effect-analyzer@3.8.1

⚠ Under review

Static analysis for Effect-TS code. Analyze Effect code to extract structure, calculate complexity, and generate visualizations.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 3.96 MB of source, external domains: cdn.jsdelivr.net, effect.website, github.com, jagreehal.github.io, json.schemastore.org, www.w3.org

Source & flagged code

5 flagged

dist/rules.jsView file

Lines 1-23javascript

1import{createRequire as io}from"module";var ft=null,Ln=null,kn=new Map,Pn=e=>globalThis.process?.getBuiltinModule?.(e),ro=()=>{let e=Pn("node:module")??Pn("module"),t=e&&typeof e=="object"&&"createRequire"in e?e.createRequire:void 0;if(!t)return null;try{return t(import.meta.url)("ts-morph")}catch{return null}};var Dn=e=>{Ln=e,ft=null};var E=()=>{if(ft)return ft;let e=Ln?.()??ro();if(!e)throw new Error("ts-morph is not configured. In Node, install ts-morph as a dependency. In browser builds, call setTsMorphModule() or setTsMorphLoader() before analysis.");return ft=e,e},In=e=>{let t=e??"__defa ...

2`);else return;let a=s.search(/\n\s*@/);return a!==-1&&(s=s.substring(0,a)),s.trim()||void 0}let o=r.getText(),c=/\/\*\*\s*\n?\s*\*\s*([^@]*?)(?=\n\s*\*\s*@|\*\/)/.exec(o);if(c?.[1])return c[1].replace(/\n\s*\*\s*/g," ").trim()||void 0}let n=e.getLeadingCommentRanges();if(n.length>0){let r=n[n.length-1];if(!r)return;let i=r.getText();if(i.startsWith("/**")){let o=i.replace(/^\/\*\*\s*/,"").replace(/\s*\*\/\s*$/,"").replace(/^\s*\*\s?/gm,"").trim(),c=o.search(/\n

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(`

4`),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a

5`).trimEnd()},_d=(e,t)=>Dt(e).idsBySpanPath.get(gn(t))??[];import{Option as Ee}from"effect";import{Option as $s}from"effect";var lt=(e,t)=>{t(e);let n=$(e);if($s.isSome(n))for(let r of n.value)lt(r,t)},Ye=(e,t)=>{for(let n of e.root.children)lt(n,t)},zs=e=>{let t=!1;return lt(e,n=>{if(!t&&Z(n)){let r=n.callee;(r.startsWith("Effect.log")||r.startsWith("console.")||r.includes("withSpan")||r.includes("annotateLogs"))&&(t=!0)}}),t},_s=e=>{if(!e||zs(e))return!1;let t=!1;return lt(e,n=>{if(!Z(n))return;let r=n.callee;(r==="Effect.void"||r==="Effect.unit"||r==="Effect.succeed"||r==="Effect.succeedNon ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

6`)};import{Option as ki}from"effect";var tu=e=>{let t=[],n=new Map,r=0,i=0,o=0;for(let a of e){

7`),t.push(`## Summary

8`),t.push(`- Total programs: ${n.totalPrograms}`),t.push(`- Programs with generic error: ${n.programsWithGenericError}`),t.push(`- Programs with no error handlers: ${n.programsWithNoErrorHandlers}`),t.push(`- Programs with unhandled errors: ${n.programsWithUnhandledErrors}`),t.push(""),n.topErrorTypes.length>0){t.push(`## Top Error Types

9`),t.push("| Error Type | Count |"),t.push("|------------|-------|");for(let{type:r,count:i}of n.topErrorTypes)t.push(`| \`${r}\` | ${i} |`);t.push("")}if(e.issues.length>0){t.push(`## Issues

10`);for(let r of e.issues){let i=r.severity==="error"?"\u274C":r.severity==="warning"?"\u26A0\uFE0F":"\u2139\uFE0F";t.push(`${i} **[${

11`)},ru=(e,t=!0)=>JSON.stringify(e,null,t?2:0);import{createHash as nc}from"crypto";import*as Je from"fs/promises";

12`)},lu=(e=!0)=>JSON.stringify(Ke(),null,e?2:0),aa=()=>Ke().map(e=>({id:`${e.domain}:${e.code}`,code:e.code,domain:e.domain,severity:e.severity,confidence:e.confidence,title:e.title,snippet:ke(`${e.description}${e.example?` Example: ${e.example}`:""}`)})),du=(e=!0)=>JSON.stringify(aa(),null,e?2:0),uu=(e,t)=>vn(e,t);var X="https://effect.website/docs",Li={"untagged-throw":{docsUrl:`${X}/error-management/expected-errors/`,example:{bad:`Effect.gen(function* () {

13 if (!user) throw new Error("not found");

14});`,good:`class UserNotFound extends Data.TaggedError("UserNotFound")<{}> {}

16Effect.gen(function* () {

17 if (!user) return yield* Effect.fail(new UserNotFound());

18});`}},"identity-catch":{docsUrl:`${X}/error-management/fallback/`,example:{bad:"Effect.catch(eff, (e) => Effect.fail(e));",good:`// Either drop the catch entirely, or actually recover:

19Effect.catch(eff, (e) => Effect.succeed(defaultValue));`}},"tryPromise-without-catch":{docsUrl:`${X}/error-management/unexpected-errors/`,example:{bad:'Effect.tryPromise(() => fetch("/x"));',good:`class FetchError extends Data.TaggedError("FetchError")<{ readonly cause

21Effect.tryPromise({

22 try: () => fetch("/x"),

23 catch: (e) => new FetchError({ cause: e }),

Long lines were clipped for display.

Lines 73-104javascript

73 Effect.gen(function* () {

74 yield* TestClock.adjust("5 minutes");

75 // assertions

76 }).pipe(Effect.provide(TestContext.TestContext), Effect.runPromise),

77);`}},"detached-fiber-in-test":{docsUrl:`${X}/concurrency

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `));let n=ic(t.forwarded,{inheritStderr:t.progress});if(!ty(n.stdout,t.format))return{output:n.stdout,stderr:n.stderr,exitCode:n.status};let r=t.analyzer?[...new Set([...t.project=... `))}return t});function Pn(e){let t=n=>r=>e?`\x1B[${n}m${r}\x1B[0m`:r;return{dim:t(2),green:t(32),cyan:t(36),yellow:t(33),red:t(31),bold:t(1)}}var ds=e=>{let t=e??".";if(Yl(t))retu... `)}),$s=(e,t,n,r="TB",s=!0,i,o=!1)=>pn.gen(function*(){let a=JS(e,n),d=yield*YS(t,r,s,i,o,e);return yield*pn.tryPromise({try:()=>fo.writeFile(a,d,"utf-8"),catch:l=>new Ts({outputPa... `)},ex=(e,t)=>{let n=st.dirname(e),r=t.replace(/[^a-zA-Z0-9_-]/g,"_").toLowerC

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/analyze-public-repos.tsView file

Lines 1-33typescript

1/**

2 * Clone public Effect repos into .analysis-output/, run effect-analyze (colocated

3 * .effect-analysis.md), and optionally run coverage audit and append a one-line

4 * summary to .analysis-output/NOTES.md.

5 *

6 * Usage: pnpm build && pnpm run analyze:public-repos [--refresh]

7 *

8 * --refresh Re-clone repos that already exist (default: skip existing clones).

9 *

10 * After running, review generated .effect-analysis.md files under .analysis-output

Source & flagged code

5 flagged · loading source

dist/rules.jsView file

93arr = arr.concat(xs);`}}};var H=(e,t)=>{let n=e.getStart(),r=e.getSourceFile(),{line:i,column:o}=r.getLineAndColumnAtPos(n);return{filePath:t,line:i,column:o}},oe=e=>e.getExpressio... L94: `&&c.push(h+1);let s=new Map,a=/\/\/\s*(eslint|effect-analyzer)-disable-(next-line|line)\b([^\n]*)/g,l;for(;(l=a.exec(o))!==null;){let h=l.index,A=1;for(let N=1;N<c.length&&!(c[N]>... L95: `),t.push(`## Summary

High

Child Process

Package source references child process execution.

dist/rules.jsView on unpkg · L93

3`).map(a=>a.replace(/^\s*\*\s?/,"")).join(` L4: `),n=[],r,i=[],o,c=/@(param|returns?|throws?|exception|example)\s*(.*)/gi,s;for(;(s=c.exec(t))!==null;){let a=s[1].toLowerCase(),l=s[2].trim();if(a==="param"){let d=/^(?:\{[^}]*\}\... L5: `).trimEnd()},_d=(e,t)=>Dt(e).idsBySpanPath.get(gn(t))??[];import{Option as Ee}from"effect";import{Option as $s}from"effect";var lt=(e,t)=>{t(e);let n=$(e);if($s.isSome(n))for(let ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rules.jsView on unpkg · L3

dist/cli.jsView file

Findings

5 High3 Medium4 Low

HighChild Processdist/rules.js

HighShell

HighCredential Redirect Persistencedist/cli.js

HighCross File Remote Execution Contextscripts/analyze-public-repos.ts

HighSemantic Analysis Limiteddist/cli.js

MediumDynamic Requiredist/rules.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to effect-analyzer@3.8.1.

See all versions of effect-analyzer for other recorded verdicts.

Review the evidence and your use of effect-analyzer@3.8.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 22:48:02.509Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.