registry / @witchynibbles/archon / 0.2.0

@witchynibbles/archon@0.2.0

Opt-in overlay for archon's shared-core orchestration.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 188 file(s), 1.78 MB of source, external domains: api.openai.com, api.voyageai.com, claude.ai, www.w3.org

Source & flagged code

5 flagged

scripts/setup-archon.shView file

Lines 397-437shell

397

398ensure_native_pgvector_available() {

399 local available

400 available="$(run_as_postgres psql -Atqc "select 1 from pg_available_extensions where name = 'vector'" postgres 2>/dev/null || true)"

401 if [[ "$available" == "1" ]]; then

402 return

403 fi

404

405 apt_available || fail "native runtime mode requires pgvector to be installed for PostgreSQL"

406 local package_name

407 package_name="$(apt_search_first_package 'pgvector')"

408 [[ -n "$package_name" ]] || fail "native runtime mode could not find a pgvector package; install pgvector locally before rerunning setup"

409 run_privileged apt-get update

410 run_privileged apt-get install -y "$package_name"

411}

412

413ensure_native_postgres_database() {

414 local escaped_user escaped_db escaped_password role_exists db_exists

415 escaped_user="$(sql_escape_literal "${ARCHON_POSTGRES_USER:-archon}")"

416 escaped_db="$(sql_escape_literal "${ARCHON_POSTGRES_DB:-archon}")"

417 escaped_password="$(sql_escape_literal "${ARCHON_POSTGRES_PASSWORD}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/setup-archon.shView on unpkg · L417

418

419 role_exists="$(run_as_postgres psql -Atqc "select 1 from pg_roles where rolname = '${escaped_user}'" postgres 2>/dev/null || true)"

420 if [[ "$role_exists" != "1" ]]; then

421 # Pipe SQL via stdin so the password does not appear in ps aux process arguments.

422 printf "CREATE ROLE \"%s\" WITH LOGIN PASSWORD '%s';\n" \

423 "${ARCHON_POSTGRES_USER:-archon}" "${escaped_password}" \

424 | run_as_postgres psql -v ON_ERROR_STOP=1 postgres

425 else

426 printf "ALTER ROLE \"%s\" WITH LOGIN PASSWORD '%s';\n" \

427 "${ARCHON_POSTGRES_USER:-archon}" "${escaped_password}" \

428 | run_as_postgres psql -v ON_ERROR_STOP=1 postgres

429 fi

430

431 db_exists="$(run_as_postgres psql -Atqc "select 1 from pg_database where datname = '${escaped_db}'" postgres 2>/dev/null || true)"

432 if [[ "$db_exists" != "1" ]]; then

433 run_as_postgres psql -v ON_ERROR_STOP=1 -c "create database \"${ARCHON_POSTGRES_DB:-archon}\" owner \"${ARCHON_POSTGRES_USER:-archon}\"" postgres

434 fi

435

436 run_as_postgres psql -v ON_ERROR_STOP=1 -d "${ARCHON_POSTGRES_DB:-archon}" -c "create extension if not exists vector"

437}

•path = scripts/setup-archon.sh kind = build_helper sizeBytes = 14995 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-archon.shView on unpkg

dist/review.jsView file

Lines 35-75javascript

35 return {

36 provider: String(candidate.provider ?? ""),

37 subject: String(candidate.subject ?? ""),

38 verified: candidate.verified === true

39 };

40 };

41}

42async

dist/runtime/repo-markdown-indexer.jsView file

Lines 163-203javascript

163 }

164 }

165 return results;

166}

167function buildArtifactsForFile(input) {

168 const artifacts = [];

169 input.sections.forEach((section, sectionIndex)

dist/runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @witchynibbles/archon@0.1.0 matchedIdentity = npm:QHdpdGNoeW5pYmJsZXMvYXJjaG9u:0.1.0 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime.jsView on unpkg

Source & flagged code

5 flagged · loading source

scripts/setup-archon.shView file

417patternName = generic_password severity = medium line = 417 matchedText = escaped_...}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/setup-archon.shView on unpkg · L417

•path = scripts/setup-archon.sh kind = build_helper sizeBytes = 14995 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-archon.shView on unpkg

dist/review.jsView file

55const resolvedPath = path.isAbsolute(adapterModulePath) ? adapterModulePath : path.resolve(cwd, adapterModulePath); L56: const adapterModule = await import(pathToFileURL(resolvedPath).href); L57: const availableBackends = adapterModule.reviewIdentityAdapters && typeof adapterModule.reviewIdentityAdapters === "object" && !Array.isArray(adapterModule.reviewIdentityAdapters) ?...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/review.jsView on unpkg · L55

dist/runtime/repo-markdown-indexer.jsView file

183sourceAnchor: section.sourceAnchor, L184: metadata: buildArtifactMetadata(input.relativePath, chunkIndex), L185: createdAt: (/* @__PURE__ */ new Date()).toISOString()

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/repo-markdown-indexer.jsView on unpkg · L183

dist/runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime.jsView on unpkg

Findings

1 High6 Medium6 Low

HighPrevious Version Dangerous Deltadist/runtime.js

MediumSecret Patternscripts/setup-archon.sh

MediumDynamic Requiredist/review.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/setup-archon.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/runtime/repo-markdown-indexer.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

scripts/setup-archon.shView file

Lines 397-437shell

397

398ensure_native_pgvector_available() {

399 local available

400 available="$(run_as_postgres psql -Atqc "select 1 from pg_available_extensions where name = 'vector'" postgres 2>/dev/null || true)"

401 if [[ "$available" == "1" ]]; then

402 return

403 fi

404

405 apt_available || fail "native runtime mode requires pgvector to be installed for PostgreSQL"

406 local package_name

407 package_name="$(apt_search_first_package 'pgvector')"

408 [[ -n "$package_name" ]] || fail "native runtime mode could not find a pgvector package; install pgvector locally before rerunning setup"

409 run_privileged apt-get update

410 run_privileged apt-get install -y "$package_name"

411}

412

413ensure_native_postgres_database() {

414 local escaped_user escaped_db escaped_password role_exists db_exists

415 escaped_user="$(sql_escape_literal "${ARCHON_POSTGRES_USER:-archon}")"

416 escaped_db="$(sql_escape_literal "${ARCHON_POSTGRES_DB:-archon}")"

417 escaped_password="$(sql_escape_literal "${ARCHON_POSTGRES_PASSWORD}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/setup-archon.shView on unpkg · L417

418

419 role_exists="$(run_as_postgres psql -Atqc "select 1 from pg_roles where rolname = '${escaped_user}'" postgres 2>/dev/null || true)"

420 if [[ "$role_exists" != "1" ]]; then

421 # Pipe SQL via stdin so the password does not appear in ps aux process arguments.

422 printf "CREATE ROLE \"%s\" WITH LOGIN PASSWORD '%s';\n" \

423 "${ARCHON_POSTGRES_USER:-archon}" "${escaped_password}" \

424 | run_as_postgres psql -v ON_ERROR_STOP=1 postgres

425 else

426 printf "ALTER ROLE \"%s\" WITH LOGIN PASSWORD '%s';\n" \

427 "${ARCHON_POSTGRES_USER:-archon}" "${escaped_password}" \

428 | run_as_postgres psql -v ON_ERROR_STOP=1 postgres

429 fi

430

431 db_exists="$(run_as_postgres psql -Atqc "select 1 from pg_database where datname = '${escaped_db}'" postgres 2>/dev/null || true)"

432 if [[ "$db_exists" != "1" ]]; then

433 run_as_postgres psql -v ON_ERROR_STOP=1 -c "create database \"${ARCHON_POSTGRES_DB:-archon}\" owner \"${ARCHON_POSTGRES_USER:-archon}\"" postgres

434 fi

435

436 run_as_postgres psql -v ON_ERROR_STOP=1 -d "${ARCHON_POSTGRES_DB:-archon}" -c "create extension if not exists vector"

437}

•path = scripts/setup-archon.sh kind = build_helper sizeBytes = 14995 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-archon.shView on unpkg

dist/review.jsView file

Lines 35-75javascript

35 return {

36 provider: String(candidate.provider ?? ""),

37 subject: String(candidate.subject ?? ""),

38 verified: candidate.verified === true

39 };

40 };

41}

42async

dist/runtime/repo-markdown-indexer.jsView file

Lines 163-203javascript

163 }

164 }

165 return results;

166}

167function buildArtifactsForFile(input) {

168 const artifacts = [];

169 input.sections.forEach((section, sectionIndex)

dist/runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime.jsView on unpkg