registry / effect-analyzer / 3.6.0

effect-analyzer@3.6.0

Static analysis for Effect-TS code. Analyze Effect code to extract structure, calculate complexity, and generate visualizations.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Direct inspection did not substantiate the scanner's credential-redirection finding: the manifest has no install hook, and the CLI contains no matching credential or gateway indicators. The reviewed entrypoints and flagged paths support ordinary analysis-tool behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The command-line tool runs when a user invokes it; the manifest has no install lifecycle hook.

Impact

No malicious effect was established from the inspected source.

Mechanism

The inspected command dispatches analysis operations on user-supplied paths. Searches of its bundled source found no credential redirection or gateway configuration.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a command-line tool and lists no install lifecycle hook.
The inspected CLI dispatches user-supplied analysis commands; searches found no credential prompt, unofficial gateway, or credential-redirection setting.
The inspected dependency files belong to TypeScript analysis and execution tooling; no malicious behavior was identified in the reviewed paths.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 3.89 MB of source, external domains: cdn.jsdelivr.net, effect.website, github.com, jagreehal.github.io, json.schemastore.org, www.w3.org

Source & flagged code

6 flagged

dist/rules.jsView file

Lines 1-23javascript

1import{createRequire as Xi}from"module";var ut=null,Fn=null,vn=new Map,Rn=e=>globalThis.process?.getBuiltinModule?.(e),Zi=()=>{let e=Rn("node:module")??Rn("module"),t=e&&typeof e=="object"&&"createRequire"in e?e.createRequire:void 0;if(!t)return null;try{return t(import.meta.url)("ts-morph")}catch{return null}};var kn=e=>{Fn=e,ut=null};var E=()=>{if(ut)return ut;let e=Fn?.()??Zi();if(!e)throw new Error("ts-morph is not configured. In Node, install ts-morph as a dependency. In browser builds, call setTsMorphModule() or setTsMorphLoader() before analysis.");return ut=e,e},Pn=e=>{let t=e??"__defa ...

2`);else return;let a=s.search(/\n\s*@/);return a!==-1&&(s=s.substring(0,a)),s.trim()||void 0}let o=r.getText(),c=/\/\*\*\s*\n?\s*\*\s*([^@]*?)(?=\n\s*\*\s*@|\*\/)/.exec(o);if(c?.[1])return c[1].replace(/\n\s*\*\s*/g," ").trim()||void 0}let n=e.getLeadingCommentRanges();if(n.length>0){let r=n[n.length-1];if(!r)return;let i=r.getText();if(i.startsWith("/**")){let o=i.replace(/^\/\*\*\s*/,"").replace(/\s*\*\/\s*$/,"").replace(/^\s*\*\s?/gm,"").trim(),c=o.search(/\n

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(`

4`),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a

5`)}function Ld(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,message:t.message,fix:t.fix,location:t.location?{line:t.location.line,column:t.location.column}:void 0,nodeId:t.nodeId}))},null,2)}function Dd(e){return e.valid&&e.warnings.length===0?"All strict mode checks passed":e.valid?`Passed with ${e.warnings.length} warning(s)`:`${e.errors.length} error(s), ${e.warnings.length} warning(s)`}import{Option as ge}from"effect";import{Option as Ds}from"effect";var lt=(e,t)=>{t(e);l ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

6`)};var J="https://effect.website/docs",Fi={"untagged-throw":{docsUrl:`${J}/error-management/expected-errors/`,example:{bad:`Effect.gen(function* () {

7 if (!user) throw new Error("not found");

8});`,good:`class UserNotFound extends Data.TaggedError("UserNotFound")<{}> {}

10Effect.gen(function* () {

11 if (!user) return yield* Effect.fail(new UserNotFound());

12});`}},"identity-catch":{docsUrl:`${J}/error-management/fallback/`,example:{bad:"Effect.catch(eff, (e) => Effect.fail(e));",good:`// Either drop the catch entirely, or actually recover:

13Effect.catch(eff, (e) => Effect.succeed(defaultValue));`}},"tryPromise-without-catch":{docsUrl:`${J}/error-management/unexpected-errors/`,example:{bad:'Effect.tryPromise(() => fetch("/x"));',good:`class FetchError extends Data.TaggedError("FetchError")<{ readonly cause: unknown }> {}

15Effect.tryPromise({

16 try: () => fetch("/x"),

17 catch: (e) => new FetchError({ cause: e }),

18});`}},"promise-api-in-gen":{docsUrl:`${J}/getting-started/creating-effects/`,example:{bad:`Effect.gen(function* () {

19 const results = Promise.all([a(), b()]);

20 return results;

21});`,good:`Effect.gen(function* () {

22 const results = yield* Effect.all([a, b], { concurrency: "unbounded" });

23 return results;

Long lines were clipped for display.

Lines 68-104javascript

68 yield* TestClock.adjust("5 minutes");

69 // assertions

70 }).pipe(Effect.provide(TestContext.TestContext), Effect.runPromise),

71);`}},"detached-fiber-in-test":{docsUrl:`${J}/concurrency/fibers/`,example:{bad:`it("forks"

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `))}return t});function Dn(e){let t=n=>r=>e?`\x1B[${n}m${r}\x1B[0m`:r;return{dim:t(2),green:t(32),cyan:t(36),yellow:t(33),red:t(31),bold:t(1)}}var us=e=>{let t=e??".";if(ed(t))retu... `)}function oh(e){return e.replace(/'/g,"\\'").replace(/"/g,'\\"')}import{Effect as ld}from"effect";var dd=1,ud={pretty:!0,includeMetadata:!0,compact:!1},fd=(e,t)=>ld.gen(function*... `)}),Ss=(e,t,n,r="TB",s=!0,i,o=!1)=>fn.gen(function*(){let a=Vh(e,n),d=yield*Zh(t,r,s,i,o,e);return yield*fn.tryPromise({try:()=>Eo.writeFile(a,d,"utf-8"),catch:l=>new hs({outputPa... `)},Yh=(e,t)=>{let n=st.dirname(e),r=t.replace(/[^a-zA-Z0-9_-]/g,"_").toLowerC

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

scripts/analyze-public-repos.tsView file

Lines 1-35typescript

1/**

2 * Clone public Effect repos into .analysis-output/, run effect-analyze (colocated

3 * .effect-analysis.md), and optionally run coverage audit and append a one-line

4 * summary to .analysis-output/NOTES.md.

5 *

6 * Usage: pnpm build && pnpm run analyze:public-repos [--refresh]

7 *

8 * --refresh Re-clone repos that already exist (default: skip existing clones).

9 *

10 * After running, review generated .effect-analysis.md files under .analysis-output

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/analysis.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = effect-analyzer@3.5.0 matchedIdentity = npm:ZWZmZWN0LWFuYWx5emVy:3.5.0 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/analysis.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/rules.jsView file

88`&&c.push(m+1);let s=new Map,a=/\/\/\s*(eslint|effect-analyzer)-disable-(next-line|line)\b([^\n]*)/g,l;for(;(l=a.exec(o))!==null;){let m=l.index,b=1;for(let T=1;T<c.length&&!(c[T]>... L89: `)},Qd=(e=!0)=>JSON.stringify(Me(),null,e?2:0),Wa=()=>Me().map(e=>({id:`${e.domain}:${e.code}`,code:e.code,domain:e.domain,severity:e.severity,confidence:e.confidence,title:e.title... L90: `).trimEnd()},ku=(e,t)=>Dt(e).idsBySpanPath.get(Cn(t))??[];import{Option as Ji}from"effect";var Iu=e=>{let t=[],n=new Map,r=0,i=0,o=0;for(let a of e){let l=rc(a);t.push(...l);for(l...

High

Child Process

Package source references child process execution.

dist/rules.jsView on unpkg · L88

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a==="param"){let u=/^(?:\{[^}]*\}\... L5: `)}function Ld(e){return JSON.stringify({valid:e.valid,errorCount:e.errors.length,warningCount:e.warnings.length,diagnostics:e.diagnostics.map(t=>({rule:t.rule,severity:t.severity,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

dist/cli.jsView file

Findings

1 Critical5 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/analysis.cjs

HighChild Processdist/rules.js

HighShell

HighCredential Redirect Persistencedist/cli.js

HighCross File Remote Execution Contextscripts/analyze-public-repos.ts

HighSemantic Analysis Limitedpackage.json

MediumDynamic Requiredist/rules.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to effect-analyzer@3.6.0.

See all versions of effect-analyzer for other recorded verdicts.

Review the evidence and your use of effect-analyzer@3.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 16:03:40.011Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code