registry / @zzop/cli / 0.2.0

@zzop/cli@0.2.0

Config-driven CLI for the zzop multi-language SAST/architecture engine — write a zzop.config.jsonc, run `npx zzop`.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 34.1 KB of source, external domains: github.com

Source & flagged code

1 flagged

bin/zzop.jsView file

Lines 123-163javascript

123 process.stdout.write(`Wrote ${path.relative(process.cwd(), target) || DEFAULT_CONFIG_FILENAME}\n`);

124 process.exit(0);

125}

126

127function resolveFormat(opts, config) {

128 const format = opts.format || config.format || 'pretty';

129 if (format !== 'pretty' && format !== 'json') {

130 throw new ConfigError(`Invalid format "${format}". Expected "pretty" or "json".`);

131 }

132 return format;

133}

134

135function runAnalyze(opts) {

136 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

137 const config = loadConfig(configPath);

138 const format = resolveFormat(opts, config);

139 const { method, request } = configToRequest(config);

140

141 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

142 let native;

143 try {

144 native = require('@zzop/native');

145 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L143

146 fail(

147 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

148 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

149 2

150 );

151 return;

152 }

153

154 let outputJson;

155 try {

156 outputJson = native[method](JSON.stringify(request));

157 } catch (err) {

158 fail(`Analysis failed: ${err && err.message}`, 2);

159 return;

160 }

161

162 let output;

163 try {

Source & flagged code

1 flagged · loading source

bin/zzop.jsView file

143package = @zzop/cli; repositoryIdentity = zzop; dependency = @zzop/native L143: try { L144: native = require('@zzop/native'); L145: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L143

Findings

1 High1 Medium3 Low

HighCopied Package Dependency Bridgebin/zzop.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

bin/zzop.jsView file

Lines 123-163javascript

123 process.stdout.write(`Wrote ${path.relative(process.cwd(), target) || DEFAULT_CONFIG_FILENAME}\n`);

124 process.exit(0);

125}

126

127function resolveFormat(opts, config) {

128 const format = opts.format || config.format || 'pretty';

129 if (format !== 'pretty' && format !== 'json') {

130 throw new ConfigError(`Invalid format "${format}". Expected "pretty" or "json".`);

131 }

132 return format;

133}

134

135function runAnalyze(opts) {

136 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

137 const config = loadConfig(configPath);

138 const format = resolveFormat(opts, config);

139 const { method, request } = configToRequest(config);

140

141 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

142 let native;

143 try {

144 native = require('@zzop/native');

145 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L143

146 fail(

147 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

148 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

149 2

150 );

151 return;

152 }

153

154 let outputJson;

155 try {

156 outputJson = native[method](JSON.stringify(request));

157 } catch (err) {

158 fail(`Analysis failed: ${err && err.message}`, 2);

159 return;

160 }

161

162 let output;

163 try {