registry / jssm / 5.157.13

jssm@5.157.13

A Javascript finite state machine (FSM) with a terse DSL and a simple API. Most FSMs are one-liners. Fast, easy, powerful, well tested, typed with TypeScript, and visualizations. MIT License.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 5.85 MB of source, external domains: cdn.jsdelivr.net, fsl.tools, github.com, llmstxt.org, unpkg.com

Source & flagged code

2 flagged

dist/wc/instance.jsView file

Lines 994-1034javascript

994/**

995 * Compile an inline-body string into a handler function whose single

996 * parameter is `e` (the event detail object). Uses the same dynamic

997 * `Function(...)` constructor that browsers use internally for inline

998 * event-handler attributes such as `<a onclick="...">`; the input here

999 * is consumer-authored markup, never network data, so the surface is

1000 * exactly that of an inline event-handler attribute and the same CSP

1001 * caveats apply (strict CSP without `'unsafe-eval'` blocks it). A

1002 * `//# sourceURL=jssm-on:N` pragma is appended so devtools stack traces

1003 * point at a meaningful name.

1004 *

1005 * @param body - The inline JS body (function body, not full function).

1006 * @param source_id - A short identifier for the sourceURL pragma.

1007 * @returns The compiled handler.

1008 */

1009function compile_inline_body(body, source_id) {

1010 const wrapped = `${body}\n//# sourceURL=jssm-on:${source_id}`;

1011 // The Function constructor is intentional here — see the docblock above

1012 // for the rationale and the CSP caveat. Equivalent to how browsers wire

1013 // up inline event handlers; the input is consumer-authored markup.

1014 // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func

1015 return new Function('e', wrapped); // skipcq: JS-0086

1016}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/wc/instance.jsView on unpkg · L1014

1017/**

1018 * Resolve a `<jssm-instance>`'s FSL source from the three legal channels:

1019 * the `fsl=""` attribute, a child `<script type="text/fsl">`, and the

1020 * element's own text content (after stripping the script and any

1021 * `<jssm-*>` companion tags). Exactly one channel may be used; using

1022 * none or more than one is an error.

1023 *

1024 * Pulled out as a pure function so it's testable without spinning up a

1025 * Lit element.

1026 *

1027 * ```typescript

1028 * const div = document.createElement('div');

1029 * div.setAttribute('fsl', 'Off -> On;');

1030 * resolve_fsl_source(div as HTMLElement, 'Off -> On;');

1031 * // => { fsl: 'Off -> On;', provided_count: 1, error: undefined }

1032 * ```

1033 *

1034 * @param host - The `<jssm-instance>` element being resolved.

dist/cli/fsl-render.cjsView file

1#!/usr/bin/env node L2: "use strict";var fs=require("fs");var path=require("path");var _documentCurrentScript=typeof document!=="undefined"?document.currentScript:null;function parseFslArgs(argv,spec){con...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/fsl-render.cjsView on unpkg · L1

Source & flagged code

2 flagged · loading source

dist/wc/instance.jsView file

1014// eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func L1015: return new Function('e', wrapped); // skipcq: JS-0086 L1016: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/wc/instance.jsView on unpkg · L1014

dist/cli/fsl-render.cjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/fsl-render.cjsView on unpkg · L1

Findings

1 High4 Medium5 Low

HighObfuscated

MediumDynamic Requiredist/cli/fsl-render.cjs

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/wc/instance.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorJohn Haugeland

Maintainersstonecypher

Version5.159.2

PublishedJul 3, 2026

LicenseMIT

Dependencies8

Integrityverified

Package size1.19 MB

Files52

Keywordsfinitestatestate machinestate-machinemachinefinite-state-machinefinite state machinefsm

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/jssm.es5.cjsmodule → dist/jssm.es6.mjstypes → ./jssm.es5.d.ctsexports mapbin → fsl, fsl-export-system-prompt, fsl-render +1

Runtimenode >=10.0.0

Artifact7.03 MB · 52 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: audit, benny, benny:all, benny:scaling +8

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsManifest: clean