registry / @roarpeng/graphflow / 1.28.1

@roarpeng/graphflow@1.28.1

⚠ Under review

Local-first memory & context harness for coding agents

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 282 file(s), 2.44 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.openai.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, electronjs.org, graphflow.invalid, graphify.team.internal, json-schema.org, registry.npmjs.org

Source & flagged code

10 flagged

package.jsonView file

Lines 39-79json

39 "types": "dist/index.d.ts",

40 "exports": {

41 ".": {

42 "types": "./dist/index.d.ts",

43 "default": "./dist/index.js"

44 },

45 "./dsh": "./dsh/plugin.mjs",

46 "./dsh/package.json": "./package.json",

47 "./web": "./web/plugin.mjs",

48 "./client": "./dsh/client.js",

49 "./package.json": "./package.json"

50 },

51 "bin": {

52 "graphflow": "dist/surfaces/cli/index.js",

53 "graphflow-mcp": "dist/surfaces/mcp/server.js"

54 },

55 "directories": {

56 "doc": "docs"

57 },

58 "scripts": {

59 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

60 "prepublishOnly": "npm run build",

61 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

62 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

63 "test": "vitest run",

64 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

65 "test:watch": "vitest",

66 "start": "tsx src/surfaces/cli/index.ts",

67 "start:mcp": "tsx src/surfaces/mcp/server.ts",

68 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

69 "benchmark:skills": "tsx benchmarks/run-skill-ab-benchmark.ts",

70 "benchmark:ab": "tsx benchmarks/run-skill-ab.ts",

71 "benchmark:memory": "tsx benchmarks/run-memory-ab.ts",

72 "benchmark:retrieval": "tsx benchmarks/run-retrieval-eval.ts",

73 "benchmark:comprehensive": "tsx benchmarks/run-comprehensive-bench.ts",

74 "benchmark:independent": "tsx benchmarks/run-independent-bench.ts",

75 "benchmark:swe-bench": "tsx benchmarks/run-swe-bench-eval.ts",

76 "benchmark:swe-bench-real": "tsx benchmarks/run-swe-bench-real.ts",

77 "benchmark:swe-bench-agent": "tsx benchmarks/run-swe-bench-agent.ts",

78 "benchmark:plugin-ab": "tsx benchmarks/run-plugin-ab.ts",

79 "benchmark:real-task-ab": "tsx benchmarks/run-real-task-ab.ts",

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join }

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-profiles/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/integrations/agent-profiles/utils.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High