registry / llmz / 0.1.1

llmz@0.1.1

LLMz - An LLM-native Typescript VM built on top of Zui

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 939 KB of source, external domains: example.com, lodash.com, openjsf.org, underscorejs.org

Source & flagged code

3 flagged

dist/chunk-TIZWOIDF.jsView file

Lines 436-476javascript

436 *

437 * @param value The result value from the completed operation

438 * @throws Error if the snapshot is not in pending status

439 * @example

440 * ```typescript

441 * // After a background job completes

442 * const result = await backgroundJob.getResult()

443 * snapshot.resolve(result)

444 *

445 * // Continue execution

446 * const continuation = await execute({ snapshot, ... })

447 * ```

448 */

449 resolve(value) {

450 var _a;

451 if (this.#status.type !== "pending") {

452 throw new Error(`Cannot resolve snapshot because it is already settled: ${this.#status.type}`);

453 }

454 const assignment = (_a = this.toolCall) == null ? void 0 : _a.assignment;

455 if (assignment) {

456 try {

457 const fn = new Function(assignment.evalFn);

458 const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TIZWOIDF.jsView on unpkg · L456

459 this.variables = [...this.variables, ...parseVariables(assignmentValue)];

460 } catch {

461 }

462 }

463 this.#status = { type: "resolved", value };

464 }

465 /**

466 * Rejects the snapshot with an error.

467 *

468 * Call this method when the long-running operation that caused the snapshot

469 * has failed or encountered an error. The provided error will be thrown

470 * when execution resumes, allowing the generated code to handle it.

471 *

472 * @param error The error that occurred during the operation

473 * @throws Error if the snapshot is not in pending status

474 * @example

475 * ```typescript

476 * try {

dist/execute-7MDJHUHO.cjsView file

Lines 285-325javascript

285};

286

287// src/runtime/utils.ts

288var finalizeIteration = async ({ iteration, status, controller, onIterationEnd }) => {

289 if (status) {

290 iteration.end(status);

291 }

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llmz@0.1.0 matchedIdentity = npm:bGxteg:0.1.0 similarity = 0.918 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/chunk-TIZWOIDF.jsView file

456try { L457: const fn = new Function(assignment.evalFn); L458: const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TIZWOIDF.jsView on unpkg · L456

dist/execute-7MDJHUHO.cjsView file

305package = llmz; repositoryIdentity = botpress; dependency = ms L305: // src/runtime/tool-wrapper.ts L306: var _ms = require('ms'); var _ms2 = _interopRequireDefault(_ms); L307: var _ulid = require('ulid');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/execute-7MDJHUHO.cjsView on unpkg · L305

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High2 Medium5 Low

HighCopied Package Dependency Bridgedist/execute-7MDJHUHO.cjs

HighPrevious Version Dangerous Deltadist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-TIZWOIDF.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunk-TIZWOIDF.jsView file

Lines 436-476javascript

436 *

437 * @param value The result value from the completed operation

438 * @throws Error if the snapshot is not in pending status

439 * @example

440 * ```typescript

441 * // After a background job completes

442 * const result = await backgroundJob.getResult()

443 * snapshot.resolve(result)

444 *

445 * // Continue execution

446 * const continuation = await execute({ snapshot, ... })

447 * ```

448 */

449 resolve(value) {

450 var _a;

451 if (this.#status.type !== "pending") {

452 throw new Error(`Cannot resolve snapshot because it is already settled: ${this.#status.type}`);

453 }

454 const assignment = (_a = this.toolCall) == null ? void 0 : _a.assignment;

455 if (assignment) {

456 try {

457 const fn = new Function(assignment.evalFn);

458 const assignmentValue = fn(value);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TIZWOIDF.jsView on unpkg · L456

459 this.variables = [...this.variables, ...parseVariables(assignmentValue)];

460 } catch {

461 }

462 }

463 this.#status = { type: "resolved", value };

464 }

465 /**

466 * Rejects the snapshot with an error.

467 *

468 * Call this method when the long-running operation that caused the snapshot

469 * has failed or encountered an error. The provided error will be thrown

470 * when execution resumes, allowing the generated code to handle it.

471 *

472 * @param error The error that occurred during the operation

473 * @throws Error if the snapshot is not in pending status

474 * @example

475 * ```typescript

476 * try {

dist/execute-7MDJHUHO.cjsView file

Lines 285-325javascript

285};

286

287// src/runtime/utils.ts

288var finalizeIteration = async ({ iteration, status, controller, onIterationEnd }) => {

289 if (status) {

290 iteration.end(status);

291 }

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg