registry / scip-query / 0.16.0

scip-query@0.16.0

⚠ Under review

Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 186 file(s), 2.15 MB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 304-344json

304 "./runtime": {

305 "import": "./dist/runtime.js",

306 "types": "./dist/runtime.d.ts"

307 }

308 },

309 "scripts": {

310 "build": "node --max-old-space-size=8192 ./node_modules/tsup/dist/cli-default.js",

311 "dev": "tsup --watch",

312 "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

313 "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

314 "test": "vitest run",

315 "test:watch": "vitest",

316 "typecheck": "tsc --noEmit",

317 "lint": "npm run format:check && eslint src tests tsup.config.ts && node scripts/check-skill-links.mjs",

318 "build:scip-windows": "node scripts/build-scip-windows.mjs",

319 "bench:evidence-products": "node scripts/evidence-product-contract.mjs",

320 "bench:native-symbol-leaf": "node scripts/bench-native-symbol-leaf.mjs",

321 "calibrate": "node scripts/accuracy-calibration.mjs",

322 "docs:commands": "vite-node scripts/render-command-reference.ts --write",

323 "prepublishOnly": "npm run publish:scip-windows && npm run build",

324 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L324

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L324

325 "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts"

326 },

327 "keywords": [

328 "scip",

329 "code-intelligence",

330 "code-navigation",

331 "go-to-definition",

332 "find-references",

333 "dead-code",

334 "dependency-graph",

335 "sourcegraph",

336 "typescript",

337 "python",

338 "rust",

339 "java",

340 "ruby",

341 "php",

342 "csharp"

343 ],

344 "license": "Apache-2.0",

dist/chunk-XAEU4ROB.jsView file

Lines 1-21javascript

dist/chunk-5UKDCXVC.jsView file

Lines 1-5javascript

1import{a as U}from"./chunk-QZ4JVECJ.js";import{a as G}from"./chunk-WXVGNFAO.js";import{a as _}from"./chunk-HLRWOFXC.js";import{h as F,o as O,p as L,q as H,s as $,v as K,x as z,y as X}from"./chunk-WFRZGMWJ.js"

dist/cli.jsView file

76`;if(t)try{let o=FA(t);xb.has(o)||(EA(o,{recursive:!0}),xb.add(o)),DA(t,i);return}catch(o){Cb||(Cb=!0,process.stderr.write(`[profile] failed to write ${t}: ${o instanceof Error?o.m... L77: `));return}ne()&&process.stderr.write(i)}function AA(e){let t=Rc()??pp({command:vc()??"unknown",toolVersion:"unknown",projectFingerprint:null});if(!t)return{};let n=process.env[dp]... L78: `):[]})}var qA=/^\s*(?:\/\/|#|\/\*+|\*)\s*scip-query[\s:-]*ignore(?:[\s:-]+(dead(?:-code)?|stale|wrapper|passthrough|drift|extract|similar|twin))?\b/i;function bs(e){let t=qA.exec(... ... L89: `;)n+=1;return n}function Is(e,t,n){let r=t+1,i=n;for(;r<e.length;){let o=e[r];if(o==="\\"){r+=2;continue}if(o===` L90: `&&(i+=1),r+=1,o==='"')break}return{index:r,line:i}}function xp(e){return e==="'"||e==="`"||e==="~"||e==="@"||e==="^"||e==="#"}function Rp(e){return/\s|,/.test(e)||e==="("||e===")"... L91: `)){let o=i.trim();o&&(s0(o)||t.has(Ac(o).toLowerCase())&&r.add(o))}return r}catch{return null}}function s0(e){return e.split("/").some(t=>Mc.has(t))}function a0(e,t){let n=new Set... L92: `).length:0,u=li(r.template),d=o.lineCount,p=r.styles.reduce((h,y)=>h+li(y),0),m=r.customBlocks.reduce((h,y)=>h+li(y),0),{line

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L76

75`)))}function Z(e){return typeof e=="object"&&e!==null}function Q(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")?e:null}import{appendFileSync as DA,mkdirSync as EA}from... L76: `;if(t)try{let o=FA(t);xb.has(o)||(EA(o,{recursive:!0}),xb.add(o)),DA(t,i);return}catch(o){Cb||(Cb=!0,process.stderr.write(`[profile] failed to write ${t}: ${o instanceof Error?o.m... L77: `));return}ne()&&process.stderr.write(i)}function AA(e){let t=Rc()??pp({command:vc()??"unknown",toolVersion:"unknown",projectFingerprint:null});if(!t)return{};let n=process.env[dp]... ... L89: `;)n+=1;return n}function Is(e,t,n){let r=t+1,i=n;for(;r<e.length;){let o=e[r];if(o==="\\"){r+=2;continue}if(o===` L90: `&&(i+=1),r+=1,o==='"')break}return{index:r,line:i}}function xp(e){return e==="'"||e==="`"||e==="~"||e==="@"||e==="^"||e==="#"}function Rp(e){return/\s|,/.test(e)||e==="("||e===")"... L91: `)){let o=i.trim();o&&(s0(o)||t.has(Ac(o).toLowerCase())&&r.add(o))}return r}catch{return null}}function s0(e){return e.split("/").some(t=>Mc.has(t))}function a0(e,t){let n=new Set... L92: `).length:0,u=li(r.template),d=o.lineCount,p=r.styles.reduce((h,y)=>h+li(y),0),m=r.customBlocks.reduce((h,y)=>h+li(y),0),{line

scripts/evidence-product-contract.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { createHash } from 'node:crypto';

4import { existsSync, mkdirSync, rmSync, statSync, appendFileSync } from 'node:fs';

5import { dirname, join, resolve } from 'node:path';

6import { performance } from

dist/chunk-D5OXYOJP.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = scip-query@0.11.0 matchedIdentity = npm:c2NpcC1xdWVyeQ:0.11.0 similarity = 0.358 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-D5OXYOJP.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-XAEU4ROB.jsView file

1import{a as ar,b as x,c as Le,d as cr,e as ue,f as lr,g as pr}from"./chunk-FFIYGYQR.js";import{a as St,b as be}from"./chunk-3M2UCPFS.js";import{a as gt,b as ht,e as yt}from"./chunk... L2: `);let l=!1;return{acquired:!0,lockPath:e,message:"",release:()=>{if(l)return;l=!0,Yn(a);let p=bt(e);p?.pid===c.pid&&p.startedAt===c.startedAt&&ur(e,{force:!0})}}}function bt(e){tr...

High

Child Process

Package source references child process execution.

dist/chunk-XAEU4ROB.jsView on unpkg · L1

dist/chunk-5UKDCXVC.jsView file

2`).trim();return o.length<=2e3?o:`${o.slice(0,2e3).trimEnd()}...`}function R(t,n){return n.filter(e=>t.includes(e))}import{existsSync as at,readFileSync as W}from"fs";var lt=/<!--\... L3: `).toLowerCase(),e=[],i=R(n,[".scipquery","declaredcouplings","suppression","suppressions","config","configuration","json"]);if(i.length>0)return e.push(`configuration/example term... L4: ${e}`.toLowerCase(),r=R(i,["historical note","historical record","history note","retrospective","postmortem","post-mortem","archived","archive","previously","legacy","recorded","re...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5UKDCXVC.jsView on unpkg · L2

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L76

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L75

1#!/usr/bin/env node L2: import{program as Gd}from"commander";import{realpathSync as w_}from"fs";import{fileURLToPath as gue}from"url";import{createRequire as Y6}from"module";import{availableParallelism as... L3: CREATE TABLE IF NOT EXISTS file_evidence ( ... L73: ${r} L74: ORDER BY relative_path`,...i).map(a=>a.relative_path),s=t.extensions?o.filter(a=>t.extensions.some(c=>a.toLowerCase().endsWith(c.toLowerCase()))):o;return t.includeIgnored===!1?s.f... L75: `)))}function Z(e){return typeof e=="object"&&e!==null}function Q(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")?e:null}import{appendFileSync as DA,mkdirSync as EA}from... L76: `;if(t)try{let o=FA(t);xb.has(o)||(EA(o,{recursive:!0}),xb.add(o)),DA(t,i);return}catch(o){Cb||(Cb=!0,process.stderr.write(`[profile] failed to write ${t}: ${o instanceof Error?o.m... L77: `));return}ne()&&process.stderr.write(i)}function AA(e){let t=Rc()??pp({command:vc()??"unknown",toolVersion:"unknown",projectFingerprint:null});if(!t)return{};let n=process.env[dp]... ... L89: `;)n+=1;return n}function Is(e,t,n){let r=t+1,i=n;for(;r<e.length;){let o=e[r];if(o==="\\"){r+=2;continue}if(o===` L90: `&&(i+=1),r+=1,o==='"')break}return{index:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

scripts/evidence-product-contract.mjsView file

1Cross-file remote execution chain: scripts/evidence-product-contract.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { createHash } from 'node:crypto'; ... L16: const args = parseArgs(process.argv.slice(2)); L17: const projectRoot = process.cwd(); L18: const cliPath = resolve(projectRoot, 'dist/cli.js'); ... L30: const status = runCli(['status', '--json'], { profile: false }); L31: if (status.exitCode !== 0) { L32: process.stderr.write(status.stderr.toString()); L33: process.exit(status.exitCode ?? 1); ... L35: L36: const statusJson = JSON.parse(status.stdout.toString());

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/evidence-product-contract.mjsView on unpkg · L1

dist/chunk-D5OXYOJP.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-D5OXYOJP.jsView on unpkg

Findings

1 Critical6 High5 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/chunk-D5OXYOJP.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-XAEU4ROB.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextscripts/evidence-product-contract.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-5UKDCXVC.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 304-344json

304 "./runtime": {

305 "import": "./dist/runtime.js",

306 "types": "./dist/runtime.d.ts"

307 }

308 },

309 "scripts": {

310 "build": "node --max-old-space-size=8192 ./node_modules/tsup/dist/cli-default.js",

311 "dev": "tsup --watch",

312 "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

313 "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",

314 "test": "vitest run",

315 "test:watch": "vitest",

316 "typecheck": "tsc --noEmit",

317 "lint": "npm run format:check && eslint src tests tsup.config.ts && node scripts/check-skill-links.mjs",

318 "build:scip-windows": "node scripts/build-scip-windows.mjs",

319 "bench:evidence-products": "node scripts/evidence-product-contract.mjs",

320 "bench:native-symbol-leaf": "node scripts/bench-native-symbol-leaf.mjs",

321 "calibrate": "node scripts/accuracy-calibration.mjs",

322 "docs:commands": "vite-node scripts/render-command-reference.ts --write",

323 "prepublishOnly": "npm run publish:scip-windows && npm run build",

324 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L324

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L324

325 "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts"

326 },

327 "keywords": [

328 "scip",

329 "code-intelligence",

330 "code-navigation",

331 "go-to-definition",

332 "find-references",

333 "dead-code",

334 "dependency-graph",

335 "sourcegraph",

336 "typescript",

337 "python",

338 "rust",

339 "java",

340 "ruby",

341 "php",

342 "csharp"

343 ],

344 "license": "Apache-2.0",

dist/chunk-XAEU4ROB.jsView file

Lines 1-21javascript

dist/chunk-5UKDCXVC.jsView file

Lines 1-5javascript

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L76

scripts/evidence-product-contract.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { createHash } from 'node:crypto';

4import { existsSync, mkdirSync, rmSync, statSync, appendFileSync } from 'node:fs';

5import { dirname, join, resolve } from 'node:path';

6import { performance } from

dist/chunk-D5OXYOJP.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-D5OXYOJP.jsView on unpkg