registry / dna-sdk / 0.6.0

dna-sdk@0.6.0

DNA — Domain Notation of Anything (TypeScript SDK)

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 890 KB of source, external domains: agents.md, github.com

Source & flagged code

3 flagged

dist/kernel/instance.jsView file

Lines 7-47javascript

7 * Method bodies delegate to namespace classes (PromptBuilder, CompositionEngine,

8 * Navigator, LockManager) and viz/ functions. The old API surface is preserved

9 * as one-line delegates for backwards compatibility.

10 *

11 * 1:1 parity with Python dna.v3.kernel.instance.

12 */

13import { readSpecString, readSpecStringArray } from "./spec-access.js";

14import { ScannerPipeline } from "./safety-scanner.js";

15import { profileForOrchestrator } from "./composition-resolver.js";

16import { PromptBuilder } from "./prompt-builder.js";

17import { CompositionEngine } from "./composition-resolver.js";

18import { Navigator } from "./navigator.js";

19import { LockManager } from "./lock-manager.js";

20import { ReportBuilder } from "./reports.js";

21// Viz imports — all use `import type { ManifestInstance }` so no circular issue at runtime.

22import { dependencyTreeMermaid as vizDependencyTreeMermaid, compositionFlowchartMermaid as vizCompositionFlowchartMermaid, c4ComponentMermaid as vizC4ComponentMermaid, erDiagramMermaid as vizErDiagramMermaid, erModel as vizErModel, mindmapMermaid as vizMindmapMermaid, pieChartMermaid as vizPieChartMermaid, quadrantMermaid as vizQuadrantMermaid, timelineMermaid as vizTimelineMermaid, sankeyMermaid as vizSankeyMermaid, kindCatalogMermaid as vizKindCatalogMermaid, exportDiagramsMd as vizExportDiagramsMd, } from "../viz/mermaid.js";

23import { healthReport as vizHealthReport, impact as vizImpact } from "../viz/health.js";

24import { matrix as vizMatrix, matrixMarkdown as vizMatrixMarkdown } from "../viz/matrix.js";

25import { asciiTree as vizAsciiTree } from "../viz/ascii.js";

26/**

27 * s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run

28 * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a

29 * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

30 * an unauthenticated RCE in the host process. Opt in with

31 * `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` only in trusted single-tenant deployments.

32 * 1:1 with the Python twin (dna.operations._hook_script_exec_allowed).

33 */

34function hookScriptExecAllowed() {

35 return (typeof process !== "undefined" &&

36 process.env?.DNA_ALLOW_HOOK_SCRIPT_EXEC === "1");

37}

38// ---------------------------------------------------------------------------

39// Deprecation plumbing (s-blessed-query-surface)

40// ---------------------------------------------------------------------------

41/** Methods that already fired their once-per-process deprecation warning. */

42const _deprecationWarned = new Set();

43/** `console.warn` a deprecation message once per method per process —

44 * mirror of the Python `DeprecationWarning` on the same members. */

45function warnDeprecatedOnce(method, message) {

46 if (_deprecationWarned.has(method))

47 return;

dist/adapters/embedding/onnx.jsView file

Lines 4-44javascript

4export const ONNX_DIMS = 384;

5/**

6 * `EmbeddingPort` backed by transformers.js feature-extraction. The heavy

7 * dynamic import (`@huggingface/transformers`) is deferred to first use so

8 * merely importing this module never pulls ML deps into a process that does not

9 * embed.

10 */

11export class OnnxEmbeddingProvider {

dist/adapters/source-url.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dna-sdk@0.2.0 matchedIdentity = npm:ZG5hLXNkaw:0.2.0 similarity = 0.899 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/source-url.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/kernel/instance.jsView file

27* s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run L28: * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a L29: * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

dist/adapters/embedding/onnx.jsView file

24// type declarations are NOT installed by default, so a literal L25: // `import("@huggingface/transformers")` would fail `tsc --noEmit` in CI L26: // with TS2307. A string variable makes the dynamic import resolve to

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/embedding/onnx.jsView on unpkg · L24

dist/adapters/source-url.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/source-url.jsView on unpkg

Findings

1 High2 Medium5 Low

HighPrevious Version Dangerous Deltadist/adapters/source-url.js

MediumDynamic Requiredist/adapters/embedding/onnx.js

MediumEnvironment Vars

LowScripts Present

LowEvaldist/kernel/instance.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/kernel/instance.jsView file

Lines 7-47javascript

7 * Method bodies delegate to namespace classes (PromptBuilder, CompositionEngine,

8 * Navigator, LockManager) and viz/ functions. The old API surface is preserved

9 * as one-line delegates for backwards compatibility.

10 *

11 * 1:1 parity with Python dna.v3.kernel.instance.

12 */

13import { readSpecString, readSpecStringArray } from "./spec-access.js";

14import { ScannerPipeline } from "./safety-scanner.js";

15import { profileForOrchestrator } from "./composition-resolver.js";

16import { PromptBuilder } from "./prompt-builder.js";

17import { CompositionEngine } from "./composition-resolver.js";

18import { Navigator } from "./navigator.js";

19import { LockManager } from "./lock-manager.js";

20import { ReportBuilder } from "./reports.js";

21// Viz imports — all use `import type { ManifestInstance }` so no circular issue at runtime.

23import { healthReport as vizHealthReport, impact as vizImpact } from "../viz/health.js";

24import { matrix as vizMatrix, matrixMarkdown as vizMatrixMarkdown } from "../viz/matrix.js";

25import { asciiTree as vizAsciiTree } from "../viz/ascii.js";

26/**

27 * s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run

28 * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a

29 * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

30 * an unauthenticated RCE in the host process. Opt in with

31 * `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` only in trusted single-tenant deployments.

32 * 1:1 with the Python twin (dna.operations._hook_script_exec_allowed).

33 */

34function hookScriptExecAllowed() {

35 return (typeof process !== "undefined" &&

36 process.env?.DNA_ALLOW_HOOK_SCRIPT_EXEC === "1");

37}

38// ---------------------------------------------------------------------------

39// Deprecation plumbing (s-blessed-query-surface)

40// ---------------------------------------------------------------------------

41/** Methods that already fired their once-per-process deprecation warning. */

42const _deprecationWarned = new Set();

43/** `console.warn` a deprecation message once per method per process —

44 * mirror of the Python `DeprecationWarning` on the same members. */

45function warnDeprecatedOnce(method, message) {

46 if (_deprecationWarned.has(method))

47 return;

dist/adapters/embedding/onnx.jsView file

Lines 4-44javascript

4export const ONNX_DIMS = 384;

5/**

6 * `EmbeddingPort` backed by transformers.js feature-extraction. The heavy

7 * dynamic import (`@huggingface/transformers`) is deferred to first use so

8 * merely importing this module never pulls ML deps into a process that does not

9 * embed.

10 */

11export class OnnxEmbeddingProvider {

dist/adapters/source-url.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/source-url.jsView on unpkg