registry / grepmax / 0.26.66

grepmax@0.26.66

⚠ Under review

Semantic code search for coding agents. Local embeddings, call graph tracing, compact code context.

Static Scan Results

scanned 22h ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 244 file(s), 2.60 MB of source, external domains: 127.0.0.1, github.com, huggingface.co

Source & flagged code

11 flagged

package.jsonView file

Lines 1-41json

2 "name": "grepmax",

3 "version": "0.26.66",

4 "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",

5 "homepage": "https://github.com/reowens/grepmax",

6 "bugs": {

7 "url": "https://github.com/reowens/grepmax/issues"

8 },

9 "repository": {

10 "type": "git",

11 "url": "https://github.com/reowens/grepmax.git"

12 },

13 "main": "dist/index.js",

14 "bin": {

15 "gmax": "dist/bin.js"

16 },

17 "engines": {

18 "node": ">=22.12.0"

19 },

20 "scripts": {

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prebuild": "rm -rf dist tsconfig.tsbuildinfo && node scripts/prepare-lance-runtime.cjs",

23 "build": "tsc",

24 "postbuild": "chmod +x dist/bin.js dist/index.js",

25 "dev": "npx tsc && node dist/bin.js",

26 "test": "vitest run",

27 "test:watch": "vitest",

28 "bench:recall": "npx tsx src/eval.ts",

29 "bench:recall:json": "GMAX_EVAL_JSON=1 npx tsx src/eval.ts",

30 "bench:oss": "npx tsx src/eval-oss.ts all",

31 "bench:oss:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-oss.ts all",

32 "bench:relevance": "tsx src/eval-relevance.ts",

33 "bench:tokens": "npx tsx src/eval-tokens.ts",

34 "bench:tokens:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-tokens.ts",

35 "bench:surprises": "npx tsx src/eval-surprising-connections.ts",

36 "bench:surprises:json": "GMAX_EVAL_JSON=1 npx tsx src/eval-surprising-connections.ts",

37 "format": "biome format --write .",

38 "format:check": "biome check .",

39 "lint": "biome lint .",

40 "lint:fix": "biome check --write .",

41 "typecheck": "tsc --noEmit",

dist/vendor/lancedb/embedding/transformers.jsView file

Lines 17-57javascript

17 model: "Xenova/all-MiniLM-L6-v2",

18 }) {

19 super();

20 const options = this.resolveVariables(optionsRaw);

21 const

dist/eval-graph-sanity.jsView file

Lines 52-92javascript

52 return function (mod) {

53 if (mod && mod.__esModule) return mod;

54 var result = {};

55 if (mod !=

dist/lib/search/pagerank.jsView file

Lines 211-251javascript

211 if (!set) {

212 set = new Set();

213 edges.set(d, set);

214 }

215 for (const r

mlx-embed-server/server.pyView file

•path = mlx-embed-server/server.py kind = build_helper sizeBytes = 8671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlx-embed-server/server.pyView on unpkg

dist/commands/add.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/add.js#virtual:normalized:round1View on unpkg

dist/commands/setup.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/commands/setup.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/setup.jsView on unpkg

dist/lib/workers/download-worker.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/lib/workers/download-worker.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/workers/download-worker.jsView on unpkg

dist/lib/graph/callsites.jsView file

•matchType = normalized_sha256 matchedPackage = grepmax@0.26.26 matchedPath = dist/lib/graph/callsites.js matchedIdentity = npm:Z3JlcG1heA:0.26.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/graph/callsites.jsView on unpkg

dist/vendor/lancedb/native.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = grepmax@0.26.28 matchedIdentity = npm:Z3JlcG1heA:0.26.28 similarity = 0.367 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/vendor/lancedb/native.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.json

grepmax@0.26.66

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code