registry / cgraphx / 1.2.0

cgraphx@1.2.0

Supercharge AI coding agents with semantic code intelligence — surgical context, fewer tool calls, faster answers. 100% local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 221 file(s), 2.99 MB of source, external domains: ai.getcodegraph.com, antigravity.google, api.github.com, app.getcodegraph.com, docs.claude.com, docs.cursor.com, geminicli.com, github.com, hermes-agent.nousresearch.com, kiro.dev, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, telemetry.getcodegraph.com

Source & flagged code

9 flagged

dist/dbquery/init.jsView file

Lines 43-92javascript

43 };

44})();

45Object.defineProperty(exports, "__esModule", { value: true });

46exports.templateProfilesContent = templateProfilesContent;

47exports.initDbProfiles = initDbProfiles;

48const fs = __importStar(require("node:fs"));

49const path = __importStar(require("node:path"));

50const constants_1 = require("./constants");

51const POSIX = process.platform !== 'win32';

52/** The template content. Uses placeholder passwords so the user knows to fill. */

53function templateProfilesContent() {

54 const obj = {

55 enabled: true,

56 default: 'example-mysql',

57 'example-mysql': {

58 description: '示例 MySQL 配置 — 改成实际值后重命名 profile',

59 type: 'mysql',

60 host: 'localhost',

61 port: 3306,

62 user: 'readonly_user',

63 password: 'CHANGE_ME',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dbquery/init.jsView on unpkg · L63

64 database: 'your_database',

65 },

66 'example-postgres': {

67 description: '示例 PostgreSQL 配置 — 改成实际值后重命名 profile',

68 type: 'postgres',

69 host: 'localhost',

70 port: 5432,

71 user: 'readonly_user',

72 password: 'CHANGE_ME',

Medium

Secret Pattern

Hardcoded password in dist/dbquery/init.js

dist/dbquery/init.jsView on unpkg · L72

73 database: 'your_database',

74 schema: 'public',

75 },

76 };

77 return JSON.stringify(obj, null, 2) + '\n';

78}

79/**

80 * Write the db-profiles.json template.

81 *

82 * @param projectRoot Project root (must already have a .cgraphx/ dir)

83 * @param opts.force Overwrite an existing file. Default false.

84 *

85 * Behavior:

86 * - .cgraphx/ missing → throws (caller should tell user to run `cgraphx init` first)

87 * - File exists + !force → returns action='already-exists', no write

88 * - File exists + force → action='overwritten'

89 * - File absent → action='created'

90 */

91function initDbProfiles(projectRoot, opts = {}) {

92 const resolved = path.resolve(projectRoot);

dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

dist/bin/codegraph.jsView file

Lines 72-112javascript

72const cli_1 = require("../markdown/cli");

73const cli_2 = require("../dbquery/cli");

74const cli_3 = require("../timeline/cli");

75const upgrade_1 =

dist/dbquery/drivers/mysql.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * MySQL driver adapter (mysql2/promise).

4 *

5 * Spec §4.3 connection lifecycle: short-lived, no pool. Each execute() opens

6 * a fresh connection and closes it in finally. Connect timeout 5s, query

7 * timeout 30s (constants).

8 *

9 * Error mapping (spec §6.1):

10 * - auth / network / unknown-db → ConnectionFailedError

11 * - timeout → QueryTimeoutError

dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken = pollForToken;

6exports.openBrowser = openBrowser;

dist/installer/index.jsView file

Lines 117-157javascript

117 if (!useDefaults) {

118 const existingPath = detectCodegraphOnPath();

119 if (existingPath) {

120 clack.log.info(`cgraphx CLI 已在 PATH 上(${existingPath})—— 跳过安装步骤。`);

121 }

122 else {

dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 4785 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg

Source & flagged code

9 flagged · loading source

dist/dbquery/init.jsView file

63patternName = generic_password severity = medium line = 63 matchedText = password...ME',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dbquery/init.jsView on unpkg · L63

72patternName = generic_password severity = medium line = 72 matchedText = password...ME',

Medium

Secret Pattern

Hardcoded password in dist/dbquery/init.js

dist/dbquery/init.jsView on unpkg · L72

dist/upgrade/index.jsView file

78const https = __importStar(require("https")); L79: const child_process_1 = require("child_process"); L80: exports.REPO = 'smdnkB/cgraphx';

High

Child Process

Package source references child process execution.

dist/upgrade/index.jsView on unpkg · L78

dist/bin/codegraph.jsView file

92// eslint-disable-next-line @typescript-eslint/no-implied-eval L93: const importESM = new Function('specifier', 'return import(specifier)'); L94: // Block cgraphx on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

dist/bin/codegraph.jsView on unpkg · L92

dist/dbquery/drivers/mysql.jsView file

15exports.createMysqlConnection = createMysqlConnection; L16: const constants_1 = require("../constants"); L17: const errors_1 = require("../errors");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dbquery/drivers/mysql.jsView on unpkg · L15

dist/reasoning/login.jsView file

17*/ L18: const child_process_1 = require("child_process"); L19: const DEFAULT_BASE = 'https://app.getcodegraph.com'; L20: /** Dashboard base for the device-login endpoints; override for testing via CGRAPHX_LOGIN_URL. */ L21: function loginBaseUrl() { L22: const raw = process.env.CGRAPHX_LOGIN_URL?.trim() || DEFAULT_BASE; L23: return raw.replace(/\/+$/, '');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/reasoning/login.jsView on unpkg · L17

dist/installer/index.jsView file

137// "permission denied" message. L138: const result = (0, child_process_1.execSync)(`npm install -g ${upgrade_1.NPM_PACKAGE}`, { L139: stdio: ['pipe', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L137

dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 4785 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg

Findings

5 High8 Medium5 Low

HighChild Processdist/upgrade/index.js

HighShell

HighEvaldist/bin/codegraph.js

HighSame File Env Network Executiondist/reasoning/login.js

HighRuntime Package Installdist/installer/index.js

MediumSecret Patterndist/dbquery/init.js

MediumDynamic Requiredist/dbquery/drivers/mysql.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/extraction/wasm/tree-sitter-scala.wasm

MediumShips Build Helperscripts/build-bundle.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/dbquery/init.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/dbquery/init.jsView file

Lines 43-92javascript

43 };

44})();

45Object.defineProperty(exports, "__esModule", { value: true });

46exports.templateProfilesContent = templateProfilesContent;

47exports.initDbProfiles = initDbProfiles;

48const fs = __importStar(require("node:fs"));

49const path = __importStar(require("node:path"));

50const constants_1 = require("./constants");

51const POSIX = process.platform !== 'win32';

52/** The template content. Uses placeholder passwords so the user knows to fill. */

53function templateProfilesContent() {

54 const obj = {

55 enabled: true,

56 default: 'example-mysql',

57 'example-mysql': {

58 description: '示例 MySQL 配置 — 改成实际值后重命名 profile',

59 type: 'mysql',

60 host: 'localhost',

61 port: 3306,

62 user: 'readonly_user',

63 password: 'CHANGE_ME',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dbquery/init.jsView on unpkg · L63

64 database: 'your_database',

65 },

66 'example-postgres': {

67 description: '示例 PostgreSQL 配置 — 改成实际值后重命名 profile',

68 type: 'postgres',

69 host: 'localhost',

70 port: 5432,

71 user: 'readonly_user',

72 password: 'CHANGE_ME',

Medium

Secret Pattern

Hardcoded password in dist/dbquery/init.js

dist/dbquery/init.jsView on unpkg · L72

73 database: 'your_database',

74 schema: 'public',

75 },

76 };

77 return JSON.stringify(obj, null, 2) + '\n';

78}

79/**

80 * Write the db-profiles.json template.

81 *

82 * @param projectRoot Project root (must already have a .cgraphx/ dir)

83 * @param opts.force Overwrite an existing file. Default false.

84 *

85 * Behavior:

86 * - .cgraphx/ missing → throws (caller should tell user to run `cgraphx init` first)

87 * - File exists + !force → returns action='already-exists', no write

88 * - File exists + force → action='overwritten'

89 * - File absent → action='created'

90 */

91function initDbProfiles(projectRoot, opts = {}) {

92 const resolved = path.resolve(projectRoot);

dist/upgrade/index.jsView file

Lines 58-98javascript

58 };

59})();

60Object.defineProperty(exports, "__esModule", { value: true });

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

dist/bin/codegraph.jsView file

Lines 72-112javascript

72const cli_1 = require("../markdown/cli");

73const cli_2 = require("../dbquery/cli");

74const cli_3 = require("../timeline/cli");

75const upgrade_1 =

dist/dbquery/drivers/mysql.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * MySQL driver adapter (mysql2/promise).

4 *

5 * Spec §4.3 connection lifecycle: short-lived, no pool. Each execute() opens

6 * a fresh connection and closes it in finally. Connect timeout 5s, query

7 * timeout 30s (constants).

8 *

9 * Error mapping (spec §6.1):

10 * - auth / network / unknown-db → ConnectionFailedError

11 * - timeout → QueryTimeoutError

dist/reasoning/login.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loginBaseUrl = loginBaseUrl;

4exports.startDeviceLogin = startDeviceLogin;

5exports.pollForToken = pollForToken;

6exports.openBrowser = openBrowser;

dist/installer/index.jsView file

Lines 117-157javascript

117 if (!useDefaults) {

118 const existingPath = detectCodegraphOnPath();

119 if (existingPath) {

120 clack.log.info(`cgraphx CLI 已在 PATH 上(${existingPath})—— 跳过安装步骤。`);

121 }

122 else {

dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

scripts/build-bundle.shView file

•path = scripts/build-bundle.sh kind = build_helper sizeBytes = 4785 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-bundle.shView on unpkg