registry / @simular-ai/simulang-js / 9.0.0

@simular-ai/simulang-js@9.0.0

Node.js bindings for simulang-rs

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 86.8 KB of source, external domains: example.com, github.com, google.com, simular.ai, www.google.com

Source & flagged code

2 flagged

package.jsonView file

Lines 62-102json

62 "constEnum": false

63 },

64 "engines": {

65 "node": ">= 20"

66 },

67 "publishConfig": {

68 "access": "public"

69 },

70 "scripts": {

71 "artifacts": "napi artifacts",

72 "bench": "node --import @oxc-node/core/register benchmark/bench.ts",

73 "build": "napi build --platform --release",

74 "build:debug": "napi build --platform",

75 "docs": "typedoc --entryPoints index.d.ts --out docs --readme README.md --name '@simular-ai/simulang-js' --includeVersion",

76 "docs:mintlify": "typedoc --options typedoc.mintlify.json",

77 "format": "run-p format:prettier format:rs format:toml",

78 "format:prettier": "prettier . -w",

79 "format:toml": "taplo format",

80 "format:rs": "cargo fmt",

81 "lint": "oxlint .",

82 "postinstall": "node bin/postinstall-hint.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

83 "prepublishOnly": "napi prepublish -t npm $NAPI_PREPUBLISH_FLAGS",

84 "test": "vitest run",

85 "typecheck": "tsc --noEmit && tsc --noEmit -p __test__/tsconfig.json && tsc --noEmit -p benchmark/tsconfig.json && tsc --noEmit -p bin/tsconfig.json && tsc --noEmit -p examples/tsconfig.json",

86 "preversion": "napi build --platform && npm run typecheck && git add .",

87 "version": "napi version && node scripts/stamp-changelog.mjs",

88 "prepare": "husky"

89 },

90 "devDependencies": {

91 "@napi-rs/cli": "^3.7.2",

92 "@oxc-node/core": "^0.1.0",

93 "@taplo/cli": "^0.7.0",

94 "@types/node": "^26.0.0",

95 "husky": "^9.1.7",

96 "lint-staged": "^17.0.8",

97 "npm-run-all2": "^9.0.2",

98 "oxlint": "^1.70.0",

99 "prettier": "^3.8.4",

100 "tinybench": "^6.0.0",

101 "typedoc": "^0.28.19",

102 "typedoc-plugin-frontmatter": "^1.3.1",

wrapped.jsView file

Lines 1-38javascript

1// Re-export the napi bindings, but with a global pause hook woven into

2// every callable. Set the hook via `setPauseHook(fn)`; clear with `null`.

3// While set, the hook runs synchronously before every method or

4// free-function call delegates to the native binding — that lets

5// `@simular-ai/simulang-log-viewer` make its grab/pause state apply to

6// every simulang-js call transparently, without forcing user code to

7// switch import paths or add awaits.

8//

9// The package's `main` points here, so `import '@simular-ai/simulang-js'`

10// resolves to this wrapper. The napi-rs codegen still owns `index.js`

11// and `index.d.ts` verbatim — auto-doc and Claude-skill tooling that

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

wrapped.jsView file

18L19: module.exports = require('./index.js') L20: const binding = module.exports

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wrapped.jsView on unpkg · L18

Findings

1 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requirewrapped.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

package.jsonView file

Lines 62-102json

62 "constEnum": false

63 },

64 "engines": {

65 "node": ">= 20"

66 },

67 "publishConfig": {

68 "access": "public"

69 },

70 "scripts": {

71 "artifacts": "napi artifacts",

72 "bench": "node --import @oxc-node/core/register benchmark/bench.ts",

73 "build": "napi build --platform --release",

74 "build:debug": "napi build --platform",

75 "docs": "typedoc --entryPoints index.d.ts --out docs --readme README.md --name '@simular-ai/simulang-js' --includeVersion",

76 "docs:mintlify": "typedoc --options typedoc.mintlify.json",

77 "format": "run-p format:prettier format:rs format:toml",

78 "format:prettier": "prettier . -w",

79 "format:toml": "taplo format",

80 "format:rs": "cargo fmt",

81 "lint": "oxlint .",

82 "postinstall": "node bin/postinstall-hint.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

83 "prepublishOnly": "napi prepublish -t npm $NAPI_PREPUBLISH_FLAGS",

84 "test": "vitest run",

85 "typecheck": "tsc --noEmit && tsc --noEmit -p __test__/tsconfig.json && tsc --noEmit -p benchmark/tsconfig.json && tsc --noEmit -p bin/tsconfig.json && tsc --noEmit -p examples/tsconfig.json",

86 "preversion": "napi build --platform && npm run typecheck && git add .",

87 "version": "napi version && node scripts/stamp-changelog.mjs",

88 "prepare": "husky"

89 },

90 "devDependencies": {

91 "@napi-rs/cli": "^3.7.2",

92 "@oxc-node/core": "^0.1.0",

93 "@taplo/cli": "^0.7.0",

94 "@types/node": "^26.0.0",

95 "husky": "^9.1.7",

96 "lint-staged": "^17.0.8",

97 "npm-run-all2": "^9.0.2",

98 "oxlint": "^1.70.0",

99 "prettier": "^3.8.4",

100 "tinybench": "^6.0.0",

101 "typedoc": "^0.28.19",

102 "typedoc-plugin-frontmatter": "^1.3.1",

wrapped.jsView file

Lines 1-38javascript

1// Re-export the napi bindings, but with a global pause hook woven into

2// every callable. Set the hook via `setPauseHook(fn)`; clear with `null`.

3// While set, the hook runs synchronously before every method or

4// free-function call delegates to the native binding — that lets

5// `@simular-ai/simulang-log-viewer` make its grab/pause state apply to

6// every simulang-js call transparently, without forcing user code to

7// switch import paths or add awaits.

8//

9// The package's `main` points here, so `import '@simular-ai/simulang-js'`

10// resolves to this wrapper. The napi-rs codegen still owns `index.js`

11// and `index.d.ts` verbatim — auto-doc and Claude-skill tooling that