registry / jssm / 5.157.18

jssm@5.157.18

A Javascript finite state machine (FSM) with a terse DSL and a simple API. Most FSMs are one-liners. Fast, easy, powerful, well tested, typed with TypeScript, and visualizations. MIT License.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 5.85 MB of source, external domains: cdn.jsdelivr.net, fsl.tools, github.com, llmstxt.org, unpkg.com

Source & flagged code

3 flagged

dist/wc/instance.jsView file

Lines 999-1039javascript

999/**

1000 * Compile an inline-body string into a handler function whose single

1001 * parameter is `e` (the event detail object). Uses the same dynamic

1002 * `Function(...)` constructor that browsers use internally for inline

1003 * event-handler attributes such as `<a onclick="...">`; the input here

1004 * is consumer-authored markup, never network data, so the surface is

1005 * exactly that of an inline event-handler attribute and the same CSP

1006 * caveats apply (strict CSP without `'unsafe-eval'` blocks it). A

1007 * `//# sourceURL=jssm-on:N` pragma is appended so devtools stack traces

1008 * point at a meaningful name.

1009 *

1010 * @param body - The inline JS body (function body, not full function).

1011 * @param source_id - A short identifier for the sourceURL pragma.

1012 * @returns The compiled handler.

1013 */

1014function compile_inline_body(body, source_id) {

1015 const wrapped = `${body}\n//# sourceURL=jssm-on:${source_id}`;

1016 // The Function constructor is intentional here — see the docblock above

1017 // for the rationale and the CSP caveat. Equivalent to how browsers wire

1018 // up inline event handlers; the input is consumer-authored markup.

1019 // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func

1020 return new Function('e', wrapped); // skipcq: JS-0086

1021}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/wc/instance.jsView on unpkg · L1019

1022/**

1023 * Resolve a `<jssm-instance>`'s FSL source from the three legal channels:

1024 * the `fsl=""` attribute, a child `<script type="text/fsl">`, and the

1025 * element's own text content (after stripping the script and any

1026 * `<jssm-*>` companion tags). Exactly one channel may be used; using

1027 * none or more than one is an error.

1028 *

1029 * Pulled out as a pure function so it's testable without spinning up a

1030 * Lit element.

1031 *

1032 * ```typescript

1033 * const div = document.createElement('div');

1034 * div.setAttribute('fsl', 'Off -> On;');

1035 * resolve_fsl_source(div as HTMLElement, 'Off -> On;');

1036 * // => { fsl: 'Off -> On;', provided_count: 1, error: undefined }

1037 * ```

1038 *

1039 * @param host - The `<jssm-instance>` element being resolved.

dist/cli/fsl-render.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = jssm@5.159.1 matchedIdentity = npm:anNzbQ:5.159.1 similarity = 0.920 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/fsl-render.cjsView on unpkg

1#!/usr/bin/env node L2: "use strict";var fs=require("fs");var path=require("path");var _documentCurrentScript=typeof document!=="undefined"?document.currentScript:null;function parseFslArgs(argv,spec){con...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/fsl-render.cjsView on unpkg · L1

Source & flagged code

3 flagged · loading source

dist/wc/instance.jsView file

1019// eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func L1020: return new Function('e', wrapped); // skipcq: JS-0086 L1021: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/wc/instance.jsView on unpkg · L1019

dist/cli/fsl-render.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/fsl-render.cjsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/fsl-render.cjsView on unpkg · L1

Findings

2 High4 Medium5 Low

HighObfuscated

HighPrevious Version Dangerous Deltadist/cli/fsl-render.cjs

MediumDynamic Requiredist/cli/fsl-render.cjs

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/wc/instance.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorJohn Haugeland

Maintainersstonecypher

Version5.159.2

PublishedJul 3, 2026

LicenseMIT

Dependencies8

Integrityverified

Package size1.19 MB

Files52

Keywordsfinitestatestate machinestate-machinemachinefinite-state-machinefinite state machinefsm

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/jssm.es5.cjsmodule → dist/jssm.es6.mjstypes → ./jssm.es5.d.ctsexports mapbin → fsl, fsl-export-system-prompt, fsl-render +1

Runtimenode >=10.0.0

Artifact7.05 MB · 52 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: audit, benny, benny:all, benny:scaling +8

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsManifest: clean