registry / cool-workflow / 0.2.0

cool-workflow@0.2.0

A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 177 file(s), 2.19 MB of source, external domains: 127.0.0.1, github.com, nodejs.org, raw.githubusercontent.com, www.npmjs.com

Source & flagged code

5 flagged

dist/shell/commit.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

30 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

31 return ar;

32 };

33 return ownKeys(o);

34 };

35 return function (mod) {

36 if (mod && mod.__esModule) return mod;

37 var result = {};

38 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

39 __setModuleDefault(result, mod);

40 return result;

41 };

42})();

43Object.defineProperty(exports, "__esModule", { value: true });

44exports.CommitGateError = void 0;

45exports.commitState = commitState;

46const fs = __importStar(require("node:fs"));

47const path = __importStar(require("node:path"));

48const node_child_process_1 = require("node:child_process");

49const fs_atomic_1 = require("./fs-atomic");

High

Child Process

Package source references child process execution.

dist/shell/commit.jsView on unpkg · L47

50const commit_gate_1 = require("../core/pipeline/commit-gate");

51const contract_1 = require("../core/pipeline/contract");

52const runner_1 = require("../core/pipeline/runner");

53const node_store_1 = require("./node-store");

54const state_node_1 = require("../core/state/state-node");

55const trust_audit_1 = require("./trust-audit");

56const evidence_grounding_1 = require("../core/trust/evidence-grounding");

57const collaboration_io_1 = require("./collaboration-io");

58const error_feedback_io_1 = require("./error-feedback-io");

59class CommitGateError extends Error {

60 structured;

61 feedbackId;

62 stateNodeId;

63 constructor(error, options = {}) {

64 super(error.message);

65 this.name = "CommitGateError";

66 this.structured = error;

67 this.feedbackId = options.feedbackId;

dist/core/pipeline/result-normalize.jsView file

Lines 1-32javascript

1"use strict";

2// core/pipeline/result-normalize.ts — normalizeResultEnvelope,

3// isEmptyCapture.

4//

5// MILESTONE 6+7 (combined). Byte-exact port of the old build's

6// src/result-normalize.ts. Pure (no fs/clock/random).

7//

8// Evidence: SPEC/pipeline-run.md "Result ingest — src/result-normalize.ts".

9Object.defineProperty(exports, "__esModule", { value: true });

dist/shell/remote-source.js#virtual:normalized:round1View file

269} L270: const child = "const fs=require('fs');const [url,out,cap]=[process.argv[1],process.argv[2],Number(process.argv[3])];const priv=(h)=>{h=String(h).replace(/^\\[|\\]$/g,'').toLowerCas... L271: const result = (0, child_process.spawnSync)(process.execPath, ["-e", child, rawUrl, dest, String(MAX_ARCHIVE_BYTES)], { L272: encoding: "utf8", L273: timeout: opts.timeoutMs || 120000, L274: env: opts.env || process.env, L275: stdio: ["ignore", "ignore", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/shell/commit.jsView file

47const path = __importStar(require("node:path")); L48: const node_child_process_1 = require("node:child_process"); L49: const fs_atomic_1 = require("./fs-atomic");

High

Child Process

Package source references child process execution.

dist/shell/commit.jsView on unpkg · L47

dist/core/pipeline/result-normalize.jsView file

12exports.isEmptyCapture = isEmptyCapture; L13: const evidence_grounding_1 = require("../trust/evidence-grounding"); L14: const FINDING_ARRAY_KEYS = [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/pipeline/result-normalize.jsView on unpkg · L12

dist/shell/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processdist/shell/commit.js

HighSame File Env Network Executiondist/shell/remote-source.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/shell/remote-source.js#virtual:normalized:round1

MediumDynamic Requiredist/core/pipeline/result-normalize.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/release-gate.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/shell/commit.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

30 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

31 return ar;

32 };

33 return ownKeys(o);

34 };

35 return function (mod) {

36 if (mod && mod.__esModule) return mod;

37 var result = {};

38 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

39 __setModuleDefault(result, mod);

40 return result;

41 };

42})();

43Object.defineProperty(exports, "__esModule", { value: true });

44exports.CommitGateError = void 0;

45exports.commitState = commitState;

46const fs = __importStar(require("node:fs"));

47const path = __importStar(require("node:path"));

48const node_child_process_1 = require("node:child_process");

49const fs_atomic_1 = require("./fs-atomic");

High

Child Process

Package source references child process execution.

dist/shell/commit.jsView on unpkg · L47

50const commit_gate_1 = require("../core/pipeline/commit-gate");

51const contract_1 = require("../core/pipeline/contract");

52const runner_1 = require("../core/pipeline/runner");

53const node_store_1 = require("./node-store");

54const state_node_1 = require("../core/state/state-node");

55const trust_audit_1 = require("./trust-audit");

56const evidence_grounding_1 = require("../core/trust/evidence-grounding");

57const collaboration_io_1 = require("./collaboration-io");

58const error_feedback_io_1 = require("./error-feedback-io");

59class CommitGateError extends Error {

60 structured;

61 feedbackId;

62 stateNodeId;

63 constructor(error, options = {}) {

64 super(error.message);

65 this.name = "CommitGateError";

66 this.structured = error;

67 this.feedbackId = options.feedbackId;

dist/core/pipeline/result-normalize.jsView file

Lines 1-32javascript

1"use strict";

2// core/pipeline/result-normalize.ts — normalizeResultEnvelope,

3// isEmptyCapture.

4//

5// MILESTONE 6+7 (combined). Byte-exact port of the old build's

6// src/result-normalize.ts. Pure (no fs/clock/random).

7//

8// Evidence: SPEC/pipeline-run.md "Result ingest — src/result-normalize.ts".

9Object.defineProperty(exports, "__esModule", { value: true });

dist/shell/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/shell/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg