registry  /  @two-tech-dev/pxml  /  0.3.0

@two-tech-dev/pxml@0.3.0

XML DSL and compiler for AI-driven project building

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 39 file(s), 232 KB of source, external domains: api.openai.com, github.com, www.w3.org

Source & flagged code

3 flagged · loading source
dist/runner/index.jsView file
1import { execSync } from 'child_process'; L2: import * as fs from 'fs';
High
Child Process

Package source references child process execution.

dist/runner/index.jsView on unpkg · L1
dist/diagnostics.test.jsView file
2Object.defineProperty(exports, "__esModule", { value: true }); L3: const vitest_1 = require("vitest"); L4: const index_ts_1 = require("../src/diagnostics/index.ts");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/diagnostics.test.jsView on unpkg · L2
src/parser.test.tsView file
231const cliPath = path.resolve(__dirname, '../src/cli/index.ts'); L232: execSync(`npx tsx "${cliPath}" migrate`, { cwd: tempDir, stdio: 'inherit' }); L233:
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

src/parser.test.tsView on unpkg · L231

Findings

3 High4 Medium5 Low
HighChild Processdist/runner/index.js
HighShell
HighRuntime Package Installsrc/parser.test.ts
MediumDynamic Requiredist/diagnostics.test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License