registry / @sensegrep/cli / 1.7.3

@sensegrep/cli@1.7.3

Command-line semantic code search for AI coding workflows — find the right code by meaning using semantic, exact, and AST-aware retrieval.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 60.7 KB of source

Source & flagged code

2 flagged

dist/main.jsView file

Lines 27-67javascript

27 const value = flags[name];

28 if (value === undefined)

29 return undefined;

30 const parsed = Number(value);

31 if (!Number.isInteger(parsed) || parsed <= 0) {

32 throw new CliUsageError(`--${name} must be a positive integer`);

33 }

34 return parsed;

35}

36let corePromise = null;

37function getCliVersion() {

38 try {

39 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

40 return typeof pkg.version === "string" ? pkg.version : "unknown";

41 }

42 catch {

43 return "unknown";

44 }

45}

46async function loadCore() {

47 if (!corePromise) {

48 corePromise = import("@sensegrep/core").catch(async (error) => {

49 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

50 try {

51 return await import(fallbackUrl);

52 }

53 catch (fallbackError) {

54 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

55 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

56 err.cause = error;

57 throw err;

58 }

59 });

60 }

61 return corePromise;

62}

63function usage() {

64 writeStdoutLine(CLI_USAGE);

65}

66function parseArgs(argv) {

67 const flags = {};

Source & flagged code

2 flagged · loading source

dist/main.jsView file

47package = @sensegrep/cli; repositoryIdentity = sensegrep; dependency = @sensegrep/core L47: if (!corePromise) { L48: corePromise = import("@sensegrep/core").catch(async (error) => { L49: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

47if (!corePromise) { L48: corePromise = import("@sensegrep/core").catch(async (error) => { L49: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/main.js

MediumDynamic Requiredist/main.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/main.jsView file

Lines 27-67javascript

27 const value = flags[name];

28 if (value === undefined)

29 return undefined;

30 const parsed = Number(value);

31 if (!Number.isInteger(parsed) || parsed <= 0) {

32 throw new CliUsageError(`--${name} must be a positive integer`);

33 }

34 return parsed;

35}

36let corePromise = null;

37function getCliVersion() {

38 try {

39 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

40 return typeof pkg.version === "string" ? pkg.version : "unknown";

41 }

42 catch {

43 return "unknown";

44 }

45}

46async function loadCore() {

47 if (!corePromise) {

48 corePromise = import("@sensegrep/core").catch(async (error) => {

49 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L47

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L47

50 try {

51 return await import(fallbackUrl);

52 }

53 catch (fallbackError) {

54 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

55 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

56 err.cause = error;

57 throw err;

58 }

59 });

60 }

61 return corePromise;

62}

63function usage() {

64 writeStdoutLine(CLI_USAGE);

65}

66function parseArgs(argv) {

67 const flags = {};