registry / cool-workflow / 0.1.98

cool-workflow@0.1.98

⚠ Under review

A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 212 file(s), 2.16 MB of source, external domains: github.com, nodejs.org, raw.githubusercontent.com, www.npmjs.com

Source & flagged code

6 flagged

dist/commit.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.CommitGateError = void 0;

7exports.commitState = commitState;

8const node_fs_1 = __importDefault(require("node:fs"));

9const node_path_1 = __importDefault(require("node:path"));

10const node_child_process_1 = require("node:child_process");

11const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

12const pipeline_contract_1 = require("./pipeline-contract");

13const state_node_1 = require("./state-node");

14const pipeline_runner_1 = require("./pipeline-runner");

15const error_feedback_1 = require("./error-feedback");

16const trust_audit_1 = require("./trust-audit");

17const collaboration_1 = require("./collaboration");

18const evidence_grounding_1 = require("./evidence-grounding");

19const verifier_1 = require("./verifier");

20const compare_1 = require("./compare");

21const gates_1 = require("./gates");

22class CommitGateError extends Error {

23 structured;

24 feedbackId;

25 stateNodeId;

26 constructor(error, options = {}) {

27 super(error.message);

28 this.name = "CommitGateError";

29 this.structured = error;

dist/reporter.jsView file

Lines 1-35javascript

1"use strict";

2// src/reporter.ts — the cw-side run reporter.

3//

4// Rendering lives behind a small interface so the drive/command-surface stay logic-only: the

5// orchestrator emits events (progress lines, the end-of-run summary) and the Reporter decides how

6// to draw them. The live AGENT view (spinner / streamed tokens / folding tool lines) is rendered

7// by the async agent wrapper — cw is blocked in spawnSync during a run, so cw only renders the

8// calm orchestration BETWEEN agents plus the final summary. Everything here goes to STDERR; the

9// MACHINE payloads on stdout (the cw:result fence + cw's --json via printJson) carry NO term

10// styling, so they stay byte-exact under any color env. Color is TTY-gated and honors

dist/remote-source.js#virtual:normalized:round1View file

269} L270: const child = "const fs=require('fs');const [url,out,cap]=[process.argv[1],process.argv[2],Number(process.argv[3])];const priv=(h)=>{h=String(h).replace(/^\\[|\\]$/g,'').toLowerCas... L271: const result = (0, child_process.spawnSync)(process.execPath, ["-e", child, rawUrl, dest, String(MAX_ARCHIVE_BYTES)], { L272: encoding: "utf8", L273: timeout: opts.timeoutMs || 120000, L274: env: opts.env || process.env, L275: stdio: ["ignore", "ignore", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

dist/remote-source.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cool-workflow@0.1.97 matchedIdentity = npm:Y29vbC13b3JrZmxvdw:0.1.97 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote-source.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/commit.jsView file

9const node_path_1 = __importDefault(require("node:path")); L10: const node_child_process_1 = require("node:child_process"); L11: const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

dist/reporter.jsView file

15exports.createReporter = createReporter; L16: const term_1 = require("./term"); L17: function isTTY(stream) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/reporter.jsView on unpkg · L15

dist/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

dist/remote-source.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote-source.jsView on unpkg

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/remote-source.js

HighChild Processdist/commit.js

HighSame File Env Network Executiondist/remote-source.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/remote-source.js#virtual:normalized:round1

MediumDynamic Requiredist/reporter.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/release-gate.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/commit.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.CommitGateError = void 0;

7exports.commitState = commitState;

8const node_fs_1 = __importDefault(require("node:fs"));

9const node_path_1 = __importDefault(require("node:path"));

10const node_child_process_1 = require("node:child_process");

11const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

12const pipeline_contract_1 = require("./pipeline-contract");

13const state_node_1 = require("./state-node");

14const pipeline_runner_1 = require("./pipeline-runner");

15const error_feedback_1 = require("./error-feedback");

16const trust_audit_1 = require("./trust-audit");

17const collaboration_1 = require("./collaboration");

18const evidence_grounding_1 = require("./evidence-grounding");

19const verifier_1 = require("./verifier");

20const compare_1 = require("./compare");

21const gates_1 = require("./gates");

22class CommitGateError extends Error {

23 structured;

24 feedbackId;

25 stateNodeId;

26 constructor(error, options = {}) {

27 super(error.message);

28 this.name = "CommitGateError";

29 this.structured = error;

dist/reporter.jsView file

Lines 1-35javascript

1"use strict";

2// src/reporter.ts — the cw-side run reporter.

3//

4// Rendering lives behind a small interface so the drive/command-surface stay logic-only: the

5// orchestrator emits events (progress lines, the end-of-run summary) and the Reporter decides how

6// to draw them. The live AGENT view (spinner / streamed tokens / folding tool lines) is rendered

7// by the async agent wrapper — cw is blocked in spawnSync during a run, so cw only renders the

8// calm orchestration BETWEEN agents plus the final summary. Everything here goes to STDERR; the

9// MACHINE payloads on stdout (the cw:result fence + cw's --json via printJson) carry NO term

10// styling, so they stay byte-exact under any color env. Color is TTY-gated and honors

dist/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

dist/remote-source.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote-source.jsView on unpkg