registry / dev-loops / 0.7.1

dev-loops@0.7.1

Agent-harness-agnostic dev-loop infrastructure (Pi and Claude Code) for reusable local and remote development loops

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 148 file(s), 1.85 MB of source, external domains: github.com, www.w3.org

Oversized source lightweight scan

scripts/loop/inspect-run-viewer/vendor/mermaid.min.js3.16 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsgithub.comwww.w3.org

Source & flagged code

2 flagged

scripts/github/build-adjacent-bundle.mjsView file

Lines 94-134javascript

94 return BINARY_EXTENSIONS.has(base.slice(dot).toLowerCase());

95}

97/**

98 * Heuristic binary-content sniff: a NUL byte within the first 8KB marks the

99 * file as binary regardless of extension (covers extension-less binaries).

100 * @param {Buffer} buf

101 * @returns {boolean}

102 */

103function looksBinaryContent(buf) {

104 const limit = Math.min(buf.length, BINARY_SNIFF_BYTES);

105 for (let i = 0; i < limit; i++) {

106 if (buf[i] === 0) return true;

107 }

108 return false;

109}

110

111/**

112 * Extract the static import/require specifiers from JS source text.

113 * Deterministic regex scan (no execution). Captures:

114 * - import ... from "x" / export ... from "x"

115 * - import("x") (dynamic import)

116 * - require("x")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/github/build-adjacent-bundle.mjsView on unpkg · L114

117 * Returns specifiers in a deterministic, grouped-by-kind order — each kind is

118 * scanned in its own pass (export/import-from → bare side-effect import →

119 * dynamic import() → require()), so the output is grouped by form rather than

120 * by position in the source. De-duplicated (first occurrence wins).

121 * @param {string} source

122 * @returns {string[]}

123 */

124export function extractImportSpecifiers(source) {

125 if (typeof source !== "string" || source.length === 0) return [];

126 const specs = [];

127 const seen = new Set();

128 const push = (s) => {

129 if (typeof s === "string" && s.length > 0 && !seen.has(s)) {

130 seen.add(s);

131 specs.push(s);

132 }

133 };

134 // import ... from "x" | export ... from "x"

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView file

•path = scripts/loop/inspect-run-viewer/vendor/mermaid.min.js kind = oversized_source_file sizeBytes = 3312967 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView on unpkg

Source & flagged code

2 flagged · loading source

scripts/github/build-adjacent-bundle.mjsView file

114* - import ... from "x" / export ... from "x" L115: * - import("x") (dynamic import) L116: * - require("x")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/github/build-adjacent-bundle.mjsView on unpkg · L114

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView file

•path = scripts/loop/inspect-run-viewer/vendor/mermaid.min.js kind = oversized_source_file sizeBytes = 3312967 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView on unpkg

Findings

1 High4 Medium5 Low

HighOversized Source Filescripts/loop/inspect-run-viewer/vendor/mermaid.min.js

MediumDynamic Requirescripts/github/build-adjacent-bundle.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

scripts/github/build-adjacent-bundle.mjsView file

Lines 94-134javascript

94 return BINARY_EXTENSIONS.has(base.slice(dot).toLowerCase());

95}

97/**

98 * Heuristic binary-content sniff: a NUL byte within the first 8KB marks the

99 * file as binary regardless of extension (covers extension-less binaries).

100 * @param {Buffer} buf

101 * @returns {boolean}

102 */

103function looksBinaryContent(buf) {

104 const limit = Math.min(buf.length, BINARY_SNIFF_BYTES);

105 for (let i = 0; i < limit; i++) {

106 if (buf[i] === 0) return true;

107 }

108 return false;

109}

110

111/**

112 * Extract the static import/require specifiers from JS source text.

113 * Deterministic regex scan (no execution). Captures:

114 * - import ... from "x" / export ... from "x"

115 * - import("x") (dynamic import)

116 * - require("x")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/github/build-adjacent-bundle.mjsView on unpkg · L114

117 * Returns specifiers in a deterministic, grouped-by-kind order — each kind is

118 * scanned in its own pass (export/import-from → bare side-effect import →

119 * dynamic import() → require()), so the output is grouped by form rather than

120 * by position in the source. De-duplicated (first occurrence wins).

121 * @param {string} source

122 * @returns {string[]}

123 */

124export function extractImportSpecifiers(source) {

125 if (typeof source !== "string" || source.length === 0) return [];

126 const specs = [];

127 const seen = new Set();

128 const push = (s) => {

129 if (typeof s === "string" && s.length > 0 && !seen.has(s)) {

130 seen.add(s);

131 specs.push(s);

132 }

133 };

134 // import ... from "x" | export ... from "x"

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView file

•path = scripts/loop/inspect-run-viewer/vendor/mermaid.min.js kind = oversized_source_file sizeBytes = 3312967 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scripts/loop/inspect-run-viewer/vendor/mermaid.min.jsView on unpkg