registry / @zzop/cli / 0.9.0

@zzop/cli@0.9.0

Config-driven CLI for the zzop multi-language SAST/architecture engine — write a zzop.config.jsonc, run `npx zzop`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 77.2 KB of source, external domains: github.com, json.schemastore.org

Source & flagged code

1 flagged

bin/zzop.jsView file

Lines 169-209javascript

169 return format;

170}

171

172// Emit warnings to stderr (prefixed, one per line) so they never pollute stdout — pretty or JSON.

173function emitWarnings(warnings) {

174 for (const w of warnings) {

175 process.stderr.write(`zzop: warning: ${w}\n`);

176 }

177}

178

179function runAnalyze(opts) {

180 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

181 const config = loadConfig(configPath);

182 const format = resolveFormat(opts, config);

183 // Surface unknown config keys (typos / cross-version drift) — ignored by the engine, but not silently.

184 emitWarnings(collectConfigWarnings(config));

185 const { method, request } = configToRequest(config);

186

187 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

188 let native;

189 try {

190 native = require('@zzop/native');

191 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L189

192 fail(

193 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

194 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

195 2

196 );

197 return;

198 }

199

200 let outputJson;

201 try {

202 outputJson = native[method](JSON.stringify(request));

203 } catch (err) {

204 fail(`Analysis failed: ${err && err.message}`, 2);

205 return;

206 }

207

208 let output;

209 try {

Source & flagged code

1 flagged · loading source

bin/zzop.jsView file

189package = @zzop/cli; repositoryIdentity = zzop; dependency = @zzop/native L189: try { L190: native = require('@zzop/native'); L191: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L189

Findings

1 High1 Medium4 Low

HighCopied Package Dependency Bridgebin/zzop.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

bin/zzop.jsView file

Lines 169-209javascript

169 return format;

170}

171

172// Emit warnings to stderr (prefixed, one per line) so they never pollute stdout — pretty or JSON.

173function emitWarnings(warnings) {

174 for (const w of warnings) {

175 process.stderr.write(`zzop: warning: ${w}\n`);

176 }

177}

178

179function runAnalyze(opts) {

180 const configPath = opts.config || DEFAULT_CONFIG_FILENAME;

181 const config = loadConfig(configPath);

182 const format = resolveFormat(opts, config);

183 // Surface unknown config keys (typos / cross-version drift) — ignored by the engine, but not silently.

184 emitWarnings(collectConfigWarnings(config));

185 const { method, request } = configToRequest(config);

186

187 // Load the native engine lazily so `zzop init` / `--help` work without the addon installed/built.

188 let native;

189 try {

190 native = require('@zzop/native');

191 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/zzop.jsView on unpkg · L189

192 fail(

193 `Failed to load the @zzop/native engine: ${err && err.message}\n` +

194 `Ensure @zzop/native is installed for this platform (it is a dependency of zzop).`,

195 2

196 );

197 return;

198 }

199

200 let outputJson;

201 try {

202 outputJson = native[method](JSON.stringify(request));

203 } catch (err) {

204 fail(`Analysis failed: ${err && err.message}`, 2);

205 return;

206 }

207

208 let output;

209 try {