registry / dirac-lang / 0.1.90

dirac-lang@0.1.90

LLM-Augmented Declarative Execution

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 233 KB of source

Source & flagged code

4 flagged

dist/chunk-PKLOBITC.jsView file

Lines 279-319javascript

279 name = element.attributes.name || element.attributes.subroutine || "";

280 } else {

281 name = element.tag;

282 }

283 if (!name) {

284 throw new Error("<call> requires name or subroutine attribute");

285 }

286 const subroutine = getSubroutine(session, name);

287 if (!subroutine) {

288 throw new Error(`Subroutine '${name}' not found`);

289 }

290 const extendAttr = subroutine.attributes.extend;

291 const extendsAttr = subroutine.attributes.extends;

292 if (extendAttr !== void 0 || extendsAttr !== void 0) {

293 const baseSubroutine = await registerExtendChain(session, subroutine, name);

294 await executeCallInternal(session, baseSubroutine, element, true);

295 } else {

296 await executeCallInternal(session, subroutine, element, false);

297 }

298}

299async function registerExtendChain(session, subroutine, currentName) {

300 const { executeSubroutine: executeSubroutine2 } = await import("./subroutine-7JJKHTV4.js");

301 const extendsAttr = subroutine.attributes.extends;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-PKLOBITC.jsView on unpkg · L299

302 let parentName;

303 if (extendsAttr) {

304 parentName = extendsAttr;

305 } else {

306 parentName = currentName;

307 }

308 const parent = getParentSubroutine(session, parentName, parentName === currentName ? subroutine : void 0);

309 if (!parent) {

310 return subroutine;

311 }

312 const parentExtendAttr = parent.attributes.extend;

313 const parentExtendsAttr = parent.attributes.extends;

314 let baseSubroutine;

315 if (parentExtendAttr !== void 0 || parentExtendsAttr !== void 0) {

316 baseSubroutine = await registerExtendChain(session, parent, parentName);

317 } else {

318 for (const child of parent.children) {

319 if (child.tag === "subroutine") {

Lines 1557-1599javascript

1557 result = args.length > 0 ? args[0] === 0 : true;

1558 break;

1559 case "same":

1560 case "strcmp":

1561 result = stringArgs.

dist/shell-KREANC2A.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 BraKetParser,

4 integrate

5} from "./chunk-PKLOBITC.js";

6import "./chunk-ECAW4X46.js";

7import "./chunk-SLGJRZ3P.js";

8import {

9 DiracParser

Source & flagged code

4 flagged · loading source

dist/chunk-PKLOBITC.jsView file

1577// src/tags/system.ts L1578: import { exec, spawn } from "child_process"; L1579: import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/chunk-PKLOBITC.jsView on unpkg · L1577

1579import { promisify } from "util"; L1580: var execAsync = promisify(exec); L1581: async function executeSystem(session, element) {

High

Shell

Package source references shell execution.

dist/chunk-PKLOBITC.jsView on unpkg · L1579

299async function registerExtendChain(session, subroutine, currentName) { L300: const { executeSubroutine: executeSubroutine2 } = await import("./subroutine-7JJKHTV4.js"); L301: const extendsAttr = subroutine.attributes.extends;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-PKLOBITC.jsView on unpkg · L299

dist/shell-KREANC2A.jsView file

20Cross-file remote execution chain: dist/shell-KREANC2A.js spawns dist/chunk-PKLOBITC.js; helper contains network access plus dynamic code execution. L20: import yaml from "js-yaml"; L21: var HISTORY_FILE = path.join(os.homedir(), ".dirac_history"); L22: var MAX_HISTORY = 1e3; ... L41: input: process.stdin, L42: output: process.stdout, L43: prompt: "> ", ... L86: ]; L87: const envVarNames = Object.keys(process.env).filter( L88: (name) => commonEnvVars.includes(name) || name.startsWith("DIRAC_") || name.startsWith("TELEGRAM_") ... L587: try { L588: formattedValue = JSON.stringify(JSON.parse(v.value), null, 2); L589: } catch {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/shell-KREANC2A.jsView on unpkg · L20

Findings

3 High3 Medium3 Low

HighChild Processdist/chunk-PKLOBITC.js

HighShelldist/chunk-PKLOBITC.js

HighCross File Remote Execution Contextdist/shell-KREANC2A.js

MediumDynamic Requiredist/chunk-PKLOBITC.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/chunk-PKLOBITC.jsView file

Lines 279-319javascript

279 name = element.attributes.name || element.attributes.subroutine || "";

280 } else {

281 name = element.tag;

282 }

283 if (!name) {

284 throw new Error("<call> requires name or subroutine attribute");

285 }

286 const subroutine = getSubroutine(session, name);

287 if (!subroutine) {

288 throw new Error(`Subroutine '${name}' not found`);

289 }

290 const extendAttr = subroutine.attributes.extend;

291 const extendsAttr = subroutine.attributes.extends;

292 if (extendAttr !== void 0 || extendsAttr !== void 0) {

293 const baseSubroutine = await registerExtendChain(session, subroutine, name);

294 await executeCallInternal(session, baseSubroutine, element, true);

295 } else {

296 await executeCallInternal(session, subroutine, element, false);

297 }

298}

299async function registerExtendChain(session, subroutine, currentName) {

300 const { executeSubroutine: executeSubroutine2 } = await import("./subroutine-7JJKHTV4.js");

301 const extendsAttr = subroutine.attributes.extends;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-PKLOBITC.jsView on unpkg · L299

302 let parentName;

303 if (extendsAttr) {

304 parentName = extendsAttr;

305 } else {

306 parentName = currentName;

307 }

308 const parent = getParentSubroutine(session, parentName, parentName === currentName ? subroutine : void 0);

309 if (!parent) {

310 return subroutine;

311 }

312 const parentExtendAttr = parent.attributes.extend;

313 const parentExtendsAttr = parent.attributes.extends;

314 let baseSubroutine;

315 if (parentExtendAttr !== void 0 || parentExtendsAttr !== void 0) {

316 baseSubroutine = await registerExtendChain(session, parent, parentName);

317 } else {

318 for (const child of parent.children) {

319 if (child.tag === "subroutine") {

Lines 1557-1599javascript

1557 result = args.length > 0 ? args[0] === 0 : true;

1558 break;

1559 case "same":

1560 case "strcmp":

1561 result = stringArgs.

dist/shell-KREANC2A.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 BraKetParser,

4 integrate

5} from "./chunk-PKLOBITC.js";

6import "./chunk-ECAW4X46.js";

7import "./chunk-SLGJRZ3P.js";

8import {

9 DiracParser