registry / parseman / 0.14.0

parseman@0.14.0

Parser combinators that compile to optimized JavaScript — use as a library or as a build-time macro

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No source-grounded verdict established.

Static reason

No blocking static signals were detected.

Trigger

unknown

Impact

unknown

Mechanism

unknown

Rationale

This response is invalid because source files were not inspected first.

Decision evidence

public snapshot

AI called this Manual Review at 0.0% confidence as Unknown with high false-positive risk.

Evidence for warning

Evidence against

Inspection could not be performed in this turn due to an invalid premature finalization attempt.

Behavioral surface

Source

ChildProcessCryptoEvalFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 754 KB of source

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 646-686javascript

646 if (def.tag === "regex") return { source: def.source, flags: def.flags };

647 if (def.tag === "transform") return getCoreRegexDef(def.parser);

648 if (def.tag === "label") return getCoreRegexDef(def.parser);

649 return null;

650}

651function applyTransforms(p, value, span) {

652 const def = p._def;

653 if (def.tag === "transform") {

654 const inner = applyTransforms(def.parser, value, span);

655 return def.fn(inner, span);

656 }

657 return value;

658}

659function continuationFirstSet(lit, source, flags) {

660 const re = new RegExp(source, "y" + flags.replace(/[gy]/g, ""));

661 re.lastIndex = 0;

662 const base = re.exec(lit);

663 if (!base || base[0] !== lit) return null;

664 const contCodes = [];

665 for (let code = 1; code < 128; code++) {

666 re.lastIndex = 0;

667 const m = re.exec(lit + String.fromCharCode(code));

668 if (m && m[0].length > lit.length) contCodes.push(code);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L666

669 }

670 if (contCodes.length === 0) return null;

671 return codesToFirstSet(contCodes);

672}

673function codesToFirstSet(codes) {

674 codes.sort((a, b) => a - b);

675 const ranges = [];

676 let lo = codes[0], hi = codes[0];

677 for (let i = 1; i < codes.length; i++) {

678 if (codes[i] === hi + 1) {

679 hi = codes[i];

680 } else {

681 ranges.push({ lo, hi });

682 lo = hi = codes[i];

683 }

684 }

685 ranges.push({ lo, hi });

686 return { kind: "ranges", ranges };

Lines 4193-4233javascript

4193 capturing: hasNodeDef(combinator),

4194 lazyUsage: analyzeLazyUsage(combinator)

4195 };

4196 const r = emit(combinator, ctx, "_pos");

4197 const collatorDecl = ctx.needsCollator ? `const _collator = new Intl.Collator(undefined, { sensitivity: 'accent' })

4198`

Source & flagged code

2 flagged · loading source

dist/plugin/index.jsView file

4213].join("\n"); L4214: const fn = new Function("input", "_pos", "_rp", "_mf", "_build", "_ctx", [ L4215: ...emptyTlDecls,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugin/index.jsView on unpkg · L4213

666re.lastIndex = 0; L667: const m = re.exec(lit + String.fromCharCode(code)); L668: if (m && m[0].length > lit.length) contCodes.push(code); ... L2889: return false; L2890: // node() captures into its own private buffers and rolls them back on L2891: // failure (emitNode restores _ctx.* and never pushes on the !ok path). ... L4213: ].join("\n"); L4214: const fn = new Function("input", "_pos", "_rp", "_mf", "_build", "_ctx", [ L4215: ...emptyTlDecls, ... L5140: const r = parseSync(filePath, src); L5141: if (r.errors.length === 0) parsed = { body: r.program.body, src }; L5142: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L666

Findings

6 Low

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugin/index.js

LowWeak Cryptodist/plugin/index.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 646-686javascript

646 if (def.tag === "regex") return { source: def.source, flags: def.flags };

647 if (def.tag === "transform") return getCoreRegexDef(def.parser);

648 if (def.tag === "label") return getCoreRegexDef(def.parser);

649 return null;

650}

651function applyTransforms(p, value, span) {

652 const def = p._def;

653 if (def.tag === "transform") {

654 const inner = applyTransforms(def.parser, value, span);

655 return def.fn(inner, span);

656 }

657 return value;

658}

659function continuationFirstSet(lit, source, flags) {

660 const re = new RegExp(source, "y" + flags.replace(/[gy]/g, ""));

661 re.lastIndex = 0;

662 const base = re.exec(lit);

663 if (!base || base[0] !== lit) return null;

664 const contCodes = [];

665 for (let code = 1; code < 128; code++) {

666 re.lastIndex = 0;

667 const m = re.exec(lit + String.fromCharCode(code));

668 if (m && m[0].length > lit.length) contCodes.push(code);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L666

669 }

670 if (contCodes.length === 0) return null;

671 return codesToFirstSet(contCodes);

672}

673function codesToFirstSet(codes) {

674 codes.sort((a, b) => a - b);

675 const ranges = [];

676 let lo = codes[0], hi = codes[0];

677 for (let i = 1; i < codes.length; i++) {

678 if (codes[i] === hi + 1) {

679 hi = codes[i];

680 } else {

681 ranges.push({ lo, hi });

682 lo = hi = codes[i];

683 }

684 }

685 ranges.push({ lo, hi });

686 return { kind: "ranges", ranges };

Lines 4193-4233javascript

4193 capturing: hasNodeDef(combinator),

4194 lazyUsage: analyzeLazyUsage(combinator)

4195 };

4196 const r = emit(combinator, ctx, "_pos");

4197 const collatorDecl = ctx.needsCollator ? `const _collator = new Intl.Collator(undefined, { sensitivity: 'accent' })

4198`