registry / @two-tech-dev/pxml / 0.16.0

@two-tech-dev/pxml@0.16.0

XML DSL and compiler for AI-driven project building

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 18 file(s), 5.83 MB of source, external domains: api.example.com, reactflow.dev, reactjs.org, www.w3.org

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { XMLParser } from 'fast-xml-parser';

4import { PxmlParser, validateProject, PxmlManifest, PxmlCache, PxmlCodegen, PxmlRunner, getTestFilePath, FileWriter, DependencyGraph, runFixLoop, runBuildLoop, syncEditorSchema, addCatalogToVscodeSettings, createDefaultManifest, addPackageToManifest, installPackages, buildProjectContext } from '@two-tech-dev/pxml-core';

5import { execSync } from 'child_process';

6import * as fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

7import * as path from 'path';

8const colors = {

9 red: (text) => `\x1b[31m${text}\x1b[0m`,

10 green: (text) => `\x1b[32m${text}\x1b[0m`,

11 yellow: (text) => `\x1b[33m${text}\x1b[0m`,

12 blue: (text) => `\x1b[34m${text}\x1b[0m`,

13 magenta: (text) => `\x1b[35m${text}\x1b[0m`,

14 cyan: (text) => `\x1b[36m${text}\x1b[0m`,

15 bold: (text) => `\x1b[1m${text}\x1b[0m`

16};

17function resolveXsd(name) {

18 const distDir = path.dirname(new URL(import.meta.url).pathname);

19 return path.resolve(distDir, '..', name);

20}

21const program = new Command();

22program

23 .name('pxml')

24 .description('pxml compiler and build tool')

Lines 338-378javascript

338 const p = await codegen.generateCombinedTest(chunk, project.stack, writer, cwd, chunkIdx);

339 combinedTestPaths.push(p);

340 }

341 catch { }

342 }

343 }

344 if (compiledNodeIds.length > 0) {

345

Source & flagged code

2 flagged · loading source

dist/index.jsView file

4import { PxmlParser, validateProject, PxmlManifest, PxmlCache, PxmlCodegen, PxmlRunner, getTestFilePath, FileWriter, DependencyGraph, runFixLoop, runBuildLoop, syncEditorSchema, ad... L5: import { execSync } from 'child_process'; L6: import * as fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

358console.log(colors.cyan(colors.bold(`\nRunning tests...`))); L359: const testCmd = `npx vitest run ${testTarget}`; L360: let batchPassed = false; L361: try { L362: execSync(testCmd, { stdio: 'pipe', cwd }); L363: batchPassed = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L358

Findings

3 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { XMLParser } from 'fast-xml-parser';

5import { execSync } from 'child_process';

6import * as fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

7import * as path from 'path';

8const colors = {

9 red: (text) => `\x1b[31m${text}\x1b[0m`,

10 green: (text) => `\x1b[32m${text}\x1b[0m`,

11 yellow: (text) => `\x1b[33m${text}\x1b[0m`,

12 blue: (text) => `\x1b[34m${text}\x1b[0m`,

13 magenta: (text) => `\x1b[35m${text}\x1b[0m`,

14 cyan: (text) => `\x1b[36m${text}\x1b[0m`,

15 bold: (text) => `\x1b[1m${text}\x1b[0m`

16};

17function resolveXsd(name) {

18 const distDir = path.dirname(new URL(import.meta.url).pathname);

19 return path.resolve(distDir, '..', name);

20}

21const program = new Command();

22program

23 .name('pxml')

24 .description('pxml compiler and build tool')

Lines 338-378javascript

338 const p = await codegen.generateCombinedTest(chunk, project.stack, writer, cwd, chunkIdx);

339 combinedTestPaths.push(p);

340 }

341 catch { }

342 }

343 }

344 if (compiledNodeIds.length > 0) {

345