registry / grepmax / 0.26.58

grepmax@0.26.58

⚠ Under review

Semantic code search for coding agents. Local embeddings, call graph tracing, compact code context.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 234 file(s), 2.49 MB of source, external domains: 127.0.0.1, github.com, huggingface.co

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/vendor/lancedb/embedding/transformers.jsView file

37// so we use `eval` to bypass typescript for this specific import. L38: transformers = await eval('import("@huggingface/transformers")'); L39: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vendor/lancedb/embedding/transformers.jsView on unpkg · L37

dist/eval-graph-sanity.jsView file

Lines 52-92javascript

52 return function (mod) {

53 if (mod && mod.__esModule) return mod;

54 var result = {};

55 if (mod !=

dist/lib/search/pagerank.jsView file

231var _a; L232: const env = Number.parseInt((_a = process.env.GMAX_PAGERANK_TTL_MS) !== null && _a !== void 0 ? _a : "", 10); L233: return Number.isFinite(env) && env > 0 ? env : DEFAULT_TTL_MS; ... L239: try { L240: const data = JSON.parse(fs.readFileSync(file, "utf8")); L241: const computedAt = Date.parse(data.computedAt);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/search/pagerank.jsView on unpkg · L231

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

dist/commands/add.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/add.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/commands/setup.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/llm/server.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/lib/llm/server.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/llm/server.jsView on unpkg

dist/lib/workers/download-worker.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/lib/workers/download-worker.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/workers/download-worker.jsView on unpkg

dist/lib/graph/callsites.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/lib/graph/callsites.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/graph/callsites.jsView on unpkg

dist/vendor/lancedb/native.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = grepmax@0.26.28 matchedIdentity = npm:Z3JlcG1heA:0.26.28 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/vendor/lancedb/native.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.json

grepmax@0.26.58

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code