registry / scip-query / 0.11.0

scip-query@0.11.0

Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 169 file(s), 1.45 MB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 291-331json

291 },

292 "./runtime": {

293 "import": "./dist/runtime.js",

294 "types": "./dist/runtime.d.ts"

295 }

296 },

297 "scripts": {

298 "build": "node --max-old-space-size=8192 ./node_modules/tsup/dist/cli-default.js",

299 "dev": "tsup --watch",

300 "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

301 "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

302 "test": "vitest run",

303 "test:watch": "vitest",

304 "typecheck": "tsc --noEmit",

305 "lint": "npm run format:check && eslint src tests tsup.config.ts && node scripts/check-skill-links.mjs",

306 "build:scip-windows": "node scripts/build-scip-windows.mjs",

307 "bench:evidence-products": "node scripts/evidence-product-contract.mjs",

308 "calibrate": "node scripts/accuracy-calibration.mjs",

309 "docs:commands": "vite-node scripts/render-command-reference.ts --write",

310 "prepublishOnly": "npm run publish:scip-windows && npm run build",

311 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L311

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L311

312 "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts"

313 },

314 "keywords": [

315 "scip",

316 "code-intelligence",

317 "code-navigation",

318 "go-to-definition",

319 "find-references",

320 "dead-code",

321 "dependency-graph",

322 "sourcegraph",

323 "typescript",

324 "python",

325 "rust",

326 "java",

327 "ruby",

328 "php",

329 "csharp"

330 ],

331 "license": "Apache-2.0",

dist/chunk-GNG622H3.jsView file

Lines 1-3javascript

1import{a as d}from"./chunk-64MNV6AB.js";import{c as S}from"./chunk-7S5E7KWT.js";import{isAbsolute as x,relative as h}from"path";function g(e){return e.replace(/\\/g,"/").replace

dist/chunk-H7NSJ7L2.jsView file

Lines 1-5javascript

1import{a as G}from"./chunk-QZ4JVECJ.js";import{a as U}from"./chunk-WXVGNFAO.js";import{a as _}from"./chunk-FXG3PHVW.js";import{b as F,i as O,j as L,k as $,l as K,m as H,o as z,p as X}from"./chunk-WS3Z6W3M.js"

dist/cli.jsView file

73(relative_path, symbol, project_fingerprint, version, payload) VALUES (?, ?, ?, ?, ?)`),dropStaleReferences:n.prepare("DELETE FROM semantic_references WHERE project_fingerprint != ... L74: (check_name, finding_id, first_seen, last_seen, times_shown, outcome) VALUES (?, ?, ?, ?, ?, ?)`)}}catch(n){nl("disabled (open failed)",n)}return ks.set(e,t),t}function Gt(e,t,n){n... L75: `;if(t)try{let i=Ok(t);Up.has(i)||(jk(i,{recursive:!0}),Up.add(i)),Mk(t,r);return}catch(i){Wp||(Wp=!0,process.stderr.write(`[profile] failed to write ${t}: ${i instanceof Error?i.m... ... L79: `&&(i+=1),r+=1,o==='"')break}return{index:r,line:i}}function sl(e){return e==="'"||e==="`"||e==="~"||e==="@"||e==="^"||e==="#"}function al(e){return/\s|,/.test(e)||e==="("||e===")"... L80: `)))}import{readdirSync as MD}from"fs";import{execFileSync as jD}from"child_process";import{extname as Bs,join as OD}from"path";var Il=[".ts",".tsx",".mts",".cts",".js",".jsx",".mj... L81: `)){let o=i.trim();o&&(zD(o)||t.has(Bs(o).toLowerCase())&&r.add(o))}return r}catch{return null}}function zD(e){return e.split("/").some(t=>Hs.has(t))}function KD(e,t){let n=new Set... L82: `).length:0,u=cr(r.template),d=o.lineCount,m=r.styles.red

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L73

74(check_name, finding_id, first_seen, last_seen, times_shown, outcome) VALUES (?, ?, ?, ?, ?, ?)`)}}catch(n){nl("disabled (open failed)",n)}return ks.set(e,t),t}function Gt(e,t,n){n... L75: `;if(t)try{let i=Ok(t);Up.has(i)||(jk(i,{recursive:!0}),Up.add(i)),Mk(t,r);return}catch(i){Wp||(Wp=!0,process.stderr.write(`[profile] failed to write ${t}: ${i instanceof Error?i.m... L76: `));return}Re()&&process.stderr.write(r)}function Gp(e){return typeof e=="function"?e():e}var zk=[Nt("source-facts",{dependsOn:["content-hash","tool-version"],keyParts:["kind","rel... ... L79: `&&(i+=1),r+=1,o==='"')break}return{index:r,line:i}}function sl(e){return e==="'"||e==="`"||e==="~"||e==="@"||e==="^"||e==="#"}function al(e){return/\s|,/.test(e)||e==="("||e===")"... L80: `)))}import{readdirSync as MD}from"fs";import{execFileSync as jD}from"child_process";import{extname as Bs,join as OD}from"path";var Il=[".ts",".tsx",".mts",".cts",".js",".jsx",".mj... L81: `)){let o=i.trim();o&&(zD(o)||t.has(Bs(o).toLowerCase())&&r.add(o))}return r}catch{return null}}function zD(e){return e.split("/").some(t=>Hs.has(t))}function KD(e,t){let n=new Set... L82: `).length:0,u=cr(r.template),d=o.lineCount,m=r.styles.red

scripts/evidence-product-contract.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { createHash } from 'node:crypto';

4import { existsSync, mkdirSync, rmSync, statSync, appendFileSync } from 'node:fs';

5import { dirname, join, resolve } from 'node:path';

6import { performance } from

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-GNG622H3.jsView file

1import{a as d}from"./chunk-64MNV6AB.js";import{c as S}from"./chunk-7S5E7KWT.js";import{isAbsolute as x,relative as h}from"path";function g(e){return e.replace(/\\/g,"/").replace(/^... L2: `)){let s=o.trim();s&&(A(s)||t.has(l(s).toLowerCase())&&i.add(s))}return i}catch{return null}}function A(e){return e.split("/").some(t=>m.has(t))}function L(e,t){let n=new Set,i=o=...

High

Child Process

Package source references child process execution.

dist/chunk-GNG622H3.jsView on unpkg · L1

dist/chunk-H7NSJ7L2.jsView file

2`).trim();return o.length<=2e3?o:`${o.slice(0,2e3).trimEnd()}...`}function R(t,n){return n.filter(e=>t.includes(e))}import{existsSync as at,readFileSync as W}from"fs";var lt=/<!--\... L3: `).toLowerCase(),e=[],i=R(n,[".scipquery","declaredcouplings","suppression","suppressions","config","configuration","json"]);if(i.length>0)return e.push(`configuration/example term... L4: ${e}`.toLowerCase(),r=R(i,["historical note","historical record","history note","retrospective","postmortem","post-mortem","archived","archive","previously","legacy","recorded","re...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-H7NSJ7L2.jsView on unpkg · L2

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L73

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L74

9`):[]})}var Ck=/^\s*(?:\/\/|#|\/\*+|\*)\s*scip-query[\s:-]*ignore(?:[\s:-]+(dead(?:-code)?|stale|wrapper|passthrough|drift|extract|similar))?\b/i;function Xi(e){let t=Ck.exec(e);re... L10: `).length}function tl(e,t,n){let r={relativePath:t,template:null,scripts:[],styles:[],customBlocks:[],errors:[]};if(!n)return r;let i;try{i=vk(n,{filename:t})}catch(s){return r.err... L11: `).length-1):0;return{kind:n,ownerPath:t,sourcePath:c,external:!0,src:s,attrs:i,lang:o,body:l,startLine:0,endLine:u,errors:l?[]:[`Vue ${n} block source not found: ${c}`]}}let a=Mat... ... L13: `),startLine:0,language:o}:null}var Ep=ar("ast-trees",{clearGroups:["whole-project","source-file"]});function ee(e,t){if(dn(t))return Dk(e,t);let n=V(t);if(!n)return null;let r=$(e... L14: `.repeat(r.startLine)+r.body;return Yi(r.language,i)}):null}function Qr(e,t){let n=Ik(e,t);if(!n)return null;let r=Jr(n);return r?{calleeLeaf:r,memberAccess:Lk(n),line:e.startPosit... L15: CREATE TABLE IF NOT EXISTS file_evidence ( ... L74: (check_name, finding_id, first_seen, last_seen, times_shown, outcome) VALUES (?, ?, ?, ?, ?, ?)`)}}catch(n){nl("disabled (open failed)",n)}return ks.set(e,t),t}function Gt(e,t,n){n... L75: `;if(t

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L9

scripts/evidence-product-contract.mjsView file

1Cross-file remote execution chain: scripts/evidence-product-contract.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { createHash } from 'node:crypto'; ... L16: const args = parseArgs(process.argv.slice(2)); L17: const projectRoot = process.cwd(); L18: const cliPath = resolve(projectRoot, 'dist/cli.js'); ... L30: const status = runCli(['status', '--json'], { profile: false }); L31: if (status.exitCode !== 0) { L32: process.stderr.write(status.stderr.toString()); L33: process.exit(status.exitCode ?? 1); ... L35: L36: const statusJson = JSON.parse(status.stdout.toString());

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/evidence-product-contract.mjsView on unpkg · L1

Findings

6 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-GNG622H3.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextscripts/evidence-product-contract.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-H7NSJ7L2.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 291-331json

291 },

292 "./runtime": {

293 "import": "./dist/runtime.js",

294 "types": "./dist/runtime.d.ts"

295 }

296 },

297 "scripts": {

298 "build": "node --max-old-space-size=8192 ./node_modules/tsup/dist/cli-default.js",

299 "dev": "tsup --watch",

300 "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

301 "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

302 "test": "vitest run",

303 "test:watch": "vitest",

304 "typecheck": "tsc --noEmit",

305 "lint": "npm run format:check && eslint src tests tsup.config.ts && node scripts/check-skill-links.mjs",

306 "build:scip-windows": "node scripts/build-scip-windows.mjs",

307 "bench:evidence-products": "node scripts/evidence-product-contract.mjs",

308 "calibrate": "node scripts/accuracy-calibration.mjs",

309 "docs:commands": "vite-node scripts/render-command-reference.ts --write",

310 "prepublishOnly": "npm run publish:scip-windows && npm run build",

311 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L311

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L311

312 "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts"

313 },

314 "keywords": [

315 "scip",

316 "code-intelligence",

317 "code-navigation",

318 "go-to-definition",

319 "find-references",

320 "dead-code",

321 "dependency-graph",

322 "sourcegraph",

323 "typescript",

324 "python",

325 "rust",

326 "java",

327 "ruby",

328 "php",

329 "csharp"

330 ],

331 "license": "Apache-2.0",

dist/chunk-GNG622H3.jsView file

Lines 1-3javascript

1import{a as d}from"./chunk-64MNV6AB.js";import{c as S}from"./chunk-7S5E7KWT.js";import{isAbsolute as x,relative as h}from"path";function g(e){return e.replace(/\\/g,"/").replace

dist/chunk-H7NSJ7L2.jsView file

Lines 1-5javascript

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L73

scripts/evidence-product-contract.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { createHash } from 'node:crypto';

4import { existsSync, mkdirSync, rmSync, statSync, appendFileSync } from 'node:fs';

5import { dirname, join, resolve } from 'node:path';

6import { performance } from