registry / Remote code execution / effect-analyzer / 3.5.0

effect-analyzer@3.5.0

Static analysis for Effect-TS code. Analyze Effect code to extract structure, calculate complexity, and generate visualizations.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not shown to be malware, but its reachable CLI has a concrete command-injection flaw. The scanner's credential-redirection claim was not confirmed by source inspection.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run effect-analyze with a diff source containing shell metacharacters.

Impact

An attacker controlling a diff argument could run commands as the CLI user.

Mechanism

Shell command injection through interpolated git show arguments.

AI rationale

The package is not shown to be malware, but its reachable CLI has a concrete command-injection flaw. The scanner's credential-redirection claim was not confirmed by source inspection.

Evidence

dist/cli.jsdist/migration.cjs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The public CLI interpolates diff reference and path values into a shell command.
The migration export contains the same unsafe shell construction.
The manifest exposes the affected CLI as effect-analyze.

Evidence against

There are no preinstall, install, or postinstall hooks.
No credential collection, fixed exfiltration endpoint, or persistence behavior was confirmed.
The public-repository helper uses fixed clone URLs and argument-array process calls.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 3.86 MB of source, external domains: effect.website, github.com, jagreehal.github.io, json.schemastore.org

Source & flagged code

9 flagged

dist/rules.jsView file

Lines 1-23javascript

1import{createRequire as Yi}from"module";var dt=null,Rn=null,An=new Map,vn=e=>globalThis.process?.getBuiltinModule?.(e),Gi=()=>{let e=vn("node:module")??vn("module"),t=e&&typeof e=="object"&&"createRequire"in e?e.createRequire:void 0;if(!t)return null;try{return t(import.meta.url)("ts-morph")}catch{return null}};var Fn=e=>{Rn=e,dt=null};var E=()=>{if(dt)return dt;let e=Rn?.()??Gi();if(!e)throw new Error("ts-morph is not configured. In Node, install ts-morph as a dependency. In browser builds, call setTsMorphModule() or setTsMorphLoader() before analysis.");return dt=e,e},kn=e=>{let t=e??"__defa ...

2`);else return;let a=s.search(/\n\s*@/);return a!==-1&&(s=s.substring(0,a)),s.trim()||void 0}let o=r.getText(),c=/\/\*\*\s*\n?\s*\*\s*([^@]*?)(?=\n\s*\*\s*@|\*\/)/.exec(o);if(c?.[1])return c[1].replace(/\n\s*\*\s*/g," ").trim()||void 0}let n=e.getLeadingCommentRanges();if(n.length>0){let r=n[n.length-1];if(!r)return;let i=r.getText();if(i.startsWith("/**")){let o=i.replace(/^\/\*\*\s*/,"").replace(/\s*\*\/\s*$/,"").replace(/^\s*\*\s?/gm,"").trim(),c=o.search(/\n

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(`

4`),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a

5`)}function Rd(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,message:t.message,fix:t.fix,location:t.location?{line:t.location.line,column:t.location.column}:void 0,nodeId:t.nodeId}))},null,2)}function Fd(e){return e.valid&&e.warnings.length===0?"All strict mode checks passed":e.valid?`Passed with ${e.warnings.length} warning(s)`:`${e.errors.length} error(s), ${e.warnings.length} warning(s)`}import{Option as ge}from"effect";import{Option as Fs}from"effect";var ct=(e,t)=>{t(e);l ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

6`)};var J="https://effect.website/docs",Ai={"untagged-throw":{docsUrl:`${J}/error-management/expected-errors/`,example:{bad:`Effect.gen(function* () {

7 if (!user) throw new Error("not found");

8});`,good:`class UserNotFound extends Data.TaggedError("UserNotFound")<{}> {}

10Effect.gen(function* () {

11 if (!user) return yield* Effect.fail(new UserNotFound());

12});`}},"identity-catch":{docsUrl:`${J}/error-management/fallback/`,example:{bad:"Effect.catch(eff, (e) => Effect.fail(e));",good:`// Either drop the catch entirely, or actually recover:

13Effect.catch(eff, (e) => Effect.succeed(defaultValue));`}},"tryPromise-without-catch":{docsUrl:`${J}/error-management/unexpected-errors/`,example:{bad:'Effect.tryPromise(() => fetch("/x"));',good:`class FetchError extends Data.TaggedError("FetchError")<{ readonly cause: unknown }> {}

15Effect.tryPromise({

16 try: () => fetch("/x"),

17 catch: (e) => new FetchError({ cause: e }),

18});`}},"promise-api-in-gen":{docsUrl:`${J}/getting-started/creating-effects/`,example:{bad:`Effect.gen(function* () {

19 const results = Promise.all([a(), b()]);

20 return results;

21});`,good:`Effect.gen(function* () {

22 const results = yield* Effect.all([a, b], { concurrency: "unbounded" });

23 return results;

Long lines were clipped for display.

Lines 68-104javascript

68 yield* TestClock.adjust("5 minutes");

69 // assertions

70 }).pipe(Effect.provide(TestContext.TestContext), Effect.runPromise),

71);`}},"detached-fiber-in-test":{docsUrl:`${J}/concurrency/fibers/`,example:{bad:`it("forks"

dist/migration.cjsView file

Lines 1-17javascript

1"use strict";var It=Object.defineProperty;var ws=Object.getOwnPropertyDescriptor;var As=Object.getOwnPropertyNames;var ks=Object.prototype.hasOwnProperty;var Is=(e,t

dist/cli.jsView file

Lines 233-273javascript

233`+Io(m));else t.errorChannel&&c?yield*cr(c,t,{json:ju,markdown:Ou}):t.serviceHealth&&f?yield*cr(f,t,{json:_u,markdown:zu}):t.performance&&u?yield*cr(u,t,{json:Hu,markdown:qu}):t.coupling&&p&&(yield*cr(p,t,{json:Zu,markdown:Ju}))}),rf=(e,t)=>xr.gen(function*(){let n=t.profile?new Set(cu(t.profile)):void 0,r=o=>n?o.filter(a=>n.has(a.code)):o,s;if(t.listRules){let o=JSON.parse(uu(!0));s=r(o)}else if(t.indexRules)s=r(ko());else if(t.searchRules)s=r(lu(t.searchRules).map(o=>o.doc));else{let o=t.explainRule?fu(t.explainRule):void 0;s=o?[o]:[]}let i={meta:{generatedAt:Rs.formatIso(yield*Rs.now),comma ...

234`)},UE=(e,t)=>{let n=e.assessment,r=[`Coverage audit for ${t.

scripts/analyze-public-repos.tsView file

Lines 1-35typescript

1/**

2 * Clone public Effect repos into .analysis-output/, run effect-analyze (colocated

3 * .effect-analysis.md), and optionally run coverage audit and append a one-line

4 * summary to .analysis-output/NOTES.md.

5 *

6 * Usage: pnpm build && pnpm run analyze:public-repos [--refresh]

7 *

8 * --refresh Re-clone repos that already exist (default: skip existing clones).

9 *

10 * After running, review generated .effect-analysis.md files under .analysis-output

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/rules.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = effect-analyzer@3.2.0 matchedIdentity = npm:ZWZmZWN0LWFuYWx5emVy:3.2.0 similarity = 0.821 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/rules.cjsView on unpkg

Source & flagged code

9 flagged · loading source

dist/rules.jsView file

88`&&c.push(m+1);let s=new Map,a=/\/\/\s*(eslint|effect-analyzer)-disable-(next-line|line)\b([^\n]*)/g,l;for(;(l=a.exec(o))!==null;){let m=l.index,b=1;for(let T=1;T<c.length&&!(c[T]>... L89: `)},Yd=(e=!0)=>JSON.stringify(Me(),null,e?2:0),Ia=()=>Me().map(e=>({id:`${e.domain}:${e.code}`,code:e.code,domain:e.domain,severity:e.severity,confidence:e.confidence,title:e.title... L90: `).trimEnd()},Au=(e,t)=>Lt(e).idsBySpanPath.get(bn(t))??[];import{Option as Vi}from"effect";var ku=e=>{let t=[],n=new Map,r=0,i=0,o=0;for(let a of e){let l=Qa(a);t.push(...l);for(l...

High

Child Process

Package source references child process execution.

dist/rules.jsView on unpkg · L88

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a==="param"){let u=/^(?:\{[^}]*\}\... L5: `)}function Rd(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

dist/migration.cjsView file

Findings

1 Critical8 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/rules.cjs

HighChild Processdist/rules.js

HighShell

HighSame File Env Network Executiondist/migration.cjs

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextscripts/analyze-public-repos.ts

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

HighSemantic Analysis Limitedpackage.json

MediumDynamic Requiredist/rules.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to effect-analyzer@3.5.0.

See all versions of effect-analyzer for other recorded verdicts.

Review the evidence and your use of effect-analyzer@3.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 07:27:30.669Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code