registry / @weave-framework/cli / 1.5.0

@weave-framework/cli@1.5.0

Weave CLI — `weave build`, `weave dev` (watch + live-reload), `weave check`, `weave routes`.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 131 KB of source

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 870-910javascript

870 "Intl",

871 "console",

872 "window",

873 "document",

874 "globalThis",

875 "parseInt",

876 "parseFloat",

877 "isNaN",

878 "isFinite",

879 "structuredClone",

880 "encodeURIComponent",

881 "decodeURIComponent",

882 "encodeURI",

883 "decodeURI",

884 "navigator",

885 "location",

886 "history",

887 "localStorage",

888 "sessionStorage",

889 "fetch",

890 "URL",

891 "URLSearchParams"

892]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L890

893function arrowParams(expr) {

894 const params = /* @__PURE__ */ new Set();

895 const ID = /^[A-Za-z_$][\w$]*$/;

896 let at = expr.indexOf("=>");

897 while (at !== -1) {

898 let k = at - 1;

899 while (k >= 0 && /\s/.test(expr[k])) k--;

900 if (expr[k] === ")") {

901 let depth = 1;

902 let m = k - 1;

903 for (; m >= 0; m--) {

904 if (expr[m] === ")") depth++;

905 else if (expr[m] === "(") {

906 depth--;

907 if (depth === 0) break;

908 }

909 }

910 for (const raw of expr.slice(m + 1, k).split(",")) {

Lines 2564-2604javascript

2564 if (quote) {

2565 if (c === "\\") {

2566 i++;

2567 continue;

2568 }

2569 if (c === quote) quote = "";

2570 continue;

2571

Lines 3881-3921javascript

3881 const roots = rest.filter((a) => !a.startsWith("-"));

3882 const diags = checkProject(roots.length ? roots : ["src"]);

3883 for (const d

•matchType = previous_version_dangerous_delta matchedPackage = @weave-framework/cli@1.0.12 matchedIdentity = npm:QHdlYXZlLWZyYW1ld29yay9jbGk:1.0.12 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

bin/weave.mjsView file

Lines 12-35javascript

12import { mkdirSync } from 'node:fs';

13import { dirname, join, resolve } from 'node:path';

14import { fileURLToPath, pathToFileURL } from 'node:url';

16const here = dirname(fileURLToPath(import.meta.url));

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

3901package = @weave-framework/cli; repositoryIdentity = weave; dependency = @weave-framework/mcp L3901: try { L3902: const mcp = await import("@weave-framework/mcp"); L3903: await mcp.runStdioServer();

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L3901

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

2584try { L2585: const ops = new Function(`return (${expr});`)(); L2586: if (!Array.isArray(ops)) throw new Error("not an array");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L2584

890"URL", L891: "URLSearchParams" L892: ]); ... L1718: for (let i = 0; i < input.length; i++) { L1719: h ^= input.charCodeAt(i); L1720: h = Math.imul(h, 16777619); ... L2584: try { L2585: const ops = new Function(`return (${expr});`)(); L2586: if (!Array.isArray(ops)) throw new Error("not an array"); ... L2876: request as httpRequest L2877: } from "node:http"; L2878: import { request as httpsRequest } from "node:https";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L890

bin/weave.mjsView file

32L33: const { main } = await import(pathToFileURL(out).href); L34: await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/weave.mjsView on unpkg · L32

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requirebin/weave.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowEvaldist/cli.js

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 870-910javascript

870 "Intl",

871 "console",

872 "window",

873 "document",

874 "globalThis",

875 "parseInt",

876 "parseFloat",

877 "isNaN",

878 "isFinite",

879 "structuredClone",

880 "encodeURIComponent",

881 "decodeURIComponent",

882 "encodeURI",

883 "decodeURI",

884 "navigator",

885 "location",

886 "history",

887 "localStorage",

888 "sessionStorage",

889 "fetch",

890 "URL",

891 "URLSearchParams"

892]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L890

893function arrowParams(expr) {

894 const params = /* @__PURE__ */ new Set();

895 const ID = /^[A-Za-z_$][\w$]*$/;

896 let at = expr.indexOf("=>");

897 while (at !== -1) {

898 let k = at - 1;

899 while (k >= 0 && /\s/.test(expr[k])) k--;

900 if (expr[k] === ")") {

901 let depth = 1;

902 let m = k - 1;

903 for (; m >= 0; m--) {

904 if (expr[m] === ")") depth++;

905 else if (expr[m] === "(") {

906 depth--;

907 if (depth === 0) break;

908 }

909 }

910 for (const raw of expr.slice(m + 1, k).split(",")) {

Lines 2564-2604javascript

2564 if (quote) {

2565 if (c === "\\") {

2566 i++;

2567 continue;

2568 }

2569 if (c === quote) quote = "";

2570 continue;

2571

Lines 3881-3921javascript

3881 const roots = rest.filter((a) => !a.startsWith("-"));

3882 const diags = checkProject(roots.length ? roots : ["src"]);

3883 for (const d

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

bin/weave.mjsView file

Lines 12-35javascript

12import { mkdirSync } from 'node:fs';

13import { dirname, join, resolve } from 'node:path';

14import { fileURLToPath, pathToFileURL } from 'node:url';

16const here = dirname(fileURLToPath(import.meta.url));