registry / @mrpatronz/nexusflow / 1.6.0

@mrpatronz/nexusflow@1.6.0

Combine multiple repos into a workspace with rich AI assistant context

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 1.17 MB of source, external domains: 127.0.0.1, api.github.com, dev.azure.com, evil.example.com, git.internal.corp, github.com, gitlab.com, malicious-external-domain.com, objects.githubusercontent.com, react.dev, reactrouter.com, registry.npmjs.org, unsafe-domain.com, www.w3.org

Source & flagged code

6 flagged

dist/core/worktree.test.jsView file

Lines 1-22javascript

1import { describe, it, expect, beforeEach, afterEach } from 'vitest';

2import { execa } from 'execa';

3import { execSync } from 'node:child_process';

4import * as fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/core/worktree.test.jsView on unpkg · L2

5import * as os from 'node:os';

6import * as path from 'node:path';

7import { createWorktree, removeWorktree } from './worktree.js';

8/** These tests drive real git; skip cleanly where git is unavailable. */

9const hasGit = (() => {

10 try {

11 execSync('git --version', { stdio: 'ignore' });

12 return true;

13 }

14 catch {

15 return false;

16 }

17})();

18async function git(cwd, ...args) {

19 const { stdout } = await execa('git', args, { cwd });

20 return stdout;

21}

22/** Initializes a git repo on branch `main` with one commit. */

dist/core/graph.jsView file

Lines 1-22javascript

1import * as fs from 'node:fs/promises';

2import * as path from 'node:path';

3import { execa } from 'execa';

4/**

High

Shell

Package source references shell execution.

dist/core/graph.jsView on unpkg · L2

dist/core/plugins/loader.jsView file

Lines 1-34javascript

1import * as path from 'node:path';

2import { registerStorageProvider } from '../adapters/registry.js';

3export async function loadPlugins(program, pluginsList) {

4 const context =

dist/core/analysis-cache.jsView file

Lines 1-31javascript

1/**

2 * @module core/analysis-cache

3 * Persists per-repo analysis results in `.nexusflow-analysis-cache.json` at

4 * the workspace root, keyed by a git content fingerprint (HEAD SHA plus a

5 * signature of dirty files). Lets refresh/sync re-analyze only repos whose

6 * content actually changed, keeping unchanged maps byte-identical — which

7 * avoids file churn and preserves AI assistants' prompt caches (token saving).

8 */

9import { createHash } from 'node:crypto';

dist/utils/update-check.jsView file

Lines 1-30javascript

1/**

2 * @module utils/update-check

3 * Checks for updates to the NexusFlow package on the NPM registry.

4 */

5import { fileURLToPath } from 'node:url';

6import * as fs from 'node:fs';

7import *

Source & flagged code

6 flagged · loading source

dist/core/worktree.test.jsView file

2import { execa } from 'execa'; L3: import { execSync } from 'node:child_process'; L4: import * as fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/core/worktree.test.jsView on unpkg · L2

dist/core/graph.jsView file

2import * as path from 'node:path'; L3: import { execa } from 'execa'; L4: /**

High

Shell

Package source references shell execution.

dist/core/graph.jsView on unpkg · L2

dist/core/plugins/loader.jsView file

19const fileUrl = resolvedPath.startsWith('file://') ? resolvedPath : `file:///${resolvedPath.replace(/\\/g, '/')}`; L20: const module = await import(fileUrl); L21: const plugin = module.default || module.plugin;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/loader.jsView on unpkg · L19

dist/core/analysis-cache.jsView file

11import * as path from 'node:path'; L12: import { execa } from 'execa'; L13: /** Name of the analysis cache file, written at the workspace root. */ ... L29: const raw = await fs.readFile(getAnalysisCachePath(workspacePath), 'utf-8'); L30: const cache = JSON.parse(raw); L31: if (!cache.repos || typeof cache.repos !== 'object') { ... L80: try { L81: const { stdout: shaOut } = await execa('git', ['rev-parse', 'HEAD'], { L82: cwd: repoPath,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/analysis-cache.jsView on unpkg · L11

dist/utils/update-check.jsView file

10/** L11: * Resolves the current package version by searching for package.json upward L12: * from the directory of the executing code. ... L16: const __filename = fileURLToPath(import.meta.url); L17: const __dirname = path.dirname(__filename); L18: let currentDir = __dirname; ... L21: if (fs.existsSync(packageJsonPath)) { L22: const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8')); L23: return pkg.version; ... L59: try { L60: const response = await fetch('https://api.github.[redacted]', { L61: headers: { 'User-Agent': 'NexusFlow-Updater' },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils/update-check.jsView on unpkg · L10

130const msg = `Update available: ${chalk.red(status.currentVersion)} → ${chalk.green(status.latestVersion)}`; L131: const runMsg = `Run ${chalk.cyan('npm install -g @mrpatronz/nexusflow')} to update!`; L132: const cleanMsg = `Update available: ${status.currentVersion} → ${status.latestVersion}`; ... L144: } L145: import { execa } from 'execa'; L146: export async function getToolsStatus(force = false) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/update-check.jsView on unpkg · L130

Findings

4 High4 Medium6 Low

HighChild Processdist/core/worktree.test.js

HighShelldist/core/graph.js

HighSandbox Evasion Gated Capabilitydist/utils/update-check.js

HighRuntime Package Installdist/utils/update-check.js

MediumDynamic Requiredist/core/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/core/analysis-cache.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/core/worktree.test.jsView file

Lines 1-22javascript

1import { describe, it, expect, beforeEach, afterEach } from 'vitest';

2import { execa } from 'execa';

3import { execSync } from 'node:child_process';

4import * as fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/core/worktree.test.jsView on unpkg · L2

5import * as os from 'node:os';

6import * as path from 'node:path';

7import { createWorktree, removeWorktree } from './worktree.js';

8/** These tests drive real git; skip cleanly where git is unavailable. */

9const hasGit = (() => {

10 try {

11 execSync('git --version', { stdio: 'ignore' });

12 return true;

13 }

14 catch {

15 return false;

16 }

17})();

18async function git(cwd, ...args) {

19 const { stdout } = await execa('git', args, { cwd });

20 return stdout;

21}

22/** Initializes a git repo on branch `main` with one commit. */

dist/core/graph.jsView file

Lines 1-22javascript

1import * as fs from 'node:fs/promises';

2import * as path from 'node:path';

3import { execa } from 'execa';

4/**

High

Shell

Package source references shell execution.

dist/core/graph.jsView on unpkg · L2

dist/core/plugins/loader.jsView file

Lines 1-34javascript

1import * as path from 'node:path';

2import { registerStorageProvider } from '../adapters/registry.js';

3export async function loadPlugins(program, pluginsList) {

4 const context =

dist/core/analysis-cache.jsView file

Lines 1-31javascript

1/**

2 * @module core/analysis-cache

3 * Persists per-repo analysis results in `.nexusflow-analysis-cache.json` at

4 * the workspace root, keyed by a git content fingerprint (HEAD SHA plus a

5 * signature of dirty files). Lets refresh/sync re-analyze only repos whose

6 * content actually changed, keeping unchanged maps byte-identical — which

7 * avoids file churn and preserves AI assistants' prompt caches (token saving).

8 */

9import { createHash } from 'node:crypto';

dist/utils/update-check.jsView file

Lines 1-30javascript

1/**

2 * @module utils/update-check

3 * Checks for updates to the NexusFlow package on the NPM registry.

4 */

5import { fileURLToPath } from 'node:url';

6import * as fs from 'node:fs';

7import *

Lines 110-150javascript

110 if (current === latest)

111 return false;

112 const currentParts = current.split('.').map(Number);

113 const latestParts = latest.split('.').map(Number);

114 for (let i = 0; i < 3; i++) {

115 const curr = currentParts[i] || 0;

116 const lat = latestParts[i] || 0;

117 if (lat > curr)

118 return true;

119 if (curr > lat)

120 return false;

121 }

122 return false;

123}

124/**

125 * Prints a clean, premium terminal notification banner if an update is available.

126 */

127export function printUpdateBanner(status) {

128 if (!status.updateAvailable)

129 return;

130 const msg = `Update available: ${chalk.red(status.currentVersion)} → ${chalk.green(status.latestVersion)}`;

131 const runMsg = `Run ${chalk.cyan('npm install -g @mrpatronz/nexusflow')} to update!`;

132 const cleanMsg = `Update available: ${status.currentVersion} → ${status.latestVersion}`;

133 const cleanRunMsg = `Run npm install -g @mrpatronz/nexusflow to update!`;

134 const width = Math.max(cleanMsg.length, cleanRunMsg.length) + 2;

135 const padMsg = ' '.repeat(width - cleanMsg.length);

136 const padRunMsg = ' '.repeat(width - cleanRunMsg.length);

137 const border = '─'.repeat(width);

138 console.log();

139 console.log(chalk.yellow(`┌${border}┐`));

140 console.log(chalk.yellow(`│ ${msg}${padMsg} │`));

141 console.log(chalk.yellow(`│ ${runMsg}${padRunMsg} │`));

142 console.log(chalk.yellow(`└${border}┘`));

143 console.log();

144}

145import { execa } from 'execa';

146export async function getToolsStatus(force = false) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/update-check.jsView on unpkg · L130

147 const currentVersion = getCurrentVersion();

148 const tools = [

149 {

150 id: 'nexusflow',