registry / @roarpeng/graphflow / 2.2.0

@roarpeng/graphflow@2.2.0

⚠ Under review

Local-first memory & context harness for coding agents

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 297 file(s), 2.76 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.openai.com, api.typesafe.ai, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, electronjs.org, graphflow.invalid, graphify.team.internal, json-schema.org, registry.npmjs.org

Source & flagged code

12 flagged

package.jsonView file

Lines 42-82json

42 "types": "dist/index.d.ts",

43 "exports": {

44 ".": {

45 "types": "./dist/index.d.ts",

46 "default": "./dist/index.js"

47 },

48 "./dsh": "./dsh/plugin.mjs",

49 "./dsh/package.json": "./package.json",

50 "./web": "./web/plugin.mjs",

51 "./client": "./dsh/client.js",

52 "./package.json": "./package.json"

53 },

54 "bin": {

55 "graphflow": "dist/surfaces/cli/index.js",

56 "graphflow-mcp": "dist/surfaces/mcp/server.js"

57 },

58 "directories": {

59 "doc": "docs"

60 },

61 "scripts": {

62 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

63 "prepublishOnly": "npm run build",

64 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

65 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

66 "test": "vitest run",

67 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

68 "test:watch": "vitest",

69 "start": "tsx src/surfaces/cli/index.ts",

70 "start:mcp": "tsx src/surfaces/mcp/server.ts",

71 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

72 "benchmark:skills": "tsx benchmarks/run-skill-ab-benchmark.ts",

73 "benchmark:ab": "tsx benchmarks/run-skill-ab.ts",

74 "benchmark:memory": "tsx benchmarks/run-memory-ab.ts",

75 "benchmark:retrieval": "tsx benchmarks/run-retrieval-eval.ts",

76 "benchmark:comprehensive": "tsx benchmarks/run-comprehensive-bench.ts",

77 "benchmark:independent": "tsx benchmarks/run-independent-bench.ts",

78 "benchmark:swe-bench": "tsx benchmarks/run-swe-bench-eval.ts",

79 "benchmark:swe-bench-real": "tsx benchmarks/run-swe-bench-real.ts",

80 "benchmark:swe-bench-agent": "tsx benchmarks/run-swe-bench-agent.ts",

81 "benchmark:plugin-ab": "tsx benchmarks/run-plugin-ab.ts",

82 "benchmark:real-task-ab": "tsx benchmarks/run-real-task-ab.ts",

dist/config/env-lookup.jsView file

Lines 1-26javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.KNOWN_CREDENTIAL_ENV_VARS = void 0;

4exports.resetRegistryEnvCache =

dist/learning/outcome-reconciler.jsView file

Lines 52-92javascript

52 const iso = (ms) => new Date(ms).toISOString();

53 const result = (0, node_child_process_1.spawnSync)("git"

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

dist/surfaces/cli/settings-server.jsView file

Lines 1-31javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join }

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-profiles/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/integrations/agent-profiles/utils.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-profiles/utils.jsView on unpkg

dist/integrations/ensure-anydoc.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/integrations/ensure-anydoc.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ensure-anydoc.jsView on unpkg

dist/surfaces/team/ops.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/surfaces/team/ops.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/team/ops.jsView on unpkg

dist/surfaces/team/server.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.17.1 matchedPath = dist/surfaces/team/server.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/team/server.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.json

@roarpeng/graphflow@2.2.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code