effect-analyzer@3.2.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

effect-analyzer@3.2.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/rules.jsView file

88`&&c.push(S+1);let s=new Map,a=/\/\/\s*(eslint|effect-analyzer)-disable-(next-line|line)\b([^\n]*)/g,l;for(;(l=a.exec(o))!==null;){let S=l.index,b=1;for(let T=1;T<c.length&&!(c[T]>... L89: `)},jd=(e=!0)=>JSON.stringify(Ke(),null,e?2:0),Fa=()=>Ke().map(e=>({id:`${e.domain}:${e.code}`,code:e.code,domain:e.domain,severity:e.severity,confidence:e.confidence,title:e.title... L90: `).trimEnd()},Nf=(e,t)=>Pt(e).idsBySpanPath.get(Tn(t))??[];import{Option as Bi}from"effect";var wf=e=>{let t=[],n=new Map,r=0,i=0,o=0;for(let a of e){let l=Ya(a);t.push(...l);for(l...

High

Child Process

Package source references child process execution.

dist/rules.jsView on unpkg · L88

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a==="param"){let f=/^(?:\{[^}]*\}\... L5: `)}function Cd(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

dist/migration.cjsView file

3`).map(l=>l.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],s,r=[],c,f=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,d;for(;(d=f.exec(t))!==null;){let l=d[1].toLowerCase(),a=d[2].trim();if(l==="param"){let i=/^(?:\{[^}]*\}\... L5: `)}function jr(e){return(e??"").replace(/\s+/g," ").trim()}function Vr(e,t){return`${e.filePath}::${e.pattern}::${jr(e.codeSnippet)}::${t}`}function qr(e){let t=new Map,n=new Map;f...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/migration.cjsView on unpkg · L3

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `))}return t});function kn(e){let t=n=>r=>e?`\x1B[${n}m${r}\x1B[0m`:r;return{dim:t(2),green:t(32),cyan:t(36),yellow:t(33),red:t(31),bold:t(1)}}var Al=e=>{let t=e??".";if(lm(t))retu... `)}function ry(e){return e.replace(/'/g,"\\'").replace(/"/g,'\\"')}import{Effect as Ml}from"effect";var Ol=1,jl={pretty:!0,includeMetadata:!0,compact:!1},Kl=(e,t)=>Ml.gen(function*... `)}),as=(e,t,n,r="TB",s=!0,i,o=!1)=>Rn.gen(function*(){let a=qy(e,n),d=yield*Uy(t,r,s,i,o,e);return yield*Rn.tryPromise({try:()=>to.writeFile(a,d,"utf-8"),catch:l=>new os({outputPa... `)},Gy=(e,t)=>{let n=it.dirname(e),r=t.replace(/[^a-zA-Z0-9_-]/g,"_").toLowerC

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

250`+on(y??{runtimes:[],commandDefinitions:[],layerAssemblies:[],filesScanned:0},e)));let b=s.allPrograms.length,L=m?r.green(`Analyzed ${String(p)} file(s) with Effect programs, wrote... L251: ${r.bold(A)}`);for(let C of v)yield*de.log(` ${C.filePath} (${x(C.metricValue)})`),yield*de.log(` ${r.dim(C.tip)}`)});yield*w("Top offenders: largest programs",$.largestProgra... L252: `)}function uf(e){return['<!doctype html><html><head><meta charset="utf-8">',`<style>body{margin:0;background:${we.bg};display:flex;flex-direction:column;gap:24px;padding:24px;}</s...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L250

250

scripts/analyze-public-repos.tsView file

15Cross-file remote execution chain: scripts/analyze-public-repos.ts spawns dist/cli.js; helper contains network access plus dynamic code execution. L15: import { join, resolve } from 'path'; L16: import { execFileSync, spawnSync } from 'child_process'; L17: L18: const ROOT = resolve(process.cwd()); L19: const ANALYSIS_DIR = join(ROOT, '.analysis-output'); ... L22: const REPOS: { name: string; url: string }[] = [ L23: { name: 'typed', url: 'https://github.com/TylorS/typed.git' }, L24: { name: 'effect-http', url: 'https://github.com/sukovanej/effect-http.git' }, ... L93: try { L94: const json = JSON.parse(readFileSync(auditPath, 'utf-8')); L95: return {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/analyze-public-repos.tsView on unpkg · L15

Source & flagged code

7 flagged

dist/rules.jsView file

Lines 1-23javascript

1import{createRequire as ji}from"module";var dt=null,vn=null,wn=new Map,An=e=>globalThis.process?.getBuiltinModule?.(e),Ui=()=>{let e=An("node:module")??An("module"),t=e&&typeof e=="object"&&"createRequire"in e?e.createRequire:void 0;if(!t)return null;try{return t(import.meta.url)("ts-morph")}catch{return null}};var Rn=e=>{vn=e,dt=null};var E=()=>{if(dt)return dt;let e=vn?.()??Ui();if(!e)throw new Error("ts-morph is not configured. In Node, install ts-morph as a dependency. In browser builds, call setTsMorphModule() or setTsMorphLoader() before analysis.");return dt=e,e},Fn=e=>{let t=e??"__defa ...

2`);else return;let a=s.search(/\n\s*@/);return a!==-1&&(s=s.substring(0,a)),s.trim()||void 0}let o=r.getText(),c=/\/\*\*\s*\n?\s*\*\s*([^@]*?)(?=\n\s*\*\s*@|\*\/)/.exec(o);if(c?.[1])return c[1].replace(/\n\s*\*\s*/g," ").trim()||void 0}let n=e.getLeadingCommentRanges();if(n.length>0){let r=n[n.length-1];if(!r)return;let i=r.getText();if(i.startsWith("/**")){let o=i.replace(/^\/\*\*\s*/,"").replace(/\s*\*\/\s*$/,"").replace(/^\s*\*\s?/gm,"").trim(),c=o.search(/\n

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(`

4`),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a

5`)}function Cd(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,message:t.message,fix:t.fix,location:t.location?{line:t.location.line,column:t.location.column}:void 0,nodeId:t.nodeId}))},null,2)}function wd(e){return e.valid&&e.warnings.length===0?"All strict mode checks passed":e.valid?`Passed with ${e.warnings.length} warning(s)`:`${e.errors.length} error(s), ${e.warnings.length} warning(s)`}import{Option as ge}from"effect";import{Option as Cs}from"effect";var ct=(e,t)=>{t(e);l ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

6`)};var J="https://effect.website/docs",wi={"untagged-throw":{docsUrl:`${J}/error-management/expected-errors/`,example:{bad:`Effect.gen(function* () {

7 if (!user) throw new Error("not found");

8});`,good:`class UserNotFound extends Data.TaggedError("UserNotFound")<{}> {}

9

10Effect.gen(function* () {

11 if (!user) return yield* Effect.fail(new UserNotFound());

12});`}},"identity-catch":{docsUrl:`${J}/error-management/fallback/`,example:{bad:"Effect.catch(eff, (e) => Effect.fail(e));",good:`// Either drop the catch entirely, or actually recover:

13Effect.catch(eff, (e) => Effect.succeed(defaultValue));`}},"tryPromise-without-catch":{docsUrl:`${J}/error-management/unexpected-errors/`,example:{bad:'Effect.tryPromise(() => fetch("/x"));',good:`class FetchError extends Data.TaggedError("FetchError")<{ readonly cause: unknown }> {}

14

15Effect.tryPromise({

16 try: () => fetch("/x"),

17 catch: (e) => new FetchError({ cause: e }),

18});`}},"promise-api-in-gen":{docsUrl:`${J}/getting-started/creating-effects/`,example:{bad:`Effect.gen(function* () {

19 const results = Promise.all([a(), b()]);

20 return results;

21});`,good:`Effect.gen(function* () {

22 const results = yield* Effect.all([a, b], { concurrency: "unbounded" });

23 return results;

Long lines were clipped for display.

Lines 68-104javascript

68 yield* TestClock.adjust("5 minutes");

69 // assertions

70 }).pipe(Effect.provide(TestContext.TestContext), Effect.runPromise),

71);`}},"detached-fiber-in-test":{docsUrl:`${J}/concurrency/fibers/`,example:{bad:`it("forks"

dist/migration.cjsView file

Lines 1-17javascript

1"use strict";var kt=Object.defineProperty;var Cs=Object.getOwnPropertyDescriptor;var Ts=Object.getOwnPropertyNames;var ws=Object.prototype.hasOwnProperty;var As=(e,t

dist/cli.jsView file

Lines 230-270javascript

230`+Co(g));else t.errorChannel&&l?yield*ir(l,t,{json:bu,markdown:Eu}):t.serviceHealth&&f?yield*ir(f,t,{json:vu,markdown:Nu}):t.performance&&u?yield*ir(u,t,{json:Au,markdown:ku}):t.coupling&&p&&(yield*ir(p,t,{json:Iu,markdown:Pu}))}),Wu=(e,t)=>hr.gen(function*(){let n=t.profile?new Set(Vd(t.profile)):void 0,r=o=>n?o.filter(a=>n.has(a.code)):o,s;if(t.listRules){let o=JSON.parse(Zd(!0));s=r(o)}else if(t.indexRules)s=r(xo());else if(t.searchRules)s=r(Gd(t.searchRules).map(o=>o.doc));else{let o=t.explainRule?Qd(t.explainRule):void 0;s=o?[o]:[]}let i={meta:{generatedAt:Cs.formatIso(yield*Cs.now),comma ...

231`)},gE=(e,t)=>{let n=e.assessment,r=[`Coverage audit for ${t.

scripts/analyze-public-repos.tsView file

Lines 1-35typescript

1/**

2 * Clone public Effect repos into .analysis-output/, run effect-analyze (colocated

3 * .effect-analysis.md), and optionally run coverage audit and append a one-line

4 * summary to .analysis-output/NOTES.md.

5 *

6 * Usage: pnpm build && pnpm run analyze:public-repos [--refresh]

7 *

8 * --refresh Re-clone repos that already exist (default: skip existing clones).

9 *

10 * After running, review generated .effect-analysis.md files under .analysis-output