registry / @two-tech-dev/pxml-core / 0.9.0

@two-tech-dev/pxml-core@0.9.0

pxml core library — parser, codegen, runner, and all compilation logic

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 225 KB of source, external domains: api.openai.com, github.com, www.w3.org

Source & flagged code

2 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

Source & flagged code

2 flagged · loading source

dist/install/index.jsView file

2import * as path from 'path'; L3: import { execSync } from 'child_process'; L4: import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

dist/validator/index.jsView file

26const localTsc = path.join(cwd, 'node_modules', '.bin', 'tsc'); L27: const tscBin = fs.existsSync(localTsc) ? `"${localTsc}"` : 'npx tsc'; L28: cmd = `${tscBin} --noEmit`; ... L31: try { L32: execSync(cmd, { cwd, stdio: 'pipe' }); L33: return { ok: true, errors: '', raw: '' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/validator/index.jsView on unpkg · L26

Findings

3 High3 Medium5 Low

HighChild Processdist/install/index.js

HighShell

HighRuntime Package Installdist/validator/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);