registry / ata-validator / 1.0.1

ata-validator@1.0.1

JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 384 KB of source, external domains: ata-validator.com, json-schema.org

Source & flagged code

4 flagged

package.jsonView file

Lines 24-64json

24 "types": "./build.d.ts",

25 "import": "./build.mjs",

26 "require": "./build.js"

27 },

28 "./t": {

29 "types": "./t.d.ts",

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

265try { L266: return new Function('d', lines.join('\n')); L267: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L265

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView file

•path = prebuilds/ata-linux-arm64-musl/node-napi-v10.node kind = native_binary sizeBytes = 1247656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/ata-linux-arm64-musl/node-napi-v10.nodeView on unpkg

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binaryprebuilds/ata-linux-arm64-musl/node-napi-v10.node

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

index.jsView file

Lines 245-285javascript

245 lines.push(`if(d[${k}]==='false'||d[${k}]==='0')d[${k}]=false`);

246 } else if (t === 'array' && options.coerceTypes === 'array') {

247 lines.push(`if(${k} in d&&d[${k}]!==undefined&&!Array.isArray(d[${k}]))d[${k}]=[d[${k}]]`);

248 }

249 }

250 }

251

252 // defaults: inline per property

253 for (const [key, prop] of Object.entries(props)) {

254 if (prop && typeof prop === 'object' && prop.default !== undefined) {

255 const k = JSON.stringify(key);

256 const def = JSON.stringify(prop.default);

257 lines.push(`if(!(${k} in d))d[${k}]=${def}`);

258 }

259 }

260

261 if (lines.length === 0) return null;

262 // Data may legitimately be null or a non-object (e.g. a `['object','null']`

263 // schema), so the per-property mutations must not run on it.

264 lines.unshift(`if(d===null||typeof d!=='object')return`);

265 try {

266 return new Function('d', lines.join('\n'));

267 } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L265

268 return null;

269 }

270}

271

272// Schema compilation cache: same schema string -> reuse compiled functions

273const _compileCache = new Map();

274

275// Object identity cache: same schema object reference -> reuse entire compiled state

276// Skips JSON.stringify, cache lookup, and all setup. Near-zero cost for repeated schemas.

277const _identityCache = new WeakMap();

278

279const SIMDJSON_PADDING = 64;

280const VALID_RESULT = Object.freeze({ valid: true, errors: Object.freeze([]) });

281const ABORT_EARLY_RESULT = Object.freeze({

282 valid: false,

283 errors: Object.freeze([Object.freeze({

284 code: 'ATA9000',

285 message: 'validation failed',