registry / regixo / 0.1.17

regixo@0.1.17

Free, local-first data catalog + context layer for AI agents — one command, no Docker, zero metadata egress, read-only MCP. The `regixo` command — scan (metadata only), map, classify, draft the RoPA/DORA record, invite, verify, watch, plus bring-your-own

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 72 file(s), 634 KB of source, external domains: api.example.com, app.regixo.com, hooks.example

Source & flagged code

2 flagged

dist/portal.jsView file

Lines 12-36javascript

12 });

13 }

14 return path;

15};

16import { existsSync } from 'node:fs';

17import { resolve, dirname } from 'node:path';

18import { fileURLToPath, pathToFileURL } from 'node:url';

19const HERE = dirname(fileURLToPath(import.meta.url));

20function portalModulePath(io) {

21 const override = io.env.REGIXO_PORTAL_MODULE;

22 if (override)

23 return existsSync(override) ? override : undefined;

24 // packages/cli/src/portal.ts → repo root is ../../.. → private/portal-pro/src/index.ts

25 const p = resolve(HERE, '../../../private/portal-pro/src/index.ts');

26 return existsSync(p) ? p : undefined;

27}

28/** The paid module if present, else undefined (free build). */

29export async function loadPortal(io) {

30 const path = portalModulePath(io);

31 if (!path)

32 return undefined;

33 const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(path).href)));

34 return mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/portal.jsView on unpkg · L32

35}

dist/commands/connectors.jsView file

Lines 26-66javascript

26 }

27 catch {

28 return [];

29 }

30}

31function byocSources(io) {

32 const cfgPath = resolveConfigPath(io.env, io.cwd);

33 if

Source & flagged code

2 flagged · loading source

dist/portal.jsView file

32return undefined; L33: const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(path).href))); L34: return mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/portal.jsView on unpkg · L32

dist/commands/connectors.jsView file

46return `#!/usr/bin/env node L47: // Regixo generator for "${name}" — prints this source's SCHEMA (metadata only) to stdout on each scan. L48: // Regixo runs this OUT-OF-PROCESS and ingests only what you print. NEVER print row values (Hard Rule #2): ... L55: // L56: // The token (if the source needs one) is in process.env.${env} — Regixo hands this script your resolved L57: // .env, so a value in .env is here. NEVER hard-code a secret; config stores only the variable NAME. ... L63: if (!token) { console.error('${env} is not set — add it to your .env'); process.exit(1); } L64: // const res = await fetch('https://api.example.com/ping', { headers: { Authorization: \`Bearer \${token}\` } }); L65: // if (!res.ok) { console.error(\`source unreachable (\${res.status})\`); process.exit(1); } ... L76: ]; L77: process.stdout.write(schema.join('\\n') + '\\n'); L78: `;

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/commands/connectors.jsView on unpkg · L46

Findings

1 High3 Medium5 Low

HighCredential Exfiltrationdist/commands/connectors.js

MediumDynamic Requiredist/portal.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/portal.jsView file

Lines 12-36javascript

12 });

13 }

14 return path;

15};

16import { existsSync } from 'node:fs';

17import { resolve, dirname } from 'node:path';

18import { fileURLToPath, pathToFileURL } from 'node:url';

19const HERE = dirname(fileURLToPath(import.meta.url));

20function portalModulePath(io) {

21 const override = io.env.REGIXO_PORTAL_MODULE;

22 if (override)

23 return existsSync(override) ? override : undefined;

24 // packages/cli/src/portal.ts → repo root is ../../.. → private/portal-pro/src/index.ts

25 const p = resolve(HERE, '../../../private/portal-pro/src/index.ts');

26 return existsSync(p) ? p : undefined;

27}

28/** The paid module if present, else undefined (free build). */

29export async function loadPortal(io) {

30 const path = portalModulePath(io);

31 if (!path)

32 return undefined;

33 const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(path).href)));

34 return mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/portal.jsView on unpkg · L32

35}

dist/commands/connectors.jsView file

Lines 26-66javascript

26 }

27 catch {

28 return [];

29 }

30}

31function byocSources(io) {

32 const cfgPath = resolveConfigPath(io.env, io.cwd);

33 if