registry / auditx / 0.1.22

auditx@0.1.22

One command. Every vulnerability, dead code, and AI-generated code anti-pattern. JSON output built for AI coding agents to parse and self-fix.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 108 KB of source, external domains: github.com, osv.dev, semgrep.dev, trivy.dev

Source & flagged code

4 flagged

dist/auditx.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 aggregate,

4 buildSummary,

5 detectStack,

6 filterBySeverity,

7 formatAgent,

8 getApplicableRunnerLabels,

9 getBinaryPath,

10 runAll,

11 stackLabels

12} from "./chunk-XGUZLLPZ.js";

14// src/bin/auditx.ts

15import { program } from "commander";

16import ora from "ora";

17import chalk3 from "chalk";

18import { writeFileSync as writeFileSync2, readFileSync as readFileSync2 } from "fs";

19import { resolve } from "path";

20import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L19

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L19

22// src/formatters/markdown.ts

23import { relative, isAbsolute } from "path";

24var SEV_EMOJI = {

25 critical: "\u{1F534}",

26 high: "\u{1F7E0}",

27 medium: "\u{1F7E1}",

28 low: "\u{1F535}",

29 info: "\u26AA"

30};

31var SEV_LABEL = {

32 critical: "Critical",

33 high: "High",

34 medium: "Medium",

35 low: "Low",

36 info: "Info"

37};

38var CAT_LABEL = {

39 SECRETS: "Secrets",

Lines 806-845javascript

806 try {

807 const bin = await getBinaryPath(tool.name);

808 execSync(`"${bin}" ${tool.checkArgs.join(" ")}`, { stdio: "ignore" });

809 console.log(` ${chalk3.green(

dist/chunk-XGUZLLPZ.jsView file

Lines 953-993javascript

953 scanner,

954 description: `Package '${dep}' is listed in devDependencies but not used.`,

955 fix: `Run: npm uninstall --save-dev ${dep}`

956 });

957 }

958 }

959 return { scanner, ok: true, findings, durationMs: Date.now() - start };

Source & flagged code

4 flagged · loading source

dist/auditx.jsView file

19import { resolve } from "path"; L20: import { execSync } from "child_process"; L21:

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L19

826try { L827: execSync("npx eslint --fix .", { cwd: targetDir, stdio: "inherit" }); L828: console.log(chalk3.green(" \u2713 eslint --fix applied"));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auditx.jsView on unpkg · L826

19import { resolve } from "path"; L20: import { execSync } from "child_process"; L21: ... L128: { L129: exitCode: urgentCount > 0 ? 1 : 0, L130: urgentCount, ... L143: lines.push(""); L144: lines.push(`*Generated by [auditx](https://github.com/parth308/auditx) \xB7 MIT License*`); L145: return lines.join("\n"); ... L356: import chalk2 from "chalk"; L357: var CONFIG_DIR = join(homedir(), ".auditx"); L358: var CONFIG_FILE = join(CONFIG_DIR, "config.json");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L19

dist/chunk-XGUZLLPZ.jsView file

973import { promisify as promisify9 } from "util"; L974: var execAsync = promisify9(exec); L975: async function runCspell(targetDir, stagedFiles) {

High

Shell

Package source references shell execution.

dist/chunk-XGUZLLPZ.jsView on unpkg · L973

Findings

3 High3 Medium5 Low

HighChild Processdist/auditx.js

HighShelldist/chunk-XGUZLLPZ.js

HighRuntime Package Installdist/auditx.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/auditx.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/auditx.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 aggregate,

4 buildSummary,

5 detectStack,

6 filterBySeverity,

7 formatAgent,

8 getApplicableRunnerLabels,

9 getBinaryPath,

10 runAll,

11 stackLabels

12} from "./chunk-XGUZLLPZ.js";

14// src/bin/auditx.ts

15import { program } from "commander";

16import ora from "ora";

17import chalk3 from "chalk";

18import { writeFileSync as writeFileSync2, readFileSync as readFileSync2 } from "fs";

19import { resolve } from "path";

20import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L19

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L19

22// src/formatters/markdown.ts

23import { relative, isAbsolute } from "path";

24var SEV_EMOJI = {

25 critical: "\u{1F534}",

26 high: "\u{1F7E0}",

27 medium: "\u{1F7E1}",

28 low: "\u{1F535}",

29 info: "\u26AA"

30};

31var SEV_LABEL = {

32 critical: "Critical",

33 high: "High",

34 medium: "Medium",

35 low: "Low",

36 info: "Info"

37};

38var CAT_LABEL = {

39 SECRETS: "Secrets",

Lines 806-845javascript

806 try {

807 const bin = await getBinaryPath(tool.name);

808 execSync(`"${bin}" ${tool.checkArgs.join(" ")}`, { stdio: "ignore" });

809 console.log(` ${chalk3.green(

dist/chunk-XGUZLLPZ.jsView file

Lines 953-993javascript

953 scanner,

954 description: `Package '${dep}' is listed in devDependencies but not used.`,

955 fix: `Run: npm uninstall --save-dev ${dep}`

956 });

957 }

958 }

959 return { scanner, ok: true, findings, durationMs: Date.now() - start };