registry / @roarpeng/graphflow / 1.7.0

@roarpeng/graphflow@1.7.0

⚠ Under review

**A Context-Aware Multi-Agent Orchestration Engine**

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 124 file(s), 768 KB of source, external domains: api.anthropic.com, api.deepseek.com, api.openai.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com

Source & flagged code

7 flagged

package.jsonView file

Lines 14-54json

14 "src/surfaces/antigravity-rules",

15 "src/surfaces/copilot-instructions",

16 "README.md",

17 "LICENSE",

18 "CHANGELOG.md",

19 "AGENTS.md",

20 "CLAUDE.md"

21 ],

22 "packageManager": "npm@10.9.2",

23 "description": "**A Context-Aware Multi-Agent Orchestration Engine**",

24 "main": "dist/index.js",

25 "types": "dist/index.d.ts",

26 "bin": {

27 "graphflow": "dist/surfaces/cli/index.js",

28 "graphflow-mcp": "dist/surfaces/mcp/server.js"

29 },

30 "directories": {

31 "doc": "docs"

32 },

33 "scripts": {

34 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "prepublishOnly": "npm run build",

36 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

37 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

38 "test": "vitest run",

39 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

40 "test:watch": "vitest",

41 "start": "tsx src/surfaces/cli/index.ts",

42 "start:mcp": "tsx src/surfaces/mcp/server.ts",

43 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

44 "lint": "eslint .",

45 "build:extension": "npm --prefix vscode-extension run build",

46 "test:extension": "npm --prefix vscode-extension run test:runtime",

47 "package:extension": "npm --prefix vscode-extension run package",

48 "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",

49 "prepare": "husky"

50 },

51 "lint-staged": {

52 "*.ts": "eslint --fix"

53 },

54 "repository": {

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join }

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/config/loader.jsView file

•matchType = token_shingles matchedPackage = @roarpeng/graphflow@1.4.4 matchedPath = dist/config/loader.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.4.4 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config/loader.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @roarpeng/graphflow@1.4.1 matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.4.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config/loader.jsView on unpkg

dist/integrations/agent-mcp-installer.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.4.4 matchedPath = dist/integrations/agent-mcp-installer.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-mcp-installer.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code