registry / @sensegrep/cli / 1.11.0

@sensegrep/cli@1.11.0

Command-line semantic code search for AI coding workflows — find the right code by meaning using semantic, exact, and AST-aware retrieval.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 104 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/main.jsView file

Lines 27-67javascript

27 const value = flags[name];

28 if (value === undefined)

29 return undefined;

30 const parsed = Number(value);

31 if (!Number.isInteger(parsed) || parsed <= 0) {

32 throw new CliUsageError(`--${name} must be a positive integer`);

33 }

34 return parsed;

35}

36let corePromise = null;

37function getCliVersion() {

38 try {

39 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

40 return typeof pkg.version === "string" ? pkg.version : "unknown";

41 }

42 catch {

43 return "unknown";

44 }

45}

46async function loadCore() {

47 if (!corePromise) {

48 corePromise = import("@sensegrep/core").catch(async (error) => {

49 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

50 try {

51 return await import(fallbackUrl);

52 }

53 catch (fallbackError) {

54 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

55 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

56 err.cause = error;

57 throw err;

58 }

59 });

60 }

61 return corePromise;

62}

63function usage() {

64 writeStdoutLine(CLI_USAGE);

65}

66function parseNonNegativeIntegerFlag(flags, name) {

67 const value = flags[name];

dist/daemon.jsView file

Lines 1-21javascript

1import { createServer, request as httpRequest } from "node:http";

2import { spawn } from "node:child_process";

3import crypto from "node:crypto";

4import path from "node:path";

5import { writeJson, writeStdoutLine } from "./output.js";

Source & flagged code

3 flagged · loading source

dist/main.jsView file

47package = @sensegrep/cli; repositoryIdentity = sensegrep; dependency = @sensegrep/core L47: if (!corePromise) { L48: corePromise = import("@sensegrep/core").catch(async (error) => { L49: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

47if (!corePromise) { L48: corePromise = import("@sensegrep/core").catch(async (error) => { L49: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

dist/daemon.jsView file

1import { createServer, request as httpRequest } from "node:http"; L2: import { spawn } from "node:child_process"; L3: import crypto from "node:crypto"; L4: import path from "node:path"; L5: import { writeJson, writeStdoutLine } from "./output.js"; L6: const toolCache = new Map(); ... L83: try { L84: resolve(text ? JSON.parse(text) : {}); L85: } ... L92: if (body !== undefined) L93: req.write(JSON.stringify(body)); L94: req.end();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon.jsView on unpkg · L1

Findings

1 High4 Medium6 Low

HighCopied Package Dependency Bridgedist/main.js

MediumDynamic Requiredist/main.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/daemon.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/main.jsView file

Lines 27-67javascript

27 const value = flags[name];

28 if (value === undefined)

29 return undefined;

30 const parsed = Number(value);

31 if (!Number.isInteger(parsed) || parsed <= 0) {

32 throw new CliUsageError(`--${name} must be a positive integer`);

33 }

34 return parsed;

35}

36let corePromise = null;

37function getCliVersion() {

38 try {

39 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

40 return typeof pkg.version === "string" ? pkg.version : "unknown";

41 }

42 catch {

43 return "unknown";

44 }

45}

46async function loadCore() {

47 if (!corePromise) {

48 corePromise = import("@sensegrep/core").catch(async (error) => {

49 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

50 try {

51 return await import(fallbackUrl);

52 }

53 catch (fallbackError) {

54 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

55 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

56 err.cause = error;

57 throw err;

58 }

59 });

60 }

61 return corePromise;

62}

63function usage() {

64 writeStdoutLine(CLI_USAGE);

65}

66function parseNonNegativeIntegerFlag(flags, name) {

67 const value = flags[name];

dist/daemon.jsView file

Lines 1-21javascript

1import { createServer, request as httpRequest } from "node:http";

2import { spawn } from "node:child_process";

3import crypto from "node:crypto";

4import path from "node:path";

5import { writeJson, writeStdoutLine } from "./output.js";