registry / @weave-framework/cli / 0.2.162

@weave-framework/cli@0.2.162

Weave CLI — `weave build`, `weave dev` (watch + live-reload), `weave check`, `weave routes`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 113 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

bin/weave.mjsView file

Lines 12-35javascript

12import { mkdirSync } from 'node:fs';

13import { dirname, join, resolve } from 'node:path';

14import { fileURLToPath, pathToFileURL } from 'node:url';

16const here = dirname(fileURLToPath(import.meta.url));

17const cacheDir = join(resolve(here, '../../..'), 'node_modules', '.weave');

18mkdirSync(cacheDir, { recursive: true });

19const out = join(cacheDir, 'cli.mjs');

21await esbuild({

22 entryPoints: [join(here, '../src/cli.ts')],

23 bundle: true,

24 format: 'esm',

25 platform: 'node',

26 // NB: @weave-framework/mcp stays INLINED in the dev bin (unlike the prod build, which

27 // externalizes it) — the dev bundle runs from node_modules/.weave/, whose module

28 // resolution can't reach the workspace-linked package, so we bundle it in.

29 external: ['esbuild', 'typescript', 'sass'],

30 outfile: out,

31});

33const { main } = await import(pathToFileURL(out).href);

34await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/weave.mjsView on unpkg · L32

dist/cli.jsView file

Lines 3386-3426javascript

3386 const roots = rest.filter((a) => !a.startsWith("-"));

3387 const diags = checkProject(roots.length ? roots : ["src"]);

3388

Source & flagged code

3 flagged · loading source

bin/weave.mjsView file

32L33: const { main } = await import(pathToFileURL(out).href); L34: await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/weave.mjsView on unpkg · L32

dist/cli.jsView file

3406package = @weave-framework/cli; repositoryIdentity = weave; dependency = @weave-framework/mcp L3406: try { L3407: const mcp = await import("@weave-framework/mcp"); L3408: await mcp.runStdioServer();

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L3406

•matchType = previous_version_dangerous_delta matchedPackage = @weave-framework/cli@0.2.107 matchedIdentity = npm:QHdlYXZlLWZyYW1ld29yay9jbGk:0.2.107 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 High3 Medium3 Low

HighCopied Package Dependency Bridgedist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requirebin/weave.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/weave.mjsView file

Lines 12-35javascript

12import { mkdirSync } from 'node:fs';

13import { dirname, join, resolve } from 'node:path';

14import { fileURLToPath, pathToFileURL } from 'node:url';

16const here = dirname(fileURLToPath(import.meta.url));

17const cacheDir = join(resolve(here, '../../..'), 'node_modules', '.weave');

18mkdirSync(cacheDir, { recursive: true });

19const out = join(cacheDir, 'cli.mjs');

21await esbuild({

22 entryPoints: [join(here, '../src/cli.ts')],

23 bundle: true,

24 format: 'esm',

25 platform: 'node',

26 // NB: @weave-framework/mcp stays INLINED in the dev bin (unlike the prod build, which

27 // externalizes it) — the dev bundle runs from node_modules/.weave/, whose module

28 // resolution can't reach the workspace-linked package, so we bundle it in.

29 external: ['esbuild', 'typescript', 'sass'],

30 outfile: out,

31});

33const { main } = await import(pathToFileURL(out).href);

34await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/weave.mjsView on unpkg · L32

dist/cli.jsView file

Lines 3386-3426javascript

3386 const roots = rest.filter((a) => !a.startsWith("-"));

3387 const diags = checkProject(roots.length ? roots : ["src"]);

3388