registry / chorograph / 0.4.0

chorograph@0.4.0

Architecture in doc comments — annotate your services, databases, and events where they live; get a clear, shareable map. No imports, no config, nothing executed.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.61 MB of source, external domains: reactjs.org, www.eclipse.org, www.w3.org

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3// src/cli.ts

4import { spawn } from "node:child_process";

5import { mkdirSync, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 }

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

3

// src/cli.ts L4: import { spawn } from "node:child_process"; L5: import { mkdirSync, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3

3Cross-file remote execution chain: dist/cli.js spawns dist/viewer.js; helper contains network access plus dynamic code execution. L3: // src/cli.ts L4: import { spawn } from "node:child_process"; L5: import { mkdirSync, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "node:fs"; ... L646: function loadGraph(paths, opts = {}) { L647: const cwd = process.cwd(); L648: const sources = expandPaths(paths).map((file) => ({ ... L675: jsx: "automatic", L676: define: { "process.env.NODE_ENV": '"production"' }, L677: logLevel: "silent" ... L691: // src/serve.ts L692: import { createServer } from "node:http"; L693: var escapeHtml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L3

Findings

3 High3 Medium6 Low

HighChild Processdist/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3// src/cli.ts

4import { spawn } from "node:child_process";

5import { mkdirSync, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 }

from

"node:fs"

;

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L3

6import { basename, dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";

7import { fileURLToPath as fileURLToPath2 } from "node:url";

8

9// src/load.ts

10import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

11import { join, relative, resolve } from "node:path";

12

13// src/core/annotations.ts

14import ts from "typescript";

15

16// src/core/grammar.gen.ts

17var grammar_gen_default = {

18 "nodeKinds": [

19 {

20 "kind": "domain",

21 "tags": [

22 "domain"

23 ],