registry / parseman / 0.21.0

parseman@0.21.0

Parser combinators that compile to optimized JavaScript — use as a library or as a build-time macro

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 948 KB of source

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 343-383javascript

343 }

344 return;

345 }

346 if (ctx._cstTriviaLog) {

347 if (withKind) ctx._cstTriviaLog.push(start, end, insertIdx, kindIndex);

348 else ctx._cstTriviaLog.push(start, end, insertIdx);

349 }

350}

351function pushTriviaLogEntry(ctx, start, end, kindIndex) {

352 if (!ctx._triviaLog) return;

353 if (ctx.triviaKindLabels !== void 0 && kindIndex !== void 0) {

354 ctx._triviaLog.push(start, end, kindIndex);

355 } else {

356 ctx._triviaLog.push(start, end);

357 }

358}

359

360// src/combinators/literal.ts

361function asciiFoldEq(a, b) {

362 if (a.length !== b.length) return false;

363 for (let i = 0; i < a.length; i++) {

364 let ca = a.charCodeAt(i);

365 let cb = b.charCodeAt(i);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L363

366 if (ca >= 65 && ca <= 90) ca += 32;

367 if (cb >= 65 && cb <= 90) cb += 32;

368 if (ca !== cb) return false;

369 }

370 return true;

371}

372function literal(value, opts = {}) {

373 const caseInsensitive = opts.caseInsensitive ?? false;

374 const firstSet2 = value.length > 0 ? fromChar(value.codePointAt(0)) : empty();

375 const meta = {

376 firstSet: firstSet2,

377 canMatchNewline: value.includes("\n"),

378 isTrivia: false

379 };

380 if (caseInsensitive) {

381 const upper = value.toUpperCase();

382 const lower = value.toLowerCase();

383 const firstUpper = upper.codePointAt(0);

Lines 5336-5376javascript

5336 capturing: hasNodeDef(combinator),

5337 lazyUsage: analyzeLazyUsage(combinator)

5338 };

5339 const r = emit(combinator, ctx, "_pos");

5340 const namedPrelude = ctx.namedFnDecls.length > 0 ? [

Source & flagged code

2 flagged · loading source

dist/plugin/index.jsView file

5356].join("\n"); L5357: const fn = new Function("input", "_pos", "_rp", "_mf", "_build", "_ctx", [ L5358: ...emptyTlDecls,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugin/index.jsView on unpkg · L5356

363for (let i = 0; i < a.length; i++) { L364: let ca = a.charCodeAt(i); L365: let cb = b.charCodeAt(i); ... L3749: return false; L3750: // node() captures into its own private buffers and rolls them back on L3751: // failure (emitNode restores _ctx.* and never pushes on the !ok path). ... L5356: ].join("\n"); L5357: const fn = new Function("input", "_pos", "_rp", "_mf", "_build", "_ctx", [ L5358: ...emptyTlDecls, ... L5835: if (e instanceof Unserializable) { L5836: if (process.env.PARSEMAN_IR_DEBUG) console.error(`[ir] fallback: ${e.message}`); L5837: return null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L363

Findings

1 Medium6 Low

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugin/index.js

LowWeak Cryptodist/plugin/index.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 343-383javascript

343 }

344 return;

345 }

346 if (ctx._cstTriviaLog) {

347 if (withKind) ctx._cstTriviaLog.push(start, end, insertIdx, kindIndex);

348 else ctx._cstTriviaLog.push(start, end, insertIdx);

349 }

350}

351function pushTriviaLogEntry(ctx, start, end, kindIndex) {

352 if (!ctx._triviaLog) return;

353 if (ctx.triviaKindLabels !== void 0 && kindIndex !== void 0) {

354 ctx._triviaLog.push(start, end, kindIndex);

355 } else {

356 ctx._triviaLog.push(start, end);

357 }

358}

359

360// src/combinators/literal.ts

361function asciiFoldEq(a, b) {

362 if (a.length !== b.length) return false;

363 for (let i = 0; i < a.length; i++) {

364 let ca = a.charCodeAt(i);

365 let cb = b.charCodeAt(i);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/index.jsView on unpkg · L363

366 if (ca >= 65 && ca <= 90) ca += 32;

367 if (cb >= 65 && cb <= 90) cb += 32;

368 if (ca !== cb) return false;

369 }

370 return true;

371}

372function literal(value, opts = {}) {

373 const caseInsensitive = opts.caseInsensitive ?? false;

374 const firstSet2 = value.length > 0 ? fromChar(value.codePointAt(0)) : empty();

375 const meta = {

376 firstSet: firstSet2,

377 canMatchNewline: value.includes("\n"),

378 isTrivia: false

379 };

380 if (caseInsensitive) {

381 const upper = value.toUpperCase();

382 const lower = value.toLowerCase();

383 const firstUpper = upper.codePointAt(0);

Lines 5336-5376javascript

5336 capturing: hasNodeDef(combinator),

5337 lazyUsage: analyzeLazyUsage(combinator)

5338 };

5339 const r = emit(combinator, ctx, "_pos");

5340 const namedPrelude = ctx.namedFnDecls.length > 0 ? [