registry  /  @weave-framework/cli  /  1.5.28

@weave-framework/cli@1.5.28

Weave CLI — `weave build`, `weave dev` (watch + live-reload), `weave check`, `weave routes`.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEvalFilesystemNetwork
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 142 KB of source

Source & flagged code

4 flagged · loading source
dist/cli.jsView file
4310package = @weave-framework/cli; repositoryIdentity = weave; dependency = @weave-framework/mcp L4310: try { L4311: const mcp = await import("@weave-framework/mcp"); L4312: await mcp.runStdioServer();
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L4310
2968try { L2969: const ops = new Function(`return (${expr});`)(); L2970: if (!Array.isArray(ops)) throw new Error("not an array");
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L2968
939"URL", L940: "URLSearchParams", L941: // timers / scheduling ... L1795: for (let i = 0; i < input.length; i++) { L1796: h ^= input.charCodeAt(i); L1797: h = Math.imul(h, 16777619); ... L2968: try { L2969: const ops = new Function(`return (${expr});`)(); L2970: if (!Array.isArray(ops)) throw new Error("not an array"); ... L3260: request as httpRequest L3261: } from "node:http"; L3262: import { request as httpsRequest } from "node:https";
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L939
bin/weave.mjsView file
32L33: const { main } = await import(pathToFileURL(out).href); L34: await main(process.argv.slice(2));
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/weave.mjsView on unpkg · L32

Findings

1 High3 Medium4 Low
HighCopied Package Dependency Bridgedist/cli.js
MediumDynamic Requirebin/weave.mjs
MediumNetwork
MediumStructural Risk Force Deep Review
LowEvaldist/cli.js
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings