registry / @slexisvn/query-engine / 0.1.2

@slexisvn/query-engine@0.1.2

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 3 file(s), 1.37 MB of source

Source & flagged code

3 flagged

dist/index.cli.jsView file

Lines 276-316javascript

276 PhysicalStrategy2["NESTED_LOOP"] = "NESTED_LOOP";

277 PhysicalStrategy2["STREAM"] = "STREAM";

278 PhysicalStrategy2["UNGROUPED"] = "UNGROUPED";

279 PhysicalStrategy2["PERFECT_HASH"] = "PERFECT_HASH";

280 return PhysicalStrategy2;

281 })(PhysicalStrategy || {});

282 SortDirection = /* @__PURE__ */ ((SortDirection2) => {

283 SortDirection2["ASC"] = "ASC";

284 SortDirection2["DESC"] = "DESC";

285 return SortDirection2;

286 })(SortDirection || {});

287 NullOrder = /* @__PURE__ */ ((NullOrder2) => {

288 NullOrder2["FIRST"] = "FIRST";

289 NullOrder2["LAST"] = "LAST";

290 return NullOrder2;

291 })(NullOrder || {});

292 }

293});

294

295// src/cli/index.ts

296import path5 from "path";

297import { fork } from "child_process";

298import { availableParallelism } from "os";

High

Child Process

Package source references child process execution.

dist/index.cli.jsView on unpkg · L296

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cli.jsView on unpkg · L296

299import { fileURLToPath } from "url";

300import { Catalog, QueryEngine } from "./index.node.js";

301

302// src/cli/cli-common.ts

303import fs2 from "fs";

304import path4 from "path";

305

306// src/cli/loaders/loader-factory.ts

307import path3 from "path";

308

309// src/cli/loaders/csv-loader.ts

310import fs from "fs";

311import csv from "csv-parser";

312import path from "path";

313import { DataType, DEFAULT_CHUNK_SIZE, Table } from "./index.node.js";

314

315// src/cli/loaders/data-loader.ts

316var DataLoader = class {

dist/core.wasmView file

•path = dist/core.wasm kind = wasm_module sizeBytes = 10473 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core.wasmView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.cli.jsView file

296import path5 from "path"; L297: import { fork } from "child_process"; L298: import { availableParallelism } from "os";

High

Child Process

Package source references child process execution.

dist/index.cli.jsView on unpkg · L296

296Cross-file remote execution chain: dist/index.cli.js spawns dist/index.node.js; helper contains network access plus dynamic code execution. L296: import path5 from "path"; L297: import { fork } from "child_process"; L298: import { availableParallelism } from "os"; ... L348: if (/\.\.[/\\]/.test(filePath)) { L349: const cwd = process.cwd(); L350: if (!resolved.startsWith(cwd + path.sep) && resolved !== cwd) { ... L557: if (depth === 0 && objectStart !== -1) { L558: yield JSON.parse(buffer.substring(objectStart, i + 1)); L559: objectStart = -1; ... L653: input: process.stdin, L654: output: process.stdout, L655: prompt: coordinator ? "dist> " : "sql> "

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cli.jsView on unpkg · L296

dist/core.wasmView file

•path = dist/core.wasm kind = wasm_module sizeBytes = 10473 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core.wasmView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/index.cli.js

HighShell

HighCross File Remote Execution Contextdist/index.cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/core.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

3 flagged

dist/index.cli.jsView file

Lines 276-316javascript

276 PhysicalStrategy2["NESTED_LOOP"] = "NESTED_LOOP";

277 PhysicalStrategy2["STREAM"] = "STREAM";

278 PhysicalStrategy2["UNGROUPED"] = "UNGROUPED";

279 PhysicalStrategy2["PERFECT_HASH"] = "PERFECT_HASH";

280 return PhysicalStrategy2;

281 })(PhysicalStrategy || {});

282 SortDirection = /* @__PURE__ */ ((SortDirection2) => {

283 SortDirection2["ASC"] = "ASC";

284 SortDirection2["DESC"] = "DESC";

285 return SortDirection2;

286 })(SortDirection || {});

287 NullOrder = /* @__PURE__ */ ((NullOrder2) => {

288 NullOrder2["FIRST"] = "FIRST";

289 NullOrder2["LAST"] = "LAST";

290 return NullOrder2;

291 })(NullOrder || {});

292 }

293});

294

295// src/cli/index.ts

296import path5 from "path";

297import { fork } from "child_process";

298import { availableParallelism } from "os";

High

Child Process

Package source references child process execution.

dist/index.cli.jsView on unpkg · L296

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cli.jsView on unpkg · L296

299import { fileURLToPath } from "url";

300import { Catalog, QueryEngine } from "./index.node.js";

301

302// src/cli/cli-common.ts

303import fs2 from "fs";

304import path4 from "path";

305

306// src/cli/loaders/loader-factory.ts

307import path3 from "path";

308

309// src/cli/loaders/csv-loader.ts

310import fs from "fs";

311import csv from "csv-parser";

312import path from "path";

313import { DataType, DEFAULT_CHUNK_SIZE, Table } from "./index.node.js";

314

315// src/cli/loaders/data-loader.ts

316var DataLoader = class {

dist/core.wasmView file

•path = dist/core.wasm kind = wasm_module sizeBytes = 10473 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core.wasmView on unpkg