4 *

5 * Each variant highlights the nodes belonging to that package and dims everything else.

6 * Output is a mermaid code block ready to paste into a README.

7 *

8 * Usage: bun libs/lockstep-core/diagrams/generate.ts

9 */

10import { readFileSync, writeFileSync, mkdirSync, copyFileSync } from 'fs';

11import { join, dirname } from 'path';

12import { execSync } from 'child_process';

13const DIAGRAMS_DIR = dirname(new URL(import.meta.url).pathname);

High

Child Process

Package source references child process execution.

diagrams/generate.jsView on unpkg · L11

14const master = readFileSync(join(DIAGRAMS_DIR, 'pipeline.mmd'), 'utf-8');

15// Strip comment lines from master

16const masterLines = master

17 .split('\n')

18 .filter((line) => !line.trim().startsWith('%%'));

19const packages = {

20 'lockstep-core': {

21 prefix: 'core-',

22 title: '@lyku/lockstep-core',

23 },

24 'lockstep-handles-ts': {

25 prefix: 'handles-',

26 title: '@lyku/lockstep-handles-ts',

27 },

28 'lockstep-client-ts': {

29 prefix: 'client-',

30 title: '@lyku/lockstep-client-ts',

31 },

Lines 133-164javascript

133 `classDef handlesNode fill:#e0e7ff,stroke:#6366f1,color:#312e81,stroke-width:1px`,

134 `classDef clientNode fill:#fce7f3,stroke:#ec4899,color:#831843,stroke-width:1px`,

135 `classDef pgNode fill:#fef9c3,stroke:#eab308,color:#713f12,stroke-width:1px`,

136 `class ${allNodeIds.filter((id) => id.startsWith('input-')).join(',')} inputNode`,

137 `class ${allNodeIds

tsonValidator/testUtils.jsView file

Lines 1-22javascript

1export function compileValidator(proto, key = 'value') {

2 const keyDeclaration = key === 'value' ? '' : `const ${key} = value;`;

3 const

cli.tsView file

Lines 47-87typescript

47 args['_cmd'] = arg;

48 } else if (!args['_sub']) {

49 args['_sub'] = arg;

50 }

51 }

52 return args;

53}

Source & flagged code

4 flagged · loading source

diagrams/generate.jsView file

11import { join, dirname } from 'path'; L12: import { execSync } from 'child_process'; L13: const DIAGRAMS_DIR = dirname(new URL(import.meta.url).pathname);

High

Child Process

Package source references child process execution.

diagrams/generate.jsView on unpkg · L11

153const svgPath = join(generatedDir, `${file}.svg`); L154: execSync(`npx @mermaid-js/mermaid-cli -i "${mmdPath}" -o "${svgPath}" -b transparent -p /dev/null`, { stdio: 'inherit' }); L155: console.log(`Rendered ${svgPath}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

diagrams/generate.jsView on unpkg · L153

tsonValidator/testUtils.jsView file

2const keyDeclaration = key === 'value' ? '' : `const ${key} = value;`; L3: const validateFn = new Function('value', ` L4: let allErrors = [];

Low

Eval

Package source references a known benign dynamic code generation pattern.

tsonValidator/testUtils.jsView on unpkg · L2

cli.tsView file

67const resolved = resolve(modulePath); L68: return import(resolved); L69: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.tsView on unpkg · L67

Findings

3 High3 Medium5 Low

HighChild Processdiagrams/generate.js

HighShell

HighRuntime Package Installdiagrams/generate.js

MediumDynamic Requirecli.ts

MediumNetwork

MediumStructural Risk Force Deep Review

LowEvaltsonValidator/testUtils.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

diagrams/generate.jsView file

Lines 1-31javascript

1/* eslint-disable security/detect-non-literal-fs-filename, security/detect-object-injection */

2/**

3 * Generates per-package pipeline diagrams from the master pipeline.mmd.

4 *

5 * Each variant highlights the nodes belonging to that package and dims everything else.

6 * Output is a mermaid code block ready to paste into a README.

7 *

8 * Usage: bun libs/lockstep-core/diagrams/generate.ts

9 */

10import { readFileSync, writeFileSync, mkdirSync, copyFileSync } from 'fs';

11import { join, dirname } from 'path';

12import { execSync } from 'child_process';

13const DIAGRAMS_DIR = dirname(new URL(import.meta.url).pathname);

High

Child Process

Package source references child process execution.

diagrams/generate.jsView on unpkg · L11

14const master = readFileSync(join(DIAGRAMS_DIR, 'pipeline.mmd'), 'utf-8');

15// Strip comment lines from master

16const masterLines = master

17 .split('\n')

18 .filter((line) => !line.trim().startsWith('%%'));

19const packages = {

20 'lockstep-core': {

21 prefix: 'core-',

22 title: '@lyku/lockstep-core',

23 },

24 'lockstep-handles-ts': {

25 prefix: 'handles-',

26 title: '@lyku/lockstep-handles-ts',

27 },

28 'lockstep-client-ts': {

29 prefix: 'client-',

30 title: '@lyku/lockstep-client-ts',

31 },

Lines 133-164javascript

133 `classDef handlesNode fill:#e0e7ff,stroke:#6366f1,color:#312e81,stroke-width:1px`,

134 `classDef clientNode fill:#fce7f3,stroke:#ec4899,color:#831843,stroke-width:1px`,

135 `classDef pgNode fill:#fef9c3,stroke:#eab308,color:#713f12,stroke-width:1px`,

136 `class ${allNodeIds.filter((id) => id.startsWith('input-')).join(',')} inputNode`,

137 `class ${allNodeIds

tsonValidator/testUtils.jsView file

Lines 1-22javascript

1export function compileValidator(proto, key = 'value') {

2 const keyDeclaration = key === 'value' ? '' : `const ${key} = value;`;

3 const

cli.tsView file

Lines 47-87typescript

47 args['_cmd'] = arg;

48 } else if (!args['_sub']) {

49 args['_sub'] = arg;

50 }

51 }

52 return args;

53}