registry / dna-sdk / 0.9.0

dna-sdk@0.9.0

DNA — Domain Notation of Anything (TypeScript SDK)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A host that explicitly enables script Hooks can execute JavaScript supplied in Hook document bodies. Network and process execution are exposed through explicit resolver APIs, not installation or import.

Static reason

No blocking static signals were detected.

Trigger

A host sets `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` and calls `applyHooks()` on an untrusted Hook document.

Impact

Arbitrary code execution in the opted-in host process.

Mechanism

Opt-in compilation of data-backed Hook bodies with `new Function`.

Rationale

No concrete malicious behavior was found, but the guarded, data-backed script-Hook path is a real high-impact dangerous capability if enabled for untrusted documents. Downgrade to warn rather than block because it is disabled by default and requires explicit host opt-in.

Evidence

package.jsondist/index.jsdist/kernel/instance.jsdist/adapters/resolvers/http.jsdist/adapters/resolvers/github.jsdist/adapters/embedding/onnx.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/kernel/instance.js` compiles Hook `spec.body` with `new Function`.
Script Hook bodies originate from package-managed `HOOK.md` documents.
Execution is enabled only with `DNA_ALLOW_HOOK_SCRIPT_EXEC=1`.
`dist/adapters/resolvers/http.js` invokes `curl` only when `HttpResolver.resolve()` is called.
`dist/adapters/resolvers/github.js` invokes `git clone` only when `GitHubResolver.resolve()` is called.

Evidence against

`package.json` contains no preinstall, install, or postinstall hook.
`dist/index.js` is export-only; inspection found no import-time network or shell action.
Default Hook behavior skips script execution and emits a warning.
Dynamic ONNX import is an optional peer dependency used only by `embed()`.
No credential harvesting, exfiltration endpoint, destructive action, or agent-control-surface mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 111 file(s), 914 KB of source, external domains: agents.md, github.com, raw.githubusercontent.com

Source & flagged code

2 flagged

dist/kernel/instance.jsView file

Lines 7-47javascript

7 * Method bodies delegate to namespace classes (PromptBuilder, CompositionEngine,

8 * Navigator, LockManager) and viz/ functions. The old API surface is preserved

9 * as one-line delegates for backwards compatibility.

10 *

11 * 1:1 parity with Python dna.v3.kernel.instance.

12 */

13import { readSpecString, readSpecStringArray } from "./spec-access.js";

14import { ScannerPipeline } from "./safety-scanner.js";

15import { profileForOrchestrator } from "./composition-resolver.js";

16import { PromptBuilder } from "./prompt-builder.js";

17import { CompositionEngine } from "./composition-resolver.js";

18import { Navigator } from "./navigator.js";

19import { LockManager } from "./lock-manager.js";

20import { ReportBuilder } from "./reports.js";

21// Viz imports — all use `import type { ManifestInstance }` so no circular issue at runtime.

22import { dependencyTreeMermaid as vizDependencyTreeMermaid, compositionFlowchartMermaid as vizCompositionFlowchartMermaid, c4ComponentMermaid as vizC4ComponentMermaid, erDiagramMermaid as vizErDiagramMermaid, erModel as vizErModel, mindmapMermaid as vizMindmapMermaid, pieChartMermaid as vizPieChartMermaid, quadrantMermaid as vizQuadrantMermaid, timelineMermaid as vizTimelineMermaid, sankeyMermaid as vizSankeyMermaid, kindCatalogMermaid as vizKindCatalogMermaid, exportDiagramsMd as vizExportDiagramsMd, } from "../viz/mermaid.js";

23import { healthReport as vizHealthReport, impact as vizImpact } from "../viz/health.js";

24import { matrix as vizMatrix, matrixMarkdown as vizMatrixMarkdown } from "../viz/matrix.js";

25import { asciiTree as vizAsciiTree } from "../viz/ascii.js";

26/**

27 * s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run

28 * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a

29 * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

30 * an unauthenticated RCE in the host process. Opt in with

31 * `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` only in trusted single-tenant deployments.

32 * 1:1 with the Python twin (dna.operations._hook_script_exec_allowed).

33 */

34function hookScriptExecAllowed() {

35 return (typeof process !== "undefined" &&

36 process.env?.DNA_ALLOW_HOOK_SCRIPT_EXEC === "1");

37}

38// ---------------------------------------------------------------------------

39// Deprecation plumbing (s-blessed-query-surface)

40// ---------------------------------------------------------------------------

41/** Methods that already fired their once-per-process deprecation warning. */

42const _deprecationWarned = new Set();

43/** `console.warn` a deprecation message once per method per process —

44 * mirror of the Python `DeprecationWarning` on the same members. */

45function warnDeprecatedOnce(method, message) {

46 if (_deprecationWarned.has(method))

47 return;

dist/adapters/embedding/onnx.jsView file

Lines 4-44javascript

4export const ONNX_DIMS = 384;

5/**

6 * `EmbeddingPort` backed by transformers.js feature-extraction. The heavy

7 * dynamic import (`@huggingface/transformers`) is deferred to first use so

8 * merely importing this module never pulls ML deps into a process that does not

9 * embed.

10 */

11export class OnnxEmbeddingProvider {

Source & flagged code

2 flagged · loading source

dist/kernel/instance.jsView file

27* s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run L28: * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a L29: * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

dist/adapters/embedding/onnx.jsView file

24// type declarations are NOT installed by default, so a literal L25: // `import("@huggingface/transformers")` would fail `tsc --noEmit` in CI L26: // with TS2307. A string variable makes the dynamic import resolve to

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/embedding/onnx.jsView on unpkg · L24

Findings

2 Medium5 Low

MediumDynamic Requiredist/adapters/embedding/onnx.js

MediumEnvironment Vars

LowScripts Present

LowEvaldist/kernel/instance.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/kernel/instance.jsView file

Lines 7-47javascript

7 * Method bodies delegate to namespace classes (PromptBuilder, CompositionEngine,

8 * Navigator, LockManager) and viz/ functions. The old API surface is preserved

9 * as one-line delegates for backwards compatibility.

10 *

11 * 1:1 parity with Python dna.v3.kernel.instance.

12 */

13import { readSpecString, readSpecStringArray } from "./spec-access.js";

14import { ScannerPipeline } from "./safety-scanner.js";

15import { profileForOrchestrator } from "./composition-resolver.js";

16import { PromptBuilder } from "./prompt-builder.js";

17import { CompositionEngine } from "./composition-resolver.js";

18import { Navigator } from "./navigator.js";

19import { LockManager } from "./lock-manager.js";

20import { ReportBuilder } from "./reports.js";

21// Viz imports — all use `import type { ManifestInstance }` so no circular issue at runtime.

23import { healthReport as vizHealthReport, impact as vizImpact } from "../viz/health.js";

24import { matrix as vizMatrix, matrixMarkdown as vizMatrixMarkdown } from "../viz/matrix.js";

25import { asciiTree as vizAsciiTree } from "../viz/ascii.js";

26/**

27 * s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run

28 * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a

29 * Hook doc is reachable via the normal doc-write path, so executing its body is

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kernel/instance.jsView on unpkg · L27

30 * an unauthenticated RCE in the host process. Opt in with

31 * `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` only in trusted single-tenant deployments.

32 * 1:1 with the Python twin (dna.operations._hook_script_exec_allowed).

33 */

34function hookScriptExecAllowed() {

35 return (typeof process !== "undefined" &&

36 process.env?.DNA_ALLOW_HOOK_SCRIPT_EXEC === "1");

37}

38// ---------------------------------------------------------------------------

39// Deprecation plumbing (s-blessed-query-surface)

40// ---------------------------------------------------------------------------

41/** Methods that already fired their once-per-process deprecation warning. */

42const _deprecationWarned = new Set();

43/** `console.warn` a deprecation message once per method per process —

44 * mirror of the Python `DeprecationWarning` on the same members. */

45function warnDeprecatedOnce(method, message) {

46 if (_deprecationWarned.has(method))

47 return;

dist/adapters/embedding/onnx.jsView file

Lines 4-44javascript

4export const ONNX_DIMS = 384;

5/**

6 * `EmbeddingPort` backed by transformers.js feature-extraction. The heavy

7 * dynamic import (`@huggingface/transformers`) is deferred to first use so

8 * merely importing this module never pulls ML deps into a process that does not

9 * embed.

10 */

11export class OnnxEmbeddingProvider {