registry / @soda-gql/tools / 0.15.0

@soda-gql/tools@0.15.0

Development tools for soda-gql: CLI, codegen, typegen, and formatter

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 744 KB of source, external domains: github.com

Source & flagged code

1 flagged

dist/formatter.mjsView file

Lines 81-121javascript

81 if (specifier.type === "ImportNamespaceSpecifier") {}

82 }

83 }

84 return gqlIdentifiers;

85};

87//#endregion

88//#region packages/tools/src/formatter/format.ts

89const require = createRequire(import.meta.url);

90let _graphqlModule;

91let _graphqlModuleError;

92const getGraphqlModule = () => {

93 if (_graphqlModuleError) {

94 return err({

95 type: "FormatError",

96 code: "MISSING_DEPENDENCY",

97 message: "The \"graphql\" package is required for soda-gql formatter. Install it with: bun add graphql"

98 });

99 }

100 if (!_graphqlModule) {

101 try {

102 _graphqlModule = require("graphql");

103 } catch (cause) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/formatter.mjsView on unpkg · L101

104 _graphqlModuleError = cause instanceof Error ? cause : new Error(String(cause));

105 return err({

106 type: "FormatError",

107 code: "MISSING_DEPENDENCY",

108 message: "The \"graphql\" package is required for soda-gql formatter. Install it with: bun add graphql",

109 cause

110 });

111 }

112 }

113 return ok(_graphqlModule);

114};

115const NEWLINE_INSERTION = "\n";

116/**

117* Simple recursive AST traversal

118*/

119const traverseNode = (node, context, gqlIdentifiers, onObjectExpression) => {

120 if (node.type === "CallExpression" && isGqlDefinitionCall(node, gqlIdentifiers)) {

121 context = {

Source & flagged code

1 flagged · loading source

dist/formatter.mjsView file

101package = @soda-gql/tools; repositoryIdentity = soda-gql; dependency = graphql L101: try { L102: _graphqlModule = require("graphql"); L103: } catch (cause) {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code