registry / @simular-ai/simulang-js / 10.1.0

@simular-ai/simulang-js@10.1.0

Node.js bindings for simulang-rs

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 87.0 KB of source, external domains: example.com, github.com, google.com, simular.ai, www.google.com

Source & flagged code

3 flagged

package.jsonView file

Lines 62-102json

62 "constEnum": false

63 },

64 "engines": {

65 "node": ">= 20"

66 },

67 "publishConfig": {

68 "access": "public"

69 },

70 "scripts": {

71 "artifacts": "napi artifacts",

72 "bench": "node --import @oxc-node/core/register benchmark/bench.ts",

73 "build": "napi build --platform --release",

74 "build:debug": "napi build --platform",

75 "docs": "typedoc --entryPoints index.d.ts --out docs --readme README.md --name '@simular-ai/simulang-js' --includeVersion",

76 "docs:mintlify": "typedoc --options typedoc.mintlify.json",

77 "format": "run-p format:prettier format:rs format:toml",

78 "format:prettier": "prettier . -w",

79 "format:toml": "taplo format",

80 "format:rs": "cargo fmt",

81 "lint": "oxlint .",

82 "postinstall": "node bin/postinstall-hint.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

83 "prepublishOnly": "napi prepublish -t npm $NAPI_PREPUBLISH_FLAGS",

84 "test": "vitest run",

85 "typecheck": "tsc --noEmit && tsc --noEmit -p __test__/tsconfig.json && tsc --noEmit -p benchmark/tsconfig.json && tsc --noEmit -p bin/tsconfig.json && tsc --noEmit -p examples/tsconfig.json",

86 "preversion": "napi build --platform && npm run typecheck && git add .",

87 "version": "napi version && node scripts/stamp-changelog.mjs",

88 "prepare": "husky"

89 },

90 "devDependencies": {

91 "@napi-rs/cli": "^3.7.2",

92 "@oxc-node/core": "^0.1.0",

93 "@taplo/cli": "^0.7.0",

94 "@types/node": "^26.0.1",

95 "husky": "^9.1.7",

96 "lint-staged": "^17.0.8",

97 "npm-run-all2": "^9.0.2",

98 "oxlint": "^1.72.0",

99 "prettier": "^3.9.4",

100 "tinybench": "^6.0.0",

101 "typedoc": "^0.28.19",

102 "typedoc-plugin-frontmatter": "^1.3.1",

wrapped.jsView file

Lines 1-38javascript

1// Re-export the napi bindings, but with a global pause hook woven into

2// every callable. Set the hook via `setPauseHook(fn)`; clear with `null`.

3// While set, the hook runs synchronously before every method or

4// free-function call delegates to the native binding — that lets

5// `@simular-ai/simulang-log-viewer` make its grab/pause state apply to

6// every simulang-js call transparently, without forcing user code to

7// switch import paths or add awaits.

8//

9// The package's `main` points here, so `import '@simular-ai/simulang-js'`

10// resolves to this wrapper. The napi-rs codegen still owns `index.js`

11// and `index.d.ts` verbatim — auto-doc and Claude-skill tooling that

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @simular-ai/simulang-js@9.0.0 matchedIdentity = npm:QHNpbXVsYXItYWkvc2ltdWxhbmctanM:9.0.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

wrapped.jsView file

18L19: module.exports = require('./index.js') L20: const binding = module.exports

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wrapped.jsView on unpkg · L18

index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Findings

2 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaindex.js

MediumDynamic Requirewrapped.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 62-102json

62 "constEnum": false

63 },

64 "engines": {

65 "node": ">= 20"

66 },

67 "publishConfig": {

68 "access": "public"

69 },

70 "scripts": {

71 "artifacts": "napi artifacts",

72 "bench": "node --import @oxc-node/core/register benchmark/bench.ts",

73 "build": "napi build --platform --release",

74 "build:debug": "napi build --platform",

75 "docs": "typedoc --entryPoints index.d.ts --out docs --readme README.md --name '@simular-ai/simulang-js' --includeVersion",

76 "docs:mintlify": "typedoc --options typedoc.mintlify.json",

77 "format": "run-p format:prettier format:rs format:toml",

78 "format:prettier": "prettier . -w",

79 "format:toml": "taplo format",

80 "format:rs": "cargo fmt",

81 "lint": "oxlint .",

82 "postinstall": "node bin/postinstall-hint.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

83 "prepublishOnly": "napi prepublish -t npm $NAPI_PREPUBLISH_FLAGS",

84 "test": "vitest run",

85 "typecheck": "tsc --noEmit && tsc --noEmit -p __test__/tsconfig.json && tsc --noEmit -p benchmark/tsconfig.json && tsc --noEmit -p bin/tsconfig.json && tsc --noEmit -p examples/tsconfig.json",

86 "preversion": "napi build --platform && npm run typecheck && git add .",

87 "version": "napi version && node scripts/stamp-changelog.mjs",

88 "prepare": "husky"

89 },

90 "devDependencies": {

91 "@napi-rs/cli": "^3.7.2",

92 "@oxc-node/core": "^0.1.0",

93 "@taplo/cli": "^0.7.0",

94 "@types/node": "^26.0.1",

95 "husky": "^9.1.7",

96 "lint-staged": "^17.0.8",

97 "npm-run-all2": "^9.0.2",

98 "oxlint": "^1.72.0",

99 "prettier": "^3.9.4",

100 "tinybench": "^6.0.0",

101 "typedoc": "^0.28.19",

102 "typedoc-plugin-frontmatter": "^1.3.1",

wrapped.jsView file

Lines 1-38javascript

1// Re-export the napi bindings, but with a global pause hook woven into

2// every callable. Set the hook via `setPauseHook(fn)`; clear with `null`.

3// While set, the hook runs synchronously before every method or

4// free-function call delegates to the native binding — that lets

5// `@simular-ai/simulang-log-viewer` make its grab/pause state apply to

6// every simulang-js call transparently, without forcing user code to

7// switch import paths or add awaits.

8//

9// The package's `main` points here, so `import '@simular-ai/simulang-js'`

10// resolves to this wrapper. The napi-rs codegen still owns `index.js`

11// and `index.d.ts` verbatim — auto-doc and Claude-skill tooling that

index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg