registry / opencode-codebase-index / 0.13.1

opencode-codebase-index@0.13.1

Semantic codebase indexing and search for OpenCode - find code by meaning, not just keywords

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 2.58 MB of source, external domains: api.openai.com, generativelanguage.googleapis.com, models.github.ai, www.w3.org

Source & flagged code

2 flagged

dist/pi-extension.cjsView file

Lines 211-251javascript

211 var REGEX_TEST_BLANK_LINE = /^\s+$/;

212 var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;

213 var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;

214 var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;

215 var REGEX_SPLITALL_CRLF = /\r?\n/g;

216 var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;

217 var REGEX_TEST_TRAILING_SLASH = /\/$/;

218 var SLASH = "/";

219 var TMP_KEY_IGNORE = "node-ignore";

220 if (typeof Symbol !== "undefined") {

221 TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");

222 }

223 var KEY_IGNORE = TMP_KEY_IGNORE;

224 var define = (object, key, value) => {

225 Object.defineProperty(object, key, { value });

226 return value;

227 };

228 var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;

229 var RETURN_FALSE = () => false;

230 var sanitizeRange = (range) => range.replace(

231 REGEX_REGEXP_RANGE,

232 (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY

233 );

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/pi-extension.cjsView on unpkg · L231

234 var cleanRangeBackSlash = (slashes) => {

235 const { length } = slashes;

236 return slashes.slice(0, length - length % 2);

237 };

238 var REPLACERS = [

239 [

240 // Remove BOM

241 // TODO:

242 // Other similar zero-width characters?

243 /^\uFEFF/,

244 () => EMPTY

245 ],

246 // > Trailing spaces are ignored unless they are quoted with backslash ("\")

247 [

248 // (a\ ) -> (a )

249 // (a ) -> (a)

250 // (a ) -> (a)

251 // (a \ ) -> (a )

native/codebase-index-native.linux-arm64-gnu.nodeView file

•path = native/codebase-index-native.linux-arm64-gnu.node kind = native_binary sizeBytes = 73078064 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/codebase-index-native.linux-arm64-gnu.nodeView on unpkg

Source & flagged code

2 flagged · loading source

dist/pi-extension.cjsView file

231REGEX_REGEXP_RANGE, L232: (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY L233: ); ... L373: // WTF! L374: // https://git-scm.com/docs/gitignore L375: // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1) ... L646: // Detect `process` so that it can run in browsers. L647: typeof process !== "undefined" && process.platform === "win32" L648: ) { ... L850: const variableName = match[1]; L851: const envValue = process.env[variableName]; L852: if (envValue === void 0) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/pi-extension.cjsView on unpkg · L231

native/codebase-index-native.linux-arm64-gnu.nodeView file

•path = native/codebase-index-native.linux-arm64-gnu.node kind = native_binary sizeBytes = 73078064 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/codebase-index-native.linux-arm64-gnu.nodeView on unpkg

Findings

1 High4 Medium5 Low

HighCloud Metadata Accessdist/pi-extension.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarynative/codebase-index-native.linux-arm64-gnu.node

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/pi-extension.cjsView file

Lines 211-251javascript

211 var REGEX_TEST_BLANK_LINE = /^\s+$/;

212 var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;

213 var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;

214 var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;

215 var REGEX_SPLITALL_CRLF = /\r?\n/g;

216 var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;

217 var REGEX_TEST_TRAILING_SLASH = /\/$/;

218 var SLASH = "/";

219 var TMP_KEY_IGNORE = "node-ignore";

220 if (typeof Symbol !== "undefined") {

221 TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");

222 }

223 var KEY_IGNORE = TMP_KEY_IGNORE;

224 var define = (object, key, value) => {

225 Object.defineProperty(object, key, { value });

226 return value;

227 };

228 var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;

229 var RETURN_FALSE = () => false;

230 var sanitizeRange = (range) => range.replace(

231 REGEX_REGEXP_RANGE,

232 (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY

233 );

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/pi-extension.cjsView on unpkg · L231

234 var cleanRangeBackSlash = (slashes) => {

235 const { length } = slashes;

236 return slashes.slice(0, length - length % 2);

237 };

238 var REPLACERS = [

239 [

240 // Remove BOM

241 // TODO:

242 // Other similar zero-width characters?

243 /^\uFEFF/,

244 () => EMPTY

245 ],

246 // > Trailing spaces are ignored unless they are quoted with backslash ("\")

247 [

248 // (a\ ) -> (a )

249 // (a ) -> (a)

250 // (a ) -> (a)

251 // (a \ ) -> (a )

native/codebase-index-native.linux-arm64-gnu.nodeView file

•path = native/codebase-index-native.linux-arm64-gnu.node kind = native_binary sizeBytes = 73078064 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/codebase-index-native.linux-arm64-gnu.nodeView on unpkg