registry / @roarpeng/graphflow / 1.18.5

@roarpeng/graphflow@1.18.5

⚠ Under review

Local-first memory & context harness for coding agents

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis flagged 25 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 246 file(s), 1.99 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.openai.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, graphflow.invalid, graphify.team.internal, json-schema.org

Source & flagged code

17 flagged

package.jsonView file

Lines 37-77json

37 "types": "dist/index.d.ts",

38 "exports": {

39 ".": {

40 "types": "./dist/index.d.ts",

41 "default": "./dist/index.js"

42 },

43 "./dsh": "./dsh/plugin.mjs",

44 "./dsh/package.json": "./package.json",

45 "./web": "./web/plugin.mjs",

46 "./client": "./dsh/client.js",

47 "./package.json": "./package.json"

48 },

49 "bin": {

50 "graphflow": "dist/surfaces/cli/index.js",

51 "graphflow-mcp": "dist/surfaces/mcp/server.js"

52 },

53 "directories": {

54 "doc": "docs"

55 },

56 "scripts": {

57 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

58 "prepublishOnly": "npm run build",

59 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

60 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

61 "test": "vitest run",

62 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

63 "test:watch": "vitest",

64 "start": "tsx src/surfaces/cli/index.ts",

65 "start:mcp": "tsx src/surfaces/mcp/server.ts",

66 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

67 "benchmark:skills": "tsx benchmarks/run-skill-ab-benchmark.ts",

68 "benchmark:ab": "tsx benchmarks/run-skill-ab.ts",

69 "benchmark:memory": "tsx benchmarks/run-memory-ab.ts",

70 "benchmark:retrieval": "tsx benchmarks/run-retrieval-eval.ts",

71 "benchmark:comprehensive": "tsx benchmarks/run-comprehensive-bench.ts",

72 "benchmark:independent": "tsx benchmarks/run-independent-bench.ts",

73 "benchmark:swe-bench": "tsx benchmarks/run-swe-bench-eval.ts",

74 "benchmark:swe-bench-real": "tsx benchmarks/run-swe-bench-real.ts",

75 "benchmark:swe-bench-agent": "tsx benchmarks/run-swe-bench-agent.ts",

76 "benchmark:plugin-ab": "tsx benchmarks/run-plugin-ab.ts",

77 "benchmark:real-task-ab": "tsx benchmarks/run-real-task-ab.ts",

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join }

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-mcp-installer.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/integrations/agent-mcp-installer.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High