registry / precogs-cbom / 2.0.0

precogs-cbom@2.0.0

Enterprise-grade Cryptographic Bill of Materials engine

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 245 KB of source, external domains: github.com, raw.githubusercontent.com

Source & flagged code

1 flagged

src/engine/ast/index.jsView file

Lines 65-105javascript

65};

67function grammarForExt(ext) {

68 return EXT_TO_GRAMMAR[(ext || '').toLowerCase()] || null;

69}

71function resolveGrammarsRoot() {

72 if (grammarsRoot) return grammarsRoot;

73 try {

74 const pkg = require.resolve('tree-sitter-wasms/package.json');

75 grammarsRoot = path.join(path.dirname(pkg), 'out');

76 } catch (_e) {

77 grammarsRoot = null;

78 }

79 return grammarsRoot;

80}

82async function init() {

83 if (initPromise) return initPromise;

84 initPromise = (async () => {

85 try {

86 Parser = require('web-tree-sitter');

87 if (process.pkg) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/engine/ast/index.jsView on unpkg · L85

88 // Point the emscripten loader at an extracted copy of tree-sitter.wasm.

89 let runtimeWasm = null;

90 try { runtimeWasm = path.join(path.dirname(require.resolve('web-tree-sitter')), 'tree-sitter.wasm'); } catch (_e) {}

91 await Parser.init(runtimeWasm

92 ? { locateFile: (name) => (name && name.endsWith('.wasm') ? materializeWasm(runtimeWasm) : name) }

93 : undefined);

94 } else {

95 await Parser.init();

96 }

97 available = !!resolveGrammarsRoot();

98 } catch (_e) {

99 available = false;

100 }

101 return available;

102 })();

103 return initPromise;

104}

105

Source & flagged code

1 flagged · loading source

src/engine/ast/index.jsView file

85package = precogs-cbom; repositoryIdentity = cbom; dependency = web-tree-sitter L85: try { L86: Parser = require('web-tree-sitter'); L87: if (process.pkg) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/engine/ast/index.jsView on unpkg · L85

Findings

1 High2 Medium5 Low

HighCopied Package Dependency Bridgesrc/engine/ast/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/engine/ast/index.jsView file

Lines 65-105javascript

65};

67function grammarForExt(ext) {

68 return EXT_TO_GRAMMAR[(ext || '').toLowerCase()] || null;

69}

71function resolveGrammarsRoot() {

72 if (grammarsRoot) return grammarsRoot;

73 try {

74 const pkg = require.resolve('tree-sitter-wasms/package.json');

75 grammarsRoot = path.join(path.dirname(pkg), 'out');

76 } catch (_e) {

77 grammarsRoot = null;

78 }

79 return grammarsRoot;

80}

82async function init() {

83 if (initPromise) return initPromise;

84 initPromise = (async () => {

85 try {

86 Parser = require('web-tree-sitter');

87 if (process.pkg) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/engine/ast/index.jsView on unpkg · L85

88 // Point the emscripten loader at an extracted copy of tree-sitter.wasm.

89 let runtimeWasm = null;

90 try { runtimeWasm = path.join(path.dirname(require.resolve('web-tree-sitter')), 'tree-sitter.wasm'); } catch (_e) {}

91 await Parser.init(runtimeWasm

92 ? { locateFile: (name) => (name && name.endsWith('.wasm') ? materializeWasm(runtimeWasm) : name) }

93 : undefined);

94 } else {

95 await Parser.init();

96 }

97 available = !!resolveGrammarsRoot();

98 } catch (_e) {

99 available = false;

100 }

101 return available;

102 })();

103 return initPromise;

104}

105