registry / @neat.is/core / 0.4.23

@neat.is/core@0.4.23

NEAT graph engine: tree-sitter extraction, OTel ingest, REST API

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 1.79 MB of source, external domains: 127.0.0.1, registry.npmjs.org

Source & flagged code

8 flagged

dist/chunk-O25KZNZK.jsView file

Lines 3446-3486javascript

3446 for (const [pattern, targets] of Object.entries(config.paths)) {

3447 let suffix = null;

3448 if (pattern === specifier) {

3449 suffix = "";

3450 } else if (pattern.endsWith("/*")) {

3451 const prefix = pattern.slice(0, -1);

3452 if (specifier.startsWith(prefix)) suffix = specifier.slice(prefix.length);

3453 }

3454 if (suffix === null) continue;

3455 for (const target of targets) {

3456 const targetBase = target.endsWith("/*") ? target.slice(0, -2) : target.replace(/\*$/, "");

3457 const resolvedBase = path12.resolve(config.baseDir, targetBase, suffix);

3458 const hit = await firstExistingCandidate(resolvedBase, serviceDir);

3459 if (hit) return hit;

3460 if (isWithinServiceDir(resolvedBase, serviceDir) && await fileExists(resolvedBase)) {

3461 return toPosix2(path12.relative(serviceDir, resolvedBase));

3462 }

3463 }

3464 }

3465 return null;

3466}

3467async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {

3468 if (!specifier) return null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-O25KZNZK.jsView on unpkg · L3466

3469 if (specifier.startsWith("./") || specifier.startsWith("../")) {

3470 const base = path12.resolve(importerDir, specifier);

3471 const ext = path12.extname(specifier);

3472 if (ext) {

3473 if (ext === ".js" || ext === ".jsx") {

3474 const tsExt = ext === ".jsx" ? ".tsx" : ".ts";

3475 const tsSibling = base.slice(0, -ext.length) + tsExt;

3476 if (isWithinServiceDir(tsSibling, serviceDir) && await fileExists(tsSibling)) {

3477 return toPosix2(path12.relative(serviceDir, tsSibling));

3478 }

3479 }

3480 if (isWithinServiceDir(base, serviceDir) && await fileExists(base)) {

3481 return toPosix2(path12.relative(serviceDir, base));

3482 }

3483 return null;

3484 }

3485 return firstExistingCandidate(base, serviceDir);

3486 }

Lines 6246-6286javascript

6246 if (removed.length === 0) return [];

6247 reg.projects = kept;

6248 await writeRegistry(reg);

6249 return removed;

6250 });

6251}

6252

6253// src/api.ts

6254import Fastify from

dist/neatd.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 reconcileDaemonRecordSync,

4 startDaemon

5} from "./chunk-IABNGQT2.js";

6import {

7 listProjects,

8 registryPath

9} from "./chunk-O25KZNZK.js";

10import {

dist/chunk-XOOCA5T7.jsView file

Lines 41-81javascript

41 return parts.join(" ");

42}

43function attrsHash(node) {

44 return createHash("sha1").update(embedText(node)).digest("hex").slice(0, 16);

dist/cli.jsView file

Lines 46-86javascript

46 makeErrorSpanWriter,

47 makeSpanHandler,

48 normalizeProjectPath,

49 pathsForProject,

50 promoteFrontierNodes,

51 pruneRegistry,

52 removeDaemonRecord,

53 removeProject,

54 resetGraph,

55 retireEdgesByFile,

56 runPackageManagerInstall,

57 saveGraphToDisk,

58 setStatus,

dist/cli.cjsView file

Lines 36-76javascript

36var init_cjs_shims = __esm({

37 "../../node_modules/tsup/assets/cjs_shims.js"() {

38 "use strict";

39 getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`

Source & flagged code

8 flagged · loading source

dist/chunk-O25KZNZK.jsView file

6266import path37 from "path"; L6267: import { spawn } from "child_process"; L6268: var LOCKFILE_PRIORITY = [

High

Child Process

Package source references child process execution.

dist/chunk-O25KZNZK.jsView on unpkg · L6266

3466} L3467: async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) { L3468: if (!specifier) return null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-O25KZNZK.jsView on unpkg · L3466

dist/neatd.jsView file

78// ESM fallback — daemon CJS bundle has `require`, but typecheck wants this L79: eval("require") L80: );

High

Eval

Package source references dynamic code evaluation.

dist/neatd.jsView on unpkg · L78

20// src/web-spawn.ts L21: import { spawn } from "child_process"; L22: import { promises as fsp } from "fs"; L23: import net from "net"; L24: import path from "path"; ... L31: function projectRoot() { L32: const fromEnv = process.env.NEAT_SCAN_PATH; L33: return path.resolve(fromEnv && fromEnv.length > 0 ? fromEnv : process.cwd());

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/neatd.jsView on unpkg · L20

dist/chunk-XOOCA5T7.jsView file

61function ollamaHost() { L62: return process.env.OLLAMA_HOST ?? null; L63: } ... L65: try { L66: const res = await fetch(`${host.replace(/\/$/, "")}/api/tags`, { L67: signal: AbortSignal.timeout(500) ... L85: headers: { "content-type": "application/json" }, L86: body: JSON.stringify({ model, prompt: text }) L87: }); ... L90: } L91: const data = await res.json(); L92: out.push(Float32Array.from(data.embedding));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-XOOCA5T7.jsView on unpkg · L61

dist/cli.jsView file

66Cross-file remote execution chain: dist/cli.js spawns dist/neatd.js; helper contains network access plus dynamic code execution. L66: import { L67: __dirname, L68: __require, ... L85: const candidates = [ L86: path.resolve(here, "../package.json"), L87: path.resolve(here, "../../package.json") ... L91: const raw = readFileSync(candidate, "utf8"); L92: const parsed = JSON.parse(raw); L93: if (parsed.name === "@neat.is/core" && typeof parsed.version === "string") { ... L153: "for prod OTel routing, set these in your deploy platform's env:", L154: " OTEL_EXPORTER_OTLP_ENDPOINT=https://<your-neat-host>:4318", L155: " OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer <NEAT_AUTH_TOKEN>"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L66

66import { L67: __dirname, L68: __require, ... L85: const candidates = [ L86: path.resolve(here, "../package.json"), L87: path.resolve(here, "../../package.json") ... L91: const raw = readFileSync(candidate, "utf8"); L92: const parsed = JSON.parse(raw); L93: if (parsed.name === "@neat.is/core" && typeof parsed.version === "string") { ... L153: "for prod OTel routing, set these in your deploy platform's env:", L154: " OTEL_EXPORTER_OTLP_ENDPOINT=https://<your-neat-host>:4318", L155: " OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer <NEAT_AUTH_TOKEN>"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L66

dist/cli.cjsView file

56Detached bundled service listener: dist/cli.cjs launches a Node helper and exposes a broad-bound HTTP listener. L56: if (opts.trustProxy) return; L57: const expected = Buffer.from(opts.token, "utf8"); L58: const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []]; ... L73: if (typeof header !== "string" || !header.startsWith("Bearer ")) { L74: void reply.code(401).send({ error: "unauthorized" }); L75: return; ... L88: } L89: function readAuthEnv(env = process.env) { L90: const t = env.NEAT_AUTH_TOKEN; ... L643: function readPackageVersion() { L644: const here = typeof __dirname !== "undefined" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl)); L645: const candidates = [

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.cjsView on unpkg · L56

Findings

6 High5 Medium6 Low

HighChild Processdist/chunk-O25KZNZK.js

HighShell

HighEvaldist/neatd.js

HighSame File Env Network Executiondist/neatd.js

HighCross File Remote Execution Contextdist/cli.js

HighSpawned Bundled Service Listenerdist/cli.cjs

MediumDynamic Requiredist/chunk-O25KZNZK.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chunk-XOOCA5T7.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/chunk-O25KZNZK.jsView file

Lines 3446-3486javascript

3446 for (const [pattern, targets] of Object.entries(config.paths)) {

3447 let suffix = null;

3448 if (pattern === specifier) {

3449 suffix = "";

3450 } else if (pattern.endsWith("/*")) {

3451 const prefix = pattern.slice(0, -1);

3452 if (specifier.startsWith(prefix)) suffix = specifier.slice(prefix.length);

3453 }

3454 if (suffix === null) continue;

3455 for (const target of targets) {

3456 const targetBase = target.endsWith("/*") ? target.slice(0, -2) : target.replace(/\*$/, "");

3457 const resolvedBase = path12.resolve(config.baseDir, targetBase, suffix);

3458 const hit = await firstExistingCandidate(resolvedBase, serviceDir);

3459 if (hit) return hit;

3460 if (isWithinServiceDir(resolvedBase, serviceDir) && await fileExists(resolvedBase)) {

3461 return toPosix2(path12.relative(serviceDir, resolvedBase));

3462 }

3463 }

3464 }

3465 return null;

3466}

3467async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {

3468 if (!specifier) return null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-O25KZNZK.jsView on unpkg · L3466

3469 if (specifier.startsWith("./") || specifier.startsWith("../")) {

3470 const base = path12.resolve(importerDir, specifier);

3471 const ext = path12.extname(specifier);

3472 if (ext) {

3473 if (ext === ".js" || ext === ".jsx") {

3474 const tsExt = ext === ".jsx" ? ".tsx" : ".ts";

3475 const tsSibling = base.slice(0, -ext.length) + tsExt;

3476 if (isWithinServiceDir(tsSibling, serviceDir) && await fileExists(tsSibling)) {

3477 return toPosix2(path12.relative(serviceDir, tsSibling));

3478 }

3479 }

3480 if (isWithinServiceDir(base, serviceDir) && await fileExists(base)) {

3481 return toPosix2(path12.relative(serviceDir, base));

3482 }

3483 return null;

3484 }

3485 return firstExistingCandidate(base, serviceDir);

3486 }

Lines 6246-6286javascript

6246 if (removed.length === 0) return [];

6247 reg.projects = kept;

6248 await writeRegistry(reg);

6249 return removed;

6250 });

6251}

6252

6253// src/api.ts

6254import Fastify from

dist/neatd.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 reconcileDaemonRecordSync,

4 startDaemon

5} from "./chunk-IABNGQT2.js";

6import {

7 listProjects,

8 registryPath

9} from "./chunk-O25KZNZK.js";

10import {

dist/chunk-XOOCA5T7.jsView file

Lines 41-81javascript

41 return parts.join(" ");

42}

43function attrsHash(node) {

44 return createHash("sha1").update(embedText(node)).digest("hex").slice(0, 16);

dist/cli.jsView file

Lines 46-86javascript

46 makeErrorSpanWriter,

47 makeSpanHandler,

48 normalizeProjectPath,

49 pathsForProject,

50 promoteFrontierNodes,

51 pruneRegistry,

52 removeDaemonRecord,

53 removeProject,

54 resetGraph,

55 retireEdgesByFile,

56 runPackageManagerInstall,

57 saveGraphToDisk,

58 setStatus,

dist/cli.cjsView file

Lines 36-76javascript

36var init_cjs_shims = __esm({

37 "../../node_modules/tsup/assets/cjs_shims.js"() {

38 "use strict";

39 getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`