registry / @quolu/lattice / 0.6.5

@quolu/lattice@0.6.5

Lattice — parallel TODO graph compiler and conflict-aware orchestration runtime with isolated executor landing

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 239 file(s), 4.53 MB of source, external domains: antigravity.google, api.github.com, docs.claude.com, docs.cursor.com, geminicli.com, getcodegraph.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, telemetry.getcodegraph.com, www.w3.org

Source & flagged code

6 flagged

sensor/dist/upgrade/index.jsView file

Lines 61-101javascript

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.hasCommand = hasCommand;

77exports.defaultRun = defaultRun;

78exports.defaultCapture = defaultCapture;

79const fs = __importStar(require("fs"));

80const path = __importStar(require("path"));

81const https = __importStar(require("https"));

82const child_process_1 = require("child_process");

83const color_1 = require("../ui/color");

High

Child Process

Package source references child process execution.

sensor/dist/upgrade/index.jsView on unpkg · L81

84exports.REPO = 'colbymchenry/codegraph';

85exports.NPM_PACKAGE = '@colbymchenry/codegraph';

86const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

87exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

88function toPosix(p) {

89 return p.replace(/\\/g, '/');

90}

91/**

92 * Where the bundle installer keeps its install root, derived from the bundle

93 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

94 * the layout isn't the one the installer creates (then the installer falls

95 * back to its own default).

96 *

97 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

98 * windows: <installDir>\current (bundleRoot) → <installDir>

99 */

100function deriveInstallDir(bundleRoot, os, exists) {

101 // Use the TARGET platform's path semantics (not the host's), so this is

src/rc1-black-box-oracle.mjsView file

Lines 244-284javascript

244 && typeof value.node_version === 'string'

245 && value.node_version.length > 0

246 && value.node_version.length <= 128

sensor/dist/bin/codegraph.jsView file

Lines 88-128javascript

88// Decided once, before `--color`/`--no-color` are stripped from argv below

89// (#1281). Piped/redirected stdout, NO_COLOR, or --no-color -> plain output.

90const COLORS_ENABLED = (0, color_1.ansiColorsEnabled)();

91// Lazy-load heavy modules (CodeGraph, runInstaller) to keep CLI startup fast.

92async function loadCodeGraph() {

sensor/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

sensor/dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

sensor/dist/extraction/wasm/tree-sitter-go.wasmView file

•path = [redacted]-sitter-go.wasm kind = wasm_module sizeBytes = 210013 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

sensor/dist/extraction/wasm/tree-sitter-go.wasmView on unpkg

Source & flagged code

6 flagged · loading source

sensor/dist/upgrade/index.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code