registry / Remote code execution / effect-analyzer / 3.8.0

effect-analyzer@3.8.0

Static analysis for Effect-TS code. Analyze Effect code to extract structure, calculate complexity, and generate visualizations.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Source inspection supports a warning for shell injection in an explicit CLI operation, not a malware block. The scanner's credential-gateway claim was not supported by the inspected CLI source.

Static reason

One or more suspicious static signals were detected.

Trigger

Running effect-analyze --diff with an attacker-controlled source argument or pull-request URL.

Impact

Injected shell syntax can execute commands with the invoking user's permissions.

Mechanism

Arguments are interpolated into commands executed through child_process.execSync without shell escaping.

AI rationale

Source inspection supports a warning for shell injection in an explicit CLI operation, not a malware block. The scanner's credential-gateway claim was not supported by the inspected CLI source.

Evidence

dist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cli.js interpolates Git references and paths into a shell command without escaping.
The explicit diff command passes its supplied source argument directly to that shell helper.
The GitHub pull-request helper also interpolates the supplied URL into a shell command.
package.json has no automatic install lifecycle or runtime self-dependency.
dist/rules.js resolves the declared local Effect compiler dependency.
scripts/analyze-public-repos.ts invokes the local analyzer with shell execution disabled.

Evidence against

No covert credential transfer or malicious install behavior was established.
The shell helpers serve explicit source-comparison commands; exploitation requires attacker-controlled arguments.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

5 flagged

dist/rules.jsView file

Lines 1-23javascript

1import{createRequire as no}from"module";var ut=null,Pn=null,Fn=new Map,kn=e=>globalThis.process?.getBuiltinModule?.(e),to=()=>{let e=kn("node:module")??kn("module"),t=e&&typeof e=="object"&&"createRequire"in e?e.createRequire:void 0;if(!t)return null;try{return t(import.meta.url)("ts-morph")}catch{return null}};var Ln=e=>{Pn=e,ut=null};var S=()=>{if(ut)return ut;let e=Pn?.()??to();if(!e)throw new Error("ts-morph is not configured. In Node, install ts-morph as a dependency. In browser builds, call setTsMorphModule() or setTsMorphLoader() before analysis.");return ut=e,e},Dn=e=>{let t=e??"__defa ...

2`);else return;let a=s.search(/\n\s*@/);return a!==-1&&(s=s.substring(0,a)),s.trim()||void 0}let o=r.getText(),c=/\/\*\*\s*\n?\s*\*\s*([^@]*?)(?=\n\s*\*\s*@|\*\/)/.exec(o);if(c?.[1])return c[1].replace(/\n\s*\*\s*/g," ").trim()||void 0}let n=e.getLeadingCommentRanges();if(n.length>0){let r=n[n.length-1];if(!r)return;let i=r.getText();if(i.startsWith("/**")){let o=i.replace(/^\/\*\*\s*/,"").replace(/\s*\*\/\s*$/,"").replace(/^\s*\*\s?/gm,"").trim(),c=o.search(/\n

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(`

4`),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a

5`).trimEnd()},Md=(e,t)=>Lt(e).idsBySpanPath.get(yn(t))??[];import{Option as Ee}from"effect";import{Option as Ks}from"effect";var ct=(e,t)=>{t(e);let n=$(e);if(Ks.isSome(n))for(let r of n.value)ct(r,t)},Ge=(e,t)=>{for(let n of e.root.children)ct(n,t)},Ws=e=>{let t=!1;return ct(e,n=>{if(!t&&Z(n)){let r=n.callee;(r.startsWith("Effect.log")||r.startsWith("console.")||r.includes("withSpan")||r.includes("annotateLogs"))&&(t=!0)}}),t},$s=e=>{if(!e||Ws(e))return!1;let t=!1;return ct(e,n=>{if(!Z(n))return;let r=n.callee;(r==="Effect.void"||r==="Effect.unit"||r==="Effect.succeed"||r==="Effect.succeedNon ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

6`)};import{Option as vi}from"effect";var Jd=e=>{let t=[],n=new Map,r=0,i=0,o=0;for(let a of e){

7`),t.push(`## Summary

8`),t.push(`- Total programs: ${n.totalPrograms}`),t.push(`- Programs with generic error: ${n.programsWithGenericError}`),t.push(`- Programs with no error handlers: ${n.programsWithNoErrorHandlers}`),t.push(`- Programs with unhandled errors: ${n.programsWithUnhandledErrors}`),t.push(""),n.topErrorTypes.length>0){t.push(`## Top Error Types

9`),t.push("| Error Type | Count |"),t.push("|------------|-------|");for(let{type:r,count:i}of n.topErrorTypes)t.push(`| \`${r}\` | ${i} |`);t.push("")}if(e.issues.length>0){t.push(`## Issues

10`);for(let r of e.issues){let i=r.severity==="error"?"\u274C":r.severity==="warning"?"\u26A0\uFE0F":"\u2139\uFE0F";t.push(`${i} **[${

11`)},Xd=(e,t=!0)=>JSON.stringify(e,null,t?2:0);import{createHash as ec}from"crypto";import*as Ye from"fs/promises";

12`)},iu=(e=!0)=>JSON.stringify(Ke(),null,e?2:0),oa=()=>Ke().map(e=>({id:`${e.domain}:${e.code}`,code:e.code,domain:e.domain,severity:e.severity,confidence:e.confidence,title:e.title,snippet:ke(`${e.description}${e.example?` Example: ${e.example}`:""}`)})),ou=(e=!0)=>JSON.stringify(oa(),null,e?2:0),su=(e,t)=>Rn(e,t);var X="https://effect.website/docs",ki={"untagged-throw":{docsUrl:`${X}/error-management/expected-errors/`,example:{bad:`Effect.gen(function* () {

13 if (!user) throw new Error("not found");

14});`,good:`class UserNotFound extends Data.TaggedError("UserNotFound")<{}> {}

16Effect.gen(function* () {

17 if (!user) return yield* Effect.fail(new UserNotFound());

18});`}},"identity-catch":{docsUrl:`${X}/error-management/fallback/`,example:{bad:"Effect.catch(eff, (e) => Effect.fail(e));",good:`// Either drop the catch entirely, or actually recover:

19Effect.catch(eff, (e) => Effect.succeed(defaultValue));`}},"tryPromise-without-catch":{docsUrl:`${X}/error-management/unexpected-errors/`,example:{bad:'Effect.tryPromise(() => fetch("/x"));',good:`class FetchError extends Data.TaggedError("FetchError")<{ readonly cause

21Effect.tryPromise({

22 try: () => fetch("/x"),

23 catch: (e) => new FetchError({ cause: e }),

Long lines were clipped for display.

Lines 73-104javascript

73 Effect.gen(function* () {

74 yield* TestClock.adjust("5 minutes");

75 // assertions

76 }).pipe(Effect.provide(TestContext.TestContext), Effect.runPromise),

77);`}},"detached-fiber-in-test":{docsUrl:`${X}/concurrency

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `));let n=rc(t.forwarded,{inheritStderr:t.progress});if(!Zg(n.stdout,t.format))return{output:n.stdout,stderr:n.stderr,exitCode:n.status};let r=t.analyzer?[...new Set([...t.project=... `))}return t});function In(e){let t=n=>r=>e?`\x1B[${n}m${r}\x1B[0m`:r;return{dim:t(2),green:t(32),cyan:t(36),yellow:t(33),red:t(31),bold:t(1)}}var as=e=>{let t=e??".";if(Gl(t))retu... `)}),Ns=(e,t,n,r="TB",s=!0,i,o=!1)=>pn.gen(function*(){let a=qS(e,n),d=yield*VS(t,r,s,i,o,e);return yield*pn.tryPromise({try:()=>lo.writeFile(a,d,"utf-8"),catch:l=>new Rs({outputPa... `)},JS=(e,t)=>{let n=st.dirname(e),r=t.replace(/[^a-zA-Z0-9_-]/g,"_").toLowerC

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

210function Bn(e,t,n){try{return Pu(`git show ${e}:${t}`,{cwd:n??process.cwd(),encoding:"utf-8",stdio:["pipe","pipe","pipe"]})}catch(r){let s=r instanceof Error?r.message:St

Medium

Ai Review Evidence

dist/cli.js interpolates Git references and paths into a shell command without escaping.

dist/cli.jsView on unpkg · L210

scripts/analyze-public-repos.tsView file

Lines 1-33typescript

1/**

2 * Clone public Effect repos into .analysis-output/, run effect-analyze (colocated

3 * .effect-analysis.md), and optionally run coverage audit and append a one-line

4 * summary to .analysis-output/NOTES.md.

5 *

6 * Usage: pnpm build && pnpm run analyze:public-repos [--refresh]

7 *

8 * --refresh Re-clone repos that already exist (default: skip existing clones).

9 *

10 * After running, review generated .effect-analysis.md files under .analysis-output

Source & flagged code

5 flagged · loading source

dist/rules.jsView file

93arr = arr.concat(xs);`}}};var H=(e,t)=>{let n=e.getStart(),r=e.getSourceFile(),{line:i,column:o}=r.getLineAndColumnAtPos(n);return{filePath:t,line:i,column:o}},oe=e=>e.getExpressio... L94: `&&c.push(h+1);let s=new Map,a=/\/\/\s*(eslint|effect-analyzer)-disable-(next-line|line)\b([^\n]*)/g,l;for(;(l=a.exec(o))!==null;){let h=l.index,T=1;for(let N=1;N<c.length&&!(c[N]>... L95: `),t.push(`## Summary

High

Child Process

Package source references child process execution.

dist/rules.jsView on unpkg · L93

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a==="param"){let d=/^(?:\{[^}]*\}\... L5: `).trimEnd()},Md=(e,t)=>Lt(e).idsBySpanPath.get(yn(t))??[];import{Option as Ee}from"effect";import{Option as Ks}from"effect";var ct=(e,t)=>{t(e);let n=$(e);if(Ks.isSome(n))for(let ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

dist/cli.jsView file

Findings

4 High4 Medium4 Low

HighChild Processdist/rules.js

HighShell

HighCredential Redirect Persistencedist/cli.js

HighCross File Remote Execution Contextscripts/analyze-public-repos.ts

MediumDynamic Requiredist/rules.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/cli.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to effect-analyzer@3.8.0.

See all versions of effect-analyzer for other recorded verdicts.

Review the evidence and your use of effect-analyzer@3.8.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-04 01:51:15.494Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code