registry / comber / 0.1.5

comber@0.1.5

Comber — every-click AI QA agent. Walks every inch of an app and surfaces what washed up.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 88 file(s), 487 KB of source, external domains: api.bitbucket.org, api.github.com, api.linear.app, codecomber.io, comber.local, example.com, gitlab.com, schema.org, us.i.posthog.com

Source & flagged code

5 flagged

dist/connectors/loader.jsView file

Lines 1-37javascript

1import { buildRunRecord } from "../sinks/record.js";

2import { builtinConnector } from "./registry.js";

3import { passesGate, } from "./types.js";

4/**

5 * Resolve one connector config to a live instance. A `use:` that names a built-in loads from the

6 * registry; anything else is treated as an EXTERNAL MODULE SPECIFIER (an installed marketplace

7 * package like "@acme/comber-teams" or a local "./my-connector.js") and dynamically imported. An

8 * external module exports the same shape as a built-in: a `create` factory (+ optional `manifest`),

9 * or a default export that is the factory. This is the whole marketplace loading mechanism — a

10 * third-party connector is just an npm package that satisfies the contract.

11 */

12async function resolveFactory(use) {

13 const builtin = builtinConnector(use);

14 if (builtin)

15 return builtin.create;

16 let mod;

17 try {

18 mod = (await import(use));

19 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/loader.jsView on unpkg · L17

20 catch (err) {

21 throw new Error(`connector "${use}" could not be loaded — install it or check the name: ${String(err).slice(0, 160)}`);

22 }

23 const factory = (mod.create ?? mod.default);

24 if (typeof factory !== "function") {

25 throw new Error(`connector "${use}" does not export a create() factory (or default)`);

26 }

27 return factory;

28}

29/**

30 * A fan-out over configured connectors. Building it resolves + instantiates every connector (so a

31 * misconfigured connector fails fast, at load, with a clear error — not silently at delivery). At

32 * delivery it builds the redacted RunRecord ONCE and hands it to each connector, gated by the

33 * connector's `on` severity bar, with each delivery isolated so one failure never breaks the run

34 * or another connector.

35 */

36export class ConnectorFanout {

37 entries;

dist/core/signal-normalize.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2const URL_PATTERN = /\b(?:https?|wss?):\/\/[^\s"'<>]+/gi;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/signal-normalize.jsView on unpkg · L1

dist/core/egress.jsView file

Lines 1-21javascript

1import { lookup } from "node:dns/promises";

2import { isIP } from "node:net";

3function normalizeHostname(hostname) {

4 return hostname.replace(/^

runtime/windows-uia-runner.ps1View file

•path = runtime/windows-uia-runner.ps1 kind = build_helper sizeBytes = 14639 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/windows-uia-runner.ps1View on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = comber@0.1.3 matchedIdentity = npm:Y29tYmVy:0.1.3 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/connectors/loader.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code