registry / @zzop/cli / 0.1.0

@zzop/cli@0.1.0

Config-driven CLI for the zzop multi-language SAST/architecture engine — write a zzop.config.jsonc, run `npx zzop`.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 30.0 KB of source, external domains: github.com

Source & flagged code

2 flagged

bin/zzop.jsView file

Lines 91-131javascript

91 process.stdout.write(`Wrote ${path.relative(process.cwd(), target) || DEFAULT_CONFIG_FILENAME}\n`);

92 process.exit(0);

93}

95function resolveFormat(opts, config) {

96 const format = opts.format || config.format || 'pretty';

97 if (format !== 'pretty' && format !== 'json') {

98 throw new ConfigError(`Invalid format "${format}". Expected "pretty" or "json".`);

99 }

100 return format;

101}

102

103function runAnalyze(opts) {

104 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

105 const config = loadConfig(configPath);

106 const format = resolveFormat(opts, config);

107 const { method, request } = configToRequest(config);

108

109 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

110 let native;

111 try {

112 native = require('@zzop/native');

113 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L111

114 fail(

115 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

116 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

117 2

118 );

119 return;

120 }

121

122 let outputJson;

123 try {

124 outputJson = native[method](JSON.stringify(request));

125 } catch (err) {

126 fail(`Analysis failed: ${err && err.message}`, 2);

127 return;

128 }

129

130 let output;

131 try {

•matchType = previous_version_dangerous_delta matchedPackage = @zzop/cli@0.2.0 matchedIdentity = npm:QHp6b3AvY2xp:0.2.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/zzop.jsView on unpkg

Source & flagged code

2 flagged · loading source

bin/zzop.jsView file

111package = @zzop/cli; repositoryIdentity = zzop; dependency = @zzop/native L111: try { L112: native = require('@zzop/native'); L113: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L111

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/zzop.jsView on unpkg

Findings

2 High1 Medium3 Low

HighCopied Package Dependency Bridgebin/zzop.js

HighPrevious Version Dangerous Deltabin/zzop.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

bin/zzop.jsView file

Lines 91-131javascript

91 process.stdout.write(`Wrote ${path.relative(process.cwd(), target) || DEFAULT_CONFIG_FILENAME}\n`);

92 process.exit(0);

93}

95function resolveFormat(opts, config) {

96 const format = opts.format || config.format || 'pretty';

97 if (format !== 'pretty' && format !== 'json') {

98 throw new ConfigError(`Invalid format "${format}". Expected "pretty" or "json".`);

99 }

100 return format;

101}

102

103function runAnalyze(opts) {

104 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

105 const config = loadConfig(configPath);

106 const format = resolveFormat(opts, config);

107 const { method, request } = configToRequest(config);

108

109 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

110 let native;

111 try {

112 native = require('@zzop/native');

113 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L111

114 fail(

115 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

116 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

117 2

118 );

119 return;

120 }

121

122 let outputJson;

123 try {

124 outputJson = native[method](JSON.stringify(request));

125 } catch (err) {

126 fail(`Analysis failed: ${err && err.message}`, 2);

127 return;

128 }

129

130 let output;

131 try {

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/zzop.jsView on unpkg