registry / auditx / 0.1.10

auditx@0.1.10

One command. Every vulnerability. AI-ready markdown report.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 79.1 KB of source, external domains: github.com, semgrep.dev, trivy.dev

Source & flagged code

4 flagged

dist/auditx.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/bin/auditx.ts

4import { program } from "commander";

5import ora2 from "ora";

6import chalk4 from "chalk";

7import { writeFileSync as writeFileSync2, readFileSync as readFileSync4 } from "fs";

8import { resolve } from "path";

9import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

11// src/detect.ts

12import { existsSync } from "fs";

13import { join } from "path";

14function detectStack(targetDir) {

15 const has = (file) => existsSync(join(targetDir, file));

16 const hasGit = has(".git");

17 return {

18 hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"),

19 hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

20 hasRust: has("Cargo.toml"),

21 hasGo: has("go.mod"),

22 hasDocker: has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml"),

23 hasGit,

24 // Treat any .git dir as having history. Gitleaks will scan it.

25 hasGitHistory: hasGit,

26 hasTerraform: has("main.tf") || has("terraform.tf") || // Check a couple of common subdirectory patterns

27 existsSync(join(targetDir, "infra", "main.tf")) || existsSync(join(targetDir, "terraform", "main.tf")),

28 hasTypeScript: has("tsconfig.json")

Lines 753-801javascript

753 "security/detect-non-literal-require": "warn",

754 "security/detect-non-literal-fs-filename": "warn",

755 "security/detect-unsafe-regex": "error",

756 "security/detect-buffer-noassert": "error",

757 "security/detect-child-process": "warn",

758 "security/detect-disable-mustache-escape": "error",

759

Source & flagged code

4 flagged · loading source

dist/auditx.jsView file

8import { resolve } from "path"; L9: import { execSync } from "child_process"; L10:

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

773import { randomUUID as randomUUID2 } from "crypto"; L774: var execAsync = promisify7(exec); L775: async function runJscpd(targetPath, stagedFiles) {

High

Shell

Package source references shell execution.

dist/auditx.jsView on unpkg · L773

781const targets = stagedFiles && stagedFiles.length > 0 ? stagedFiles.map((f) => `"${f}"`).join(" ") : `"${targetPath}"`; L782: await execAsync(`npx --yes jscpd ${targets} --reporters json --output "${tmpDir}" --silent`, { maxBuffer: 10 * 1024 * 1024 }); L783: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auditx.jsView on unpkg · L781

8import { resolve } from "path"; L9: import { execSync } from "child_process"; L10: ... L17: return { L18: hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"), L19: hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"), ... L50: import { existsSync as existsSync2, mkdirSync, createWriteStream, rmSync } from "fs"; L51: import https from "https"; L52: import * as tar from "tar"; ... L61: function getSemgrepEnv() { L62: const semgrepHome = join2(homedir(), ".auditx", "semgrep-home"); L63: if (!existsSync2(semgrepHome)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

Findings

3 High3 Medium5 Low

HighChild Processdist/auditx.js

HighShelldist/auditx.js

HighRuntime Package Installdist/auditx.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/auditx.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/auditx.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/bin/auditx.ts

4import { program } from "commander";

5import ora2 from "ora";

6import chalk4 from "chalk";

7import { writeFileSync as writeFileSync2, readFileSync as readFileSync4 } from "fs";

8import { resolve } from "path";

9import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

11// src/detect.ts

12import { existsSync } from "fs";

13import { join } from "path";

14function detectStack(targetDir) {

15 const has = (file) => existsSync(join(targetDir, file));

16 const hasGit = has(".git");

17 return {

18 hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"),

19 hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

20 hasRust: has("Cargo.toml"),

21 hasGo: has("go.mod"),

22 hasDocker: has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml"),

23 hasGit,

24 // Treat any .git dir as having history. Gitleaks will scan it.

25 hasGitHistory: hasGit,

26 hasTerraform: has("main.tf") || has("terraform.tf") || // Check a couple of common subdirectory patterns

27 existsSync(join(targetDir, "infra", "main.tf")) || existsSync(join(targetDir, "terraform", "main.tf")),

28 hasTypeScript: has("tsconfig.json")

Lines 753-801javascript

753 "security/detect-non-literal-require": "warn",

754 "security/detect-non-literal-fs-filename": "warn",

755 "security/detect-unsafe-regex": "error",

756 "security/detect-buffer-noassert": "error",

757 "security/detect-child-process": "warn",

758 "security/detect-disable-mustache-escape": "error",

759