registry / candor-ts / 0.9.0

candor-ts@0.9.0

candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.9)

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a local TypeScript static-analysis CLI suite that reads target sources and writes requested report files.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit invocation of its CLI, watcher, MCP, or LSP entrypoints.

Impact

Creates analysis reports at user-selected output paths; the watcher locally invokes its bundled scanner.

Mechanism

Local source analysis, report querying, and stdio protocol handling.

Rationale

Direct inspection shows scanner signals arise from an explicit local watcher subprocess and conformance fixtures that deliberately exercise effect detection. No concrete exfiltration, remote payload, unauthorized persistence, lifecycle execution, or AI-agent control-surface mutation is present.

Evidence

package.jsonscan.mjswatch.mjsmcp.mjslsp.mjsCases.tscontract.mjs.candor/report.json.candor/report.callgraph.json

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

`Cases.ts` imports network and subprocess APIs, but it is documented conformance-fixture source.
`watch.mjs` launches local `scan.mjs` only after explicit `candor-ts-watch` invocation.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
Entrypoints are user-invoked CLI, MCP, LSP, and watcher tools; no import-time scan or network action was found.
`scan.mjs` writes only requested report outputs using local filesystem APIs.
`mcp.mjs` is stdio-only and confines caller-supplied policy reads to the report workspace.
No runtime HTTP client, socket connection, credential harvesting, eval/vm execution, or persistence write was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 292 KB of source, external domains: github.com

Source & flagged code

5 flagged

Cases.tsView file

Lines 1-24typescript

1// The candor-spec conformance cases in TypeScript — paired by bare function name with the Rust and

2// Java fixtures; the expected effect sets are conformance/expected.json (the SAME oracle).

3import * as fsm from "node:fs";

4import * as netm from "node:net";

5import * as cp from "node:child_process";

6import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

7import { DatabaseSync } from "node:sqlite";

8import * as winstonm from "winston";

10// --- one function per std-only effect ---

11export function fs_read(): void { try { fsm.readFileSync("/tmp/x"); } catch {} }

12export function net_connect(): void { try { netm.connect(1, "h"); } catch {} }

13export function exec_spawn(): void { try { cp.spawn("x"); } catch {} }

14// Exec-cliff refinement (spec §4 ⟨0.5⟩): a known literal head adds its effect; all engines must agree.

15export function exec_curl(): void { try { cp.spawn("curl"); } catch {} }

16// Exec-refinement reads the HEAD (argv[0]) only: a dynamic program with a literal ARGUMENT keeps the

17// bare cliff — "curl" in the args array must NOT fabricate Net (spec §4 ⟨0.5⟩: the head is argv[0]).

18export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} }

19export function env_read(): void { void process.env.X; }

20export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

21// Rand: node:crypto's CSPRNG. candor-ts is syntactic (AST), so the builtin need not resolve at scan time.

22export function rand_gen(): void { void cryptom.randomBytes(16); }

23// Db: node:sqlite's DatabaseSync.exec is the store round-trip (named import — candor-ts tracks the symbol).

24export function db_query(): void { void new DatabaseSync(":memory:").exec("SELECT 1"); }

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

scan.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = candor-ts@0.8.15 matchedIdentity = npm:Y2FuZG9yLXRz:0.8.15 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scan.mjsView on unpkg

Source & flagged code

5 flagged · loading source

Cases.tsView file

4import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

3import * as fsm from "node:fs"; L4: import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto"; ... L18: export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} } L19: export function env_read(): void { void process.env.X; } L20: export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

watch.mjsView file

16Cross-file remote execution chain: watch.mjs spawns scan.mjs; helper contains network access plus dynamic code execution. L16: */ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

watch.mjsView on unpkg · L16

16*/ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

scan.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scan.mjsView on unpkg

Findings

1 Critical4 High1 Medium5 Low

CriticalPrevious Version Dangerous Deltascan.mjs

HighChild ProcessCases.ts

HighShell

HighSame File Env Network ExecutionCases.ts

HighCross File Remote Execution Contextwatch.mjs

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptowatch.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings