registry / @two-tech-dev/pxml / 0.6.2

@two-tech-dev/pxml@0.6.2

XML DSL and compiler for AI-driven project building

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 45 file(s), 298 KB of source, external domains: api.openai.com, github.com, www.w3.org

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/diagnostics.test.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const vitest_1 = require("vitest");

4const index_ts_1 = require("../src/diagnostics/index.ts");

Medium

Dynamic Require

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

Source & flagged code

3 flagged · loading source

dist/install/index.jsView file

2import * as path from 'path'; L3: import { execSync } from 'child_process'; L4: import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

dist/diagnostics.test.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const vitest_1 = require("vitest"); L4: const index_ts_1 = require("../src/diagnostics/index.ts");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/diagnostics.test.jsView on unpkg · L2

dist/validator/index.jsView file

26const localTsc = path.join(cwd, 'node_modules', '.bin', 'tsc'); L27: const tscBin = fs.existsSync(localTsc) ? `"${localTsc}"` : 'npx tsc'; L28: cmd = `${tscBin} --noEmit`; ... L31: try { L32: execSync(cmd, { cwd, stdio: 'pipe' }); L33: return { ok: true, errors: '', raw: '' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/validator/index.jsView on unpkg · L26

Findings

3 High4 Medium5 Low

HighChild Processdist/install/index.js

HighShell

HighRuntime Package Installdist/validator/index.js

MediumDynamic Requiredist/diagnostics.test.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/diagnostics.test.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const vitest_1 = require("vitest");

4const index_ts_1 = require("../src/diagnostics/index.ts");

Medium

Dynamic Require

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);