Loading npm security reports…

@weave-framework/cli@1.6.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @weave-framework/cli / 1.6.0

@weave-framework/cli@1.6.0

Weave CLI — `weave build`, `weave dev` (watch + live-reload), `weave check`, `weave routes`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 202 KB of source

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 979-1019javascript

979 "Intl",

980 "console",

981 "window",

982 "document",

983 "globalThis",

984 "parseInt",

985 "parseFloat",

986 "isNaN",

987 "isFinite",

988 "structuredClone",

989 "encodeURIComponent",

990 "decodeURIComponent",

991 "encodeURI",

992 "decodeURI",

993 "navigator",

994 "location",

995 "history",

996 "localStorage",

997 "sessionStorage",

998 "fetch",

999 "URL",

1000 "URLSearchParams",

1001 // timers / scheduling

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L999

1002 "setTimeout",

1003 "clearTimeout",

1004 "setInterval",

1005 "clearInterval",

1006 "requestAnimationFrame",

1007 "cancelAnimationFrame",

1008 "queueMicrotask",

1009 // common DOM globals a handler may call inline

1010 "alert",

1011 "confirm",

1012 "prompt",

1013 "performance",

1014 "crypto",

1015 "Event",

1016 "CustomEvent",

1017 "AbortController",

1018 "FormData",

1019 "Blob",

Lines 4555-4595javascript

4555 if (quote) {

4556 if (c === "\\") {

4557 i++;

4558 continue;

4559 }

4560 if (c === quote) quote =

Lines 6072-6112javascript

6072 const roots = rest.filter((a) => !a.startsWith("-"));

6073 const diags = checkProject(roots.length ?

•matchType = previous_version_dangerous_delta matchedPackage = @weave-framework/cli@1.5.28 matchedIdentity = npm:QHdlYXZlLWZyYW1ld29yay9jbGk:1.5.28 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

bin/weave.mjsView file

Lines 12-35javascript

12import { mkdirSync } from 'node:fs';

13import { dirname, join, resolve } from 'node:path';

14import { fileURLToPath, pathToFileURL } from 'node:url';

16const here =

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

6092package = @weave-framework/cli; repositoryIdentity = weave; dependency = @weave-framework/mcp L6092: try { L6093: const mcp = await import("@weave-framework/mcp"); L6094: await mcp.runStdioServer();

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code