Loading npm security reports…

chorograph: Suspicious npm security report (Warn) | LPM Firewall

registry / chorograph / 0.4.0

chorograph@0.4.0

Architecture in doc comments — annotate your services, databases, and events where they live; get a clear, shareable map. No imports, no config, nothing executed.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.61 MB of source, external domains: reactjs.org, www.eclipse.org, www.w3.org

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { spawn } from "node:child_process";

5import { mkdirSync, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L3

6import { basename, dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";

7import { fileURLToPath as fileURLToPath2 } from "node:url";

9// src/load.ts

10import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

11import { join, relative, resolve } from "node:path";

13// src/core/annotations.ts

14import ts from "typescript";

16// src/core/grammar.gen.ts

17var grammar_gen_default = {

18 "nodeKinds": [

19 {

20 "kind": "domain",

21 "tags": [

22 "domain"

23 ],

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code