registry / @querygraph/verdun / 0.1.1

@querygraph/verdun@0.1.1

Verdun is the reusable core for database-backed collection/review workbenches. This repository carries the generic core plus a neutral bundled demo instance. Product apps extend Verdun through public package, API, database, deploy, and crawler contracts w

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 167 KB of source, external domains: 127.0.0.1, api.resend.com, example.com, example.test, oauth2.googleapis.com

Source & flagged code

3 flagged

scripts/smoke-account-store.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process'

3import { mkdir, mkdtemp, readFile } from 'node:fs/promises'

High

Child Process

Package source references child process execution.

scripts/smoke-account-store.mjsView on unpkg · L1

4import { join } from 'node:path'

5import { pathToFileURL } from 'node:url'

7const artifactRoot = new URL('../.codex-artifacts/', import.meta.url)

8await mkdir(artifactRoot, { recursive: true })

9const outDir = await mkdtemp(new URL('account-store-smoke-', artifactRoot))

10const compile = spawnSync('node_modules/.bin/tsc', [

11 '--ignoreConfig',

12 '--outDir',

13 outDir,

14 '--module',

15 'NodeNext',

16 '--moduleResolution',

17 'NodeNext',

18 '--target',

19 'ES2022',

20 '--types',

21 'node',

23 'src/accounts/account-types.ts',

24 'src/accounts/http.ts',

25 'src/accounts/store.ts',

26], {

27 cwd: new URL('..', import.meta.url),

28 stdio: 'inherit',

29})

30if (compile.error) throw compile.error

31if (compile.status !== 0) throw new Error(`Verdun account store smoke TypeScript compile exited with ${compile.status}`)

33const {

34 createVerdunAccountSession,

35 currentVerdunAccount,

36 deleteExpiredVerdunAccountSessions,

37 hashVerdunSessionToken,

38 recordVerdunAccountUsage,

39 revokeVerdunAccountSession,

40 updateVerdunAccountStatus,

41 upsertVerdunGoogleAccount,

42 verdunAdminEmailsFromEnv,

43 verdunAccountUsage,

44} = await import(pathToFileURL(join(outDir, 'store.js')).href)

45const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-account-store.mjsView on unpkg · L43

46 clearVerdunSessionCookie,

47 verdunAccountCookieName,

48 verdunCookieValue,

49 verdunDefaultSessionMaxAgeSeconds,

50 verdunSessionCookie,

51} = await import(pathToFileURL(join(outDir, 'http.js')).href)

52const {

53 isVerdunAccountStatus,

54 isVerdunAccountTier,

55 verdunAccountStatuses,

56 verdunAccountTiers,

57 verdunPublicAccount,

58} = await import(pathToFileURL(join(outDir, 'account-types.js')).href)

60const sql = fakeSql()

61const accountStoreSource = await readFile(new URL('../src/accounts/store.ts', import.meta.url), 'utf8')

62if (!accountStoreSource.includes('and exists (select 1 from inserted_subject)\n )\n returning used')) {

63 throw new Error('distinct-subject usage SQL must close the update predicate before returning used')

scripts/deploy-workbench-database.mjsView file

Lines 141-181javascript

141 ? 'generic workbench database load applied and deployed database gate passed'

142 : 'generic workbench database deployment preflight passed (dry run only; add --apply to load external Postgres)')

143}

144

145function optionValue(args, name) {

146

Source & flagged code

3 flagged · loading source

scripts/smoke-account-store.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code