registry / comber / 0.1.3

comber@0.1.3

Comber — every-click AI QA agent. Walks every inch of an app and surfaces what washed up.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 88 file(s), 473 KB of source, external domains: api.bitbucket.org, api.github.com, api.linear.app, codecomber.io, comber.local, example.com, gitlab.com, schema.org, us.i.posthog.com

Source & flagged code

4 flagged

dist/connectors/loader.jsView file

Lines 1-37javascript

1import { buildRunRecord } from "../sinks/record.js";

2import { builtinConnector } from "./registry.js";

3import { passesGate, } from "./types.js";

4/**

5 * Resolve one connector config to a live instance. A `use:` that names a built-in loads from the

6 * registry; anything else is treated as an EXTERNAL MODULE SPECIFIER (an installed marketplace

7 * package like "@acme/comber-teams" or a local "./my-connector.js") and dynamically imported. An

8 * external module exports the same shape as a built-in: a `create` factory (+ optional `manifest`),

9 * or a default export that is the factory. This is the whole marketplace loading mechanism — a

10 * third-party connector is just an npm package that satisfies the contract.

11 */

12async function resolveFactory(use) {

13 const builtin = builtinConnector(use);

14 if (builtin)

15 return builtin.create;

16 let mod;

17 try {

18 mod = (await import(use));

19 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/loader.jsView on unpkg · L17

20 catch (err) {

21 throw new Error(`connector "${use}" could not be loaded — install it or check the name: ${String(err).slice(0, 160)}`);

22 }

23 const factory = (mod.create ?? mod.default);

24 if (typeof factory !== "function") {

25 throw new Error(`connector "${use}" does not export a create() factory (or default)`);

26 }

27 return factory;

28}

29/**

30 * A fan-out over configured connectors. Building it resolves + instantiates every connector (so a

31 * misconfigured connector fails fast, at load, with a clear error — not silently at delivery). At

32 * delivery it builds the redacted RunRecord ONCE and hands it to each connector, gated by the

33 * connector's `on` severity bar, with each delivery isolated so one failure never breaks the run

34 * or another connector.

35 */

36export class ConnectorFanout {

37 entries;

dist/core/signal-normalize.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2const URL_PATTERN = /\b(?:https?|wss?):\/\/[^\s"'<>]+/gi;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/signal-normalize.jsView on unpkg · L1

3const DUPLICATE_EGRESS_KINDS

dist/core/egress.jsView file

Lines 1-21javascript

1import { lookup } from "node:dns/promises";

2import { isIP } from "node:net";

3function normalizeHostname(hostname) {

4 return hostname.replace(/^\[/, "").replace(/\]$

runtime/windows-uia-runner.ps1View file

•path = runtime/windows-uia-runner.ps1 kind = build_helper sizeBytes = 14639 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/windows-uia-runner.ps1View on unpkg

Source & flagged code

4 flagged · loading source

dist/connectors/loader.jsView file

17try { L18: mod = (await import(use)); L19: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/loader.jsView on unpkg · L17

dist/core/signal-normalize.jsView file

1import { createHash } from "node:crypto"; L2: const URL_PATTERN = /\b(?:https?|wss?):\/\/[^\s"'<>]+/gi;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/signal-normalize.jsView on unpkg · L1

dist/core/egress.jsView file

1import { lookup } from "node:dns/promises"; L2: import { isIP } from "node:net"; ... L5: } L6: function isPrivateIpv4(address) { L7: const parts = address.split(".").map((part) => Number(part));

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/core/egress.jsView on unpkg · L1

runtime/windows-uia-runner.ps1View file

•path = runtime/windows-uia-runner.ps1 kind = build_helper sizeBytes = 14639 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/windows-uia-runner.ps1View on unpkg

Findings

1 High5 Medium7 Low

HighCloud Metadata Accessdist/core/egress.js

MediumDynamic Requiredist/connectors/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/windows-uia-runner.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/core/signal-normalize.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/connectors/loader.jsView file

Lines 1-37javascript

1import { buildRunRecord } from "../sinks/record.js";

2import { builtinConnector } from "./registry.js";

3import { passesGate, } from "./types.js";

4/**

5 * Resolve one connector config to a live instance. A `use:` that names a built-in loads from the

6 * registry; anything else is treated as an EXTERNAL MODULE SPECIFIER (an installed marketplace

7 * package like "@acme/comber-teams" or a local "./my-connector.js") and dynamically imported. An

8 * external module exports the same shape as a built-in: a `create` factory (+ optional `manifest`),

9 * or a default export that is the factory. This is the whole marketplace loading mechanism — a

10 * third-party connector is just an npm package that satisfies the contract.

11 */

12async function resolveFactory(use) {

13 const builtin = builtinConnector(use);

14 if (builtin)

15 return builtin.create;

16 let mod;

17 try {

18 mod = (await import(use));

19 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/loader.jsView on unpkg · L17

20 catch (err) {

21 throw new Error(`connector "${use}" could not be loaded — install it or check the name: ${String(err).slice(0, 160)}`);

22 }

23 const factory = (mod.create ?? mod.default);

24 if (typeof factory !== "function") {

25 throw new Error(`connector "${use}" does not export a create() factory (or default)`);

26 }

27 return factory;

28}

29/**

30 * A fan-out over configured connectors. Building it resolves + instantiates every connector (so a

31 * misconfigured connector fails fast, at load, with a clear error — not silently at delivery). At

32 * delivery it builds the redacted RunRecord ONCE and hands it to each connector, gated by the

33 * connector's `on` severity bar, with each delivery isolated so one failure never breaks the run

34 * or another connector.

35 */

36export class ConnectorFanout {

37 entries;

dist/core/signal-normalize.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2const URL_PATTERN = /\b(?:https?|wss?):\/\/[^\s"'<>]+/gi;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/signal-normalize.jsView on unpkg · L1

3const DUPLICATE_EGRESS_KINDS

dist/core/egress.jsView file

Lines 1-21javascript

1import { lookup } from "node:dns/promises";

2import { isIP } from "node:net";

3function normalizeHostname(hostname) {

4 return hostname.replace(/^\[/, "").replace(/\]$

runtime/windows-uia-runner.ps1View file

•path = runtime/windows-uia-runner.ps1 kind = build_helper sizeBytes = 14639 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/windows-uia-runner.ps1View on unpkg