registry / @qdama/flowspec / 0.1.17

@qdama/flowspec@0.1.17

FlowSpec CLI and Codex skills for QDM AI-native delivery workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 128 KB of source, external domains: gitlab.com, registry.npmjs.org

Source & flagged code

3 flagged

dist/gitlab.jsView file

Lines 1-21javascript

1import http from "node:http";

2import https from "node:https";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/gitlab.jsView on unpkg · L1

3export const GITLAB_LABEL_DEFINITIONS = [

4 { name: "qa-found", color: "#428BCA", description: "QA reported the issue." },

5 { name: "codex-ready", color: "#1F75CB", description: "Codex may triage or attempt a fix." },

6 { name: "codex-running", color: "#A8D695", description: "A Codex runner is actively processing the issue." },

7 { name: "fix-proposed", color: "#69D100", description: "A fix merge request has been created." },

8 { name: "needs-info", color: "#F0AD4E", description: "More evidence is required before work can continue." },

9 { name: "human-needed", color: "#D9534F", description: "Human review or a decision is required." },

10 { name: "blocking", color: "#D9534F", description: "Blocks QA acceptance or release." },

11 { name: "non-blocking", color: "#A8D695", description: "Does not block QA acceptance or release." },

12 { name: "verification-passed", color: "#69D100", description: "QA verification passed." },

13 { name: "verification-failed", color: "#D9534F", description: "QA verification failed." },

14];

15const DEFAULT_TOKEN_ENV = "FLOWSPEC_GITLAB_TOKEN";

16const QDM_TOKEN_ENV = "QDM_GITLAB_TOKEN";

17const DEFAULT_TIMEOUT_MS = 30_000;

18export class GitLabClient {

19 baseUrl;

20 tokenEnv;

21 tokenHeader;

scripts/fix_qa_issue.pyView file

•path = scripts/fix_qa_issue.py kind = build_helper sizeBytes = 4431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/fix_qa_issue.pyView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @qdama/flowspec@0.1.14 matchedIdentity = npm:QHFkYW1hL2Zsb3dzcGVj:0.1.14 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/gitlab.jsView file

1import http from "node:http"; L2: import https from "node:https"; ... L24: constructor(options = {}) { L25: this.tokenEnv = options.tokenEnv ?? (process.env[DEFAULT_TOKEN_ENV] ? DEFAULT_TOKEN_ENV : process.env[QDM_TOKEN_ENV] ? QDM_TOKEN_ENV : DEFAULT_TOKEN_ENV); L26: const token = process.env[this.tokenEnv]; ... L28: throw new Error(`GitLab token environment variable is not set: ${this.tokenEnv}`); L29: const configuredUrl = options.baseUrl ?? process.env.FLOWSPEC_GITLAB_URL ?? process.env.CI_SERVER_URL ?? "https://gitlab.com"; L30: const parsedUrl = new URL(configuredUrl); ... L155: const chunks = []; L156: response.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))); L157: response.on("end", () => { ... L165: if (!responseText) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/gitlab.jsView on unpkg · L1

scripts/fix_qa_issue.pyView file

•path = scripts/fix_qa_issue.py kind = build_helper sizeBytes = 4431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/fix_qa_issue.pyView on unpkg

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/gitlab.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/fix_qa_issue.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings