registry / algenta-sdk / 1.0.2

algenta-sdk@1.0.2

TypeScript and JavaScript SDK for Algenta's HTTP API, local runtime, simulations, governed data, and repository intelligence

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 583 KB of source, external domains: algenta.ai, api.algenta.ai, app.algenta.ai, docs.algenta.ai

Source & flagged code

1 flagged

dist/runtime_daemon_client.jsView file

Lines 137-177javascript

137}

138function normalizeListModulesResponse(response) {

139 if (typeof response !== "object" || response === null) {

140 throw invalidLibraryInventory("The local runtime returned a malformed Mojo library inventory.", { response });

141 }

142 const modules = response.modules;

143 if (modules == null) {

144 return [];

145 }

146 if (!Array.isArray(modules)) {

147 throw invalidLibraryInventory("The local runtime returned a malformed Mojo library inventory.", { modules });

148 }

149 return filterLibraryModules(modules);

150}

151async function loadRuntimeGrpc() {

152 if (!loadedRuntimeGrpcPromise) {

153 loadedRuntimeGrpcPromise = (async () => {

154 let grpc;

155 let protoLoader;

156 try {

157 [grpc, protoLoader] = await Promise.all([

158 import("@grpc/grpc-js"),

159 import("@grpc/proto-loader"),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/runtime_daemon_client.jsView on unpkg · L157

160 ]);

161 }

162 catch (error) {

163 throw new mojo_errors_js_1.MojoRuntimeConfigurationError("compute_runtime_unavailable", "The TypeScript gRPC runtime client is unavailable. Install the local runtime transport dependencies before using Mojo libraries.", { error: error instanceof Error ? error.message : String(error) });

164 }

165 const packageDefinition = await protoLoader.load(RUNTIME_PROTO_PATH, {

166 keepCase: true,

167 defaults: true,

168 enums: String,

169 oneofs: true,

170 });

171 const loaded = grpc.loadPackageDefinition(packageDefinition);

172 const Client = loaded.algenta?.runtime?.v1?.CodnaRuntime;

173 if (!Client) {

174 throw new mojo_errors_js_1.MojoRuntimeConfigurationError("compute_runtime_unavailable", "The Algenta runtime gRPC contract is unavailable.", { proto_path: RUNTIME_PROTO_PATH });

175 }

176 return { grpc, Client };

177 })();

Source & flagged code

1 flagged · loading source

dist/runtime_daemon_client.jsView file

157package = algenta-sdk; repositoryIdentity = algenta; dependency = @grpc/grpc-js L157: [grpc, protoLoader] = await Promise.all([ L158: import("@grpc/grpc-js"), L159: import("@grpc/proto-loader"),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/runtime_daemon_client.jsView on unpkg · L157

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/runtime_daemon_client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/runtime_daemon_client.jsView file

Lines 137-177javascript

137}

138function normalizeListModulesResponse(response) {

139 if (typeof response !== "object" || response === null) {

140 throw invalidLibraryInventory("The local runtime returned a malformed Mojo library inventory.", { response });

141 }

142 const modules = response.modules;

143 if (modules == null) {

144 return [];

145 }

146 if (!Array.isArray(modules)) {

147 throw invalidLibraryInventory("The local runtime returned a malformed Mojo library inventory.", { modules });

148 }

149 return filterLibraryModules(modules);

150}

151async function loadRuntimeGrpc() {

152 if (!loadedRuntimeGrpcPromise) {

153 loadedRuntimeGrpcPromise = (async () => {

154 let grpc;

155 let protoLoader;

156 try {

157 [grpc, protoLoader] = await Promise.all([

158 import("@grpc/grpc-js"),

159 import("@grpc/proto-loader"),

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/runtime_daemon_client.jsView on unpkg · L157

160 ]);

161 }

162 catch (error) {

164 }

165 const packageDefinition = await protoLoader.load(RUNTIME_PROTO_PATH, {

166 keepCase: true,

167 defaults: true,

168 enums: String,

169 oneofs: true,

170 });

171 const loaded = grpc.loadPackageDefinition(packageDefinition);

172 const Client = loaded.algenta?.runtime?.v1?.CodnaRuntime;

173 if (!Client) {

174 throw new mojo_errors_js_1.MojoRuntimeConfigurationError("compute_runtime_unavailable", "The Algenta runtime gRPC contract is unavailable.", { proto_path: RUNTIME_PROTO_PATH });

175 }

176 return { grpc, Client };

177 })();