registry / llmz / 0.0.85

llmz@0.0.85

LLMz - An LLM-native Typescript VM built on top of Zui

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 938 KB of source, external domains: example.com, lodash.com, openjsf.org, underscorejs.org

Source & flagged code

2 flagged

dist/chunk-2XSXXGXJ.jsView file

Lines 436-476javascript

436 *

437 * @param value The result value from the completed operation

438 * @throws Error if the snapshot is not in pending status

439 * @example

440 * ```typescript

441 * // After a background job completes

442 * const result = await backgroundJob.getResult()

443 * snapshot.resolve(result)

444 *

445 * // Continue execution

446 * const continuation = await execute({ snapshot, ... })

447 * ```

448 */

449 resolve(value) {

450 var _a;

451 if (this.#status.type !== "pending") {

452 throw new Error(`Cannot resolve snapshot because it is already settled: ${this.#status.type}`);

453 }

454 const assignment = (_a = this.toolCall) == null ? void 0 : _a.assignment;

455 if (assignment) {

456 try {

457 const fn = new Function(assignment.evalFn);

458 const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-2XSXXGXJ.jsView on unpkg · L456

459 this.variables = [...this.variables, ...parseVariables(assignmentValue)];

460 } catch {

461 }

462 }

463 this.#status = { type: "resolved", value };

464 }

465 /**

466 * Rejects the snapshot with an error.

467 *

468 * Call this method when the long-running operation that caused the snapshot

469 * has failed or encountered an error. The provided error will be thrown

470 * when execution resumes, allowing the generated code to handle it.

471 *

472 * @param error The error that occurred during the operation

473 * @throws Error if the snapshot is not in pending status

474 * @example

475 * ```typescript

476 * try {

dist/execute-I53OOORH.cjsView file

Lines 284-324javascript

284};

285

286// src/runtime/utils.ts

287var finalizeIteration = async ({ iteration, status, controller, onIterationEnd }) => {

288 if (status) {

289 iteration.end(status);

290 }

Source & flagged code

2 flagged · loading source

dist/chunk-2XSXXGXJ.jsView file

456try { L457: const fn = new Function(assignment.evalFn); L458: const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-2XSXXGXJ.jsView on unpkg · L456

dist/execute-I53OOORH.cjsView file

304package = llmz; repositoryIdentity = botpress; dependency = ms L304: // src/runtime/tool-wrapper.ts L305: var _ms = require('ms'); var _ms2 = _interopRequireDefault(_ms); L306: var _ulid = require('ulid');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/execute-I53OOORH.cjsView on unpkg · L304

Findings

1 High2 Medium5 Low

HighCopied Package Dependency Bridgedist/execute-I53OOORH.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-2XSXXGXJ.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-2XSXXGXJ.jsView file

Lines 436-476javascript

436 *

437 * @param value The result value from the completed operation

438 * @throws Error if the snapshot is not in pending status

439 * @example

440 * ```typescript

441 * // After a background job completes

442 * const result = await backgroundJob.getResult()

443 * snapshot.resolve(result)

444 *

445 * // Continue execution

446 * const continuation = await execute({ snapshot, ... })

447 * ```

448 */

449 resolve(value) {

450 var _a;

451 if (this.#status.type !== "pending") {

452 throw new Error(`Cannot resolve snapshot because it is already settled: ${this.#status.type}`);

453 }

454 const assignment = (_a = this.toolCall) == null ? void 0 : _a.assignment;

455 if (assignment) {

456 try {

457 const fn = new Function(assignment.evalFn);

458 const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-2XSXXGXJ.jsView on unpkg · L456

459 this.variables = [...this.variables, ...parseVariables(assignmentValue)];

460 } catch {

461 }

462 }

463 this.#status = { type: "resolved", value };

464 }

465 /**

466 * Rejects the snapshot with an error.

467 *

468 * Call this method when the long-running operation that caused the snapshot

469 * has failed or encountered an error. The provided error will be thrown

470 * when execution resumes, allowing the generated code to handle it.

471 *

472 * @param error The error that occurred during the operation

473 * @throws Error if the snapshot is not in pending status

474 * @example

475 * ```typescript

476 * try {

dist/execute-I53OOORH.cjsView file

Lines 284-324javascript

284};

285

286// src/runtime/utils.ts

287var finalizeIteration = async ({ iteration, status, controller, onIterationEnd }) => {

288 if (status) {

289 iteration.end(status);

290 }