registry / @sensegrep/cli / 1.7.5

@sensegrep/cli@1.7.5

Command-line semantic code search for AI coding workflows — find the right code by meaning using semantic, exact, and AST-aware retrieval.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 53.7 KB of source

Source & flagged code

2 flagged

dist/main.jsView file

Lines 28-68javascript

28 const value = flags[name];

29 if (value === undefined)

30 return undefined;

31 const parsed = Number(value);

32 if (!Number.isInteger(parsed) || parsed <= 0) {

33 throw new CliUsageError(`--${name} must be a positive integer`);

34 }

35 return parsed;

36}

37let corePromise = null;

38function getCliVersion() {

39 try {

40 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

41 return typeof pkg.version === "string" ? pkg.version : "unknown";

42 }

43 catch {

44 return "unknown";

45 }

46}

47async function loadCore() {

48 if (!corePromise) {

49 corePromise = import("@sensegrep/core").catch(async (error) => {

50 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L48

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L48

51 try {

52 return await import(fallbackUrl);

53 }

54 catch (fallbackError) {

55 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

56 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

57 err.cause = error;

58 throw err;

59 }

60 });

61 }

62 return corePromise;

63}

64function usage() {

65 writeStdoutLine(CLI_USAGE);

66}

67function parseArgs(argv) {

68 const flags = {};

Source & flagged code

2 flagged · loading source

dist/main.jsView file

48package = @sensegrep/cli; repositoryIdentity = sensegrep; dependency = @sensegrep/core L48: if (!corePromise) { L49: corePromise = import("@sensegrep/core").catch(async (error) => { L50: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L48

48if (!corePromise) { L49: corePromise = import("@sensegrep/core").catch(async (error) => { L50: const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L48

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/main.js

MediumDynamic Requiredist/main.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/main.jsView file

Lines 28-68javascript

28 const value = flags[name];

29 if (value === undefined)

30 return undefined;

31 const parsed = Number(value);

32 if (!Number.isInteger(parsed) || parsed <= 0) {

33 throw new CliUsageError(`--${name} must be a positive integer`);

34 }

35 return parsed;

36}

37let corePromise = null;

38function getCliVersion() {

39 try {

40 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

41 return typeof pkg.version === "string" ? pkg.version : "unknown";

42 }

43 catch {

44 return "unknown";

45 }

46}

47async function loadCore() {

48 if (!corePromise) {

49 corePromise = import("@sensegrep/core").catch(async (error) => {

50 const fallbackUrl = new URL("../../core/dist/index.js", import.meta.url).href;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/main.jsView on unpkg · L48

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L48

51 try {

52 return await import(fallbackUrl);

53 }

54 catch (fallbackError) {

55 const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);

56 const err = new Error(`Failed to load @sensegrep/core. Fallback also failed: ${message}`);

57 err.cause = error;

58 throw err;

59 }

60 });

61 }

62 return corePromise;

63}

64function usage() {

65 writeStdoutLine(CLI_USAGE);

66}

67function parseArgs(argv) {

68 const flags = {};