registry / clay-generator / 0.3.3

clay-generator@0.3.3

a model and convention based source code generator

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 375 KB of source, external domains: morkeleb.github.io, raw.githubusercontent.com

Source & flagged code

5 flagged

dist/src/conventions.jsView file

Lines 43-83javascript

43 return [];

44 }

45 const content = fs.readFileSync(resolved, 'utf-8');

46 const generator = JSON.parse(content);

47 if (!generator.conventions || !Array.isArray(generator.conventions)) {

48 return [];

49 }

50 const generatorDir = path.dirname(resolved);

51 return generator.conventions.map((entry) => {

52 if ('include' in entry && typeof entry.include === 'string') {

53 const includePath = path.resolve(generatorDir, entry.include);

54 const includeContent = fs.readFileSync(includePath, 'utf-8');

55 return JSON.parse(includeContent);

56 }

57 return entry;

58 });

59}

60function runConventions(conventions, model) {

61 const violations = [];

62 for (const convention of conventions) {

63 try {

64 const fn = eval(convention.function);

65 const result = fn(model);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/conventions.jsView on unpkg · L63

66 const errors = Array.isArray(result) ? result : [];

67 if (errors.length > 0) {

68 violations.push({

69 convention: convention.name,

70 description: convention.description,

71 errors,

72 });

73 }

74 }

75 catch (err) {

76 const message = err instanceof Error ? err.message : String(err);

77 violations.push({

78 convention: convention.name,

79 description: convention.description,

80 errors: [message],

81 });

82 }

83 }

dist/index.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

dist/src/pipeline/engines.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

package.jsonView file

Lines 1-37json

2 "name": "clay-generator",

3 "version": "0.3.3",

4 "description": "a model and convention based source code generator",

5 "main": "dist/index.js",

6 "exports": {

7 ".": "./dist/index.js",

Source & flagged code

5 flagged · loading source

dist/src/conventions.jsView file

63try { L64: const fn = eval(convention.function); L65: const result = fn(model);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/conventions.jsView on unpkg · L63

dist/index.jsView file

7process.isCLI = require.main === module; L8: const command_line_1 = __importDefault(require("./src/command-line")); L9: command_line_1.default.parse(process.argv);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L7

dist/src/pipeline/engines.jsView file

14package = clay-generator; repositoryIdentity = clay; dependency = ejs L14: try { L15: ejs = require('ejs'); L16: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/pipeline/engines.jsView on unpkg · L14

package.jsonView file

•dependencies changed=handlebars-group-by

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

1 Critical2 High4 Medium6 Low

CriticalManifest Confusionpackage.json

HighCopied Package Dependency Bridgedist/src/pipeline/engines.js

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/src/conventions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/src/conventions.jsView file

Lines 43-83javascript

43 return [];

44 }

45 const content = fs.readFileSync(resolved, 'utf-8');

46 const generator = JSON.parse(content);

47 if (!generator.conventions || !Array.isArray(generator.conventions)) {

48 return [];

49 }

50 const generatorDir = path.dirname(resolved);

51 return generator.conventions.map((entry) => {

52 if ('include' in entry && typeof entry.include === 'string') {

53 const includePath = path.resolve(generatorDir, entry.include);

54 const includeContent = fs.readFileSync(includePath, 'utf-8');

55 return JSON.parse(includeContent);

56 }

57 return entry;

58 });

59}

60function runConventions(conventions, model) {

61 const violations = [];

62 for (const convention of conventions) {

63 try {

64 const fn = eval(convention.function);

65 const result = fn(model);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/conventions.jsView on unpkg · L63

66 const errors = Array.isArray(result) ? result : [];

67 if (errors.length > 0) {

68 violations.push({

69 convention: convention.name,

70 description: convention.description,

71 errors,

72 });

73 }

74 }

75 catch (err) {

76 const message = err instanceof Error ? err.message : String(err);

77 violations.push({

78 convention: convention.name,

79 description: convention.description,

80 errors: [message],

81 });

82 }

83 }

dist/index.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

dist/src/pipeline/engines.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

package.jsonView file

Lines 1-37json

2 "name": "clay-generator",

3 "version": "0.3.3",

4 "description": "a model and convention based source code generator",

5 "main": "dist/index.js",

6 "exports": {

7 ".": "./dist/index.js",