registry / @saluzi/codegraph / 0.2.2

@saluzi/codegraph@0.2.2

Supercharge AI coding agents with semantic code intelligence — surgical context, fewer tool calls, faster answers. 100% local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 185 file(s), 3.14 MB of source, external domains: antigravity.google, api.github.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, telemetry.getcodegraph.com

Source & flagged code

6 flagged

dist/upgrade/index.jsView file

Lines 61-101javascript

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.hasCommand = hasCommand;

77exports.defaultRun = defaultRun;

78exports.defaultCapture = defaultCapture;

79const fs = __importStar(require("fs"));

80const path = __importStar(require("path"));

81const https = __importStar(require("https"));

82const child_process_1 = require("child_process");

83exports.REPO = 'colbymchenry/codegraph';

High

Child Process

Package source references child process execution.

dist/upgrade/index.jsView on unpkg · L81

84exports.NPM_PACKAGE = '@colbymchenry/codegraph';

85const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

86exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

87function toPosix(p) {

88 return p.replace(/\\/g, '/');

89}

90/**

91 * Where the bundle installer keeps its install root, derived from the bundle

92 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

93 * the layout isn't the one the installer creates (then the installer falls

94 * back to its own default).

95 *

96 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

97 * windows: <installDir>\current (bundleRoot) → <installDir>

98 */

99function deriveInstallDir(bundleRoot, os, exists) {

100 // Use the TARGET platform's path semantics (not the host's), so this is

101 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

dist/bin/codegraph.jsView file

Lines 74-114javascript

74const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

75const command_supervision_1 = require("./command-supervision");

76const extraction_version_1 = require("../extraction/extraction-version");

77const telemetry_1

dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

Dynamic Require

dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

113 // matches existing behavior). Skipped when --yes (assume present).

114 if (

dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 5118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/upgrade/index.jsView file

81const https = __importStar(require("https")); L82: const child_process_1 = require("child_process"); L83: exports.REPO = 'colbymchenry/codegraph';

High

Child Process

Package source references child process execution.

dist/upgrade/index.jsView on unpkg · L81

dist/bin/codegraph.jsView file

94// eslint-disable-next-line @typescript-eslint/no-implied-eval L95: const importESM = new Function('specifier', 'return import(specifier)'); L96: // Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

dist/bin/codegraph.jsView on unpkg · L94

dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/shimmer-worker.jsView on unpkg · L2

dist/installer/index.jsView file

128// wedged npm can't hang the interactive installer forever (#1139). L129: (0, child_process_1.execSync)('npm install -g @colbymchenry/codegraph', { stdio: 'pipe', windowsHide: true, timeout: 120_000 }); L130: s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L128

dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 5118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg

Findings

4 High6 Medium5 Low

HighChild Processdist/upgrade/index.js

HighShell

HighEvaldist/bin/codegraph.js

HighRuntime Package Installdist/installer/index.js

MediumDynamic Requiredist/ui/shimmer-worker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/extraction/wasm/tree-sitter-terraform.wasm

MediumShips Build Helperscripts/build-bundle.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/upgrade/index.jsView file

Lines 61-101javascript

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.hasCommand = hasCommand;

77exports.defaultRun = defaultRun;

78exports.defaultCapture = defaultCapture;

79const fs = __importStar(require("fs"));

80const path = __importStar(require("path"));

81const https = __importStar(require("https"));

82const child_process_1 = require("child_process");

83exports.REPO = 'colbymchenry/codegraph';

High

Child Process

Package source references child process execution.

dist/upgrade/index.jsView on unpkg · L81

84exports.NPM_PACKAGE = '@colbymchenry/codegraph';

85const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

86exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

87function toPosix(p) {

88 return p.replace(/\\/g, '/');

89}

90/**

91 * Where the bundle installer keeps its install root, derived from the bundle

92 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

93 * the layout isn't the one the installer creates (then the installer falls

94 * back to its own default).

95 *

96 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

97 * windows: <installDir>\current (bundleRoot) → <installDir>

98 */

99function deriveInstallDir(bundleRoot, os, exists) {

100 // Use the TARGET platform's path semantics (not the host's), so this is

101 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

dist/bin/codegraph.jsView file

Lines 74-114javascript

74const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

75const command_supervision_1 = require("./command-supervision");

76const extraction_version_1 = require("../extraction/extraction-version");

77const telemetry_1

dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

Dynamic Require

dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

113 // matches existing behavior). Skipped when --yes (assume present).

114 if (

dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 5118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg