registry / @substrate-ai/core / 0.20.142

@substrate-ai/core@0.20.142

Transport-agnostic primitives for the [Substrate](https://github.com/johnplanow/substrate) platform. This is the foundation package — adapters, dispatch, routing, persistence, telemetry, cost tracking, event bus, and supervisor analysis — kept free of SDL

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 123 file(s), 777 KB of source, external domains: docs.dolthub.com, git-scm.com, github.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/version-manager/version-manager-impl.jsView file

Lines 155-195javascript

155 breakingChanges: breaking

156 ? [`Major version bump from v${fromVersion} to v${targetVersion}`]

157 : [],

158 migrationSteps: [this.updateChecker.getChangelog(targetVersion)],

159 automaticMigrations: breaking ? ['Run defaultConfigMigrator.migrate() if config changed'] : [],

160 manualStepsRequired: breaking

161 ? ['Review breaking changes at the changelog URL above']

162 : [],

163 };

164 }

165 /**

166 * Migrate the project configuration from one format version to another.

167 * Delegates to the shared defaultConfigMigrator singleton.

168 * Loads the actual config from the project config file so migration functions receive real data.

169 */

170 migrateConfiguration(fromVersion, toVersion) {

171 let configObj = {};

172 try {

173 const _require = createRequire(import.meta.url);

174 const fs = _require('fs');

175 const path = _require('path');

176 const yaml = _require('js-yaml');

177 const configPath = path.join(process.cwd(), '.substrate', 'config.yaml');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/version-manager/version-manager-impl.jsView on unpkg · L175

178 try {

179 const raw = fs.readFileSync(configPath, 'utf-8');

180 configObj = yaml.load(raw) ?? {};

181 }

182 catch {

183 // No project config file — use empty object

184 configObj = {};

185 }

186 }

187 catch {

188 configObj = {};

189 }

190 const { result } = defaultConfigMigrator.migrate(configObj, fromVersion, toVersion);

191 return result;

192 }

193 /**

194 * Migrate a task graph file from one format version to another.

195 * Delegates to the shared defaultConfigMigrator singleton.

dist/adapters/claude-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @substrate-ai/core@0.20.139 matchedIdentity = npm:QHN1YnN0cmF0ZS1haS9jb3Jl:0.20.139 similarity = 0.963 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/claude-adapter.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/version-manager/version-manager-impl.jsView file

175package = @substrate-ai/core; repositoryIdentity = substrate; dependency = js-yaml L175: const path = _require('path'); L176: const yaml = _require('js-yaml'); L177: const configPath = path.join(process.cwd(), '.substrate', 'config.yaml');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/version-manager/version-manager-impl.jsView on unpkg · L175

dist/adapters/claude-adapter.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/claude-adapter.jsView on unpkg

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/version-manager/version-manager-impl.js

HighPrevious Version Dangerous Deltadist/adapters/claude-adapter.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/version-manager/version-manager-impl.jsView file

Lines 155-195javascript

155 breakingChanges: breaking

156 ? [`Major version bump from v${fromVersion} to v${targetVersion}`]

157 : [],

158 migrationSteps: [this.updateChecker.getChangelog(targetVersion)],

159 automaticMigrations: breaking ? ['Run defaultConfigMigrator.migrate() if config changed'] : [],

160 manualStepsRequired: breaking

161 ? ['Review breaking changes at the changelog URL above']

162 : [],

163 };

164 }

165 /**

166 * Migrate the project configuration from one format version to another.

167 * Delegates to the shared defaultConfigMigrator singleton.

168 * Loads the actual config from the project config file so migration functions receive real data.

169 */

170 migrateConfiguration(fromVersion, toVersion) {

171 let configObj = {};

172 try {

173 const _require = createRequire(import.meta.url);

174 const fs = _require('fs');

175 const path = _require('path');

176 const yaml = _require('js-yaml');

177 const configPath = path.join(process.cwd(), '.substrate', 'config.yaml');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/version-manager/version-manager-impl.jsView on unpkg · L175

178 try {

179 const raw = fs.readFileSync(configPath, 'utf-8');

180 configObj = yaml.load(raw) ?? {};

181 }

182 catch {

183 // No project config file — use empty object

184 configObj = {};

185 }

186 }

187 catch {

188 configObj = {};

189 }

190 const { result } = defaultConfigMigrator.migrate(configObj, fromVersion, toVersion);

191 return result;

192 }

193 /**

194 * Migrate a task graph file from one format version to another.

195 * Delegates to the shared defaultConfigMigrator singleton.

dist/adapters/claude-adapter.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/claude-adapter.jsView on unpkg