registry / sweet-search / 2.6.12

sweet-search@2.6.12

Sweet Search - SOTA Hybrid Code Search Engine with WASM CatBoost Query Router, Semantic/Lexical/Structural Search, and Multilingual Support

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 247 file(s), 5.41 MB of source, external domains: 127.0.0.1, api.cerebras.ai, api.groq.com, api.jina.ai, api.mistral.ai, api.voyageai.com, github.com, huggingface.co, nodejs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 66-106json

66 "scripts/install-tool-enforcement.js",

67 "scripts/hooks/",

68 "core/training/query-router/features/",

69 "core/training/query-router/output/v45_router_d4.js",

70 "core/training/query-router/output/v46_router_d4.js",

71 "core/prompt-optimization/data/p7-final/",

72 "eval/agent-read-workflows/bin/ss-search",

73 "eval/agent-read-workflows/bin/ss-find",

74 "eval/agent-read-workflows/bin/ss-grep",

75 "eval/agent-read-workflows/bin/ss-semantic",

76 "eval/agent-read-workflows/bin/ss-trace",

77 "eval/agent-read-workflows/bin/ss-read",

78 "eval/agent-read-workflows/bin/_ss-helpers.mjs",

79 "eval/agent-read-workflows/bin/_ss-argparse.mjs",

80 "crates/wasm-router/pkg/",

81 "LICENSE",

82 "NOTICE"

83 ],

84 "scripts": {

85 "init": "node scripts/init.js",

86 "postinstall": "node scripts/postinstall-banner.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

87 "bake:banner": "node scripts/bake-banner.mjs",

88 "build:assets": "node scripts/generate-asset-manifest.js",

89 "lint": "eslint core/",

90 "build": "node -e \"import('./core/search/sweet-search.js')\" && echo 'Build OK'",

91 "build:wasm": "node scripts/build-wasm.js && cd crates/wasm-maxsim && RUSTFLAGS=\"-C target-feature=+simd128\" cargo build --target wasm32-unknown-unknown --release && cp target/wasm32-unknown-unknown/release/maxsim_wasm.wasm ../../core/infrastructure/maxsim.wasm && echo 'WASM build OK'",

92 "build:native": "cd crates/sweet-search-native && npx napi build --release --platform --features coreml,accelerate && echo 'Native build OK'",

93 "build:native:cuda": "cd crates/sweet-search-native && npx napi build --release --platform --features cuda,flash-attn && echo 'CUDA native build OK (Ampere+ — flash-attn compiled in, runtime-gated on SM 8.0+)'",

94 "build:native:cuda-no-flashattn": "cd crates/sweet-search-native && npx napi build --release --platform --features cuda && echo 'CUDA native build OK (no flash-attn — SM 7.0+ compatible, naive attention)'",

95 "build:bg-priority": "cd native/bg-priority && npx napi build --platform --release && echo 'bg-priority native addon build OK'",

96 "build:mem-pressure": "cd native/mem-pressure && npx napi build --platform --release && echo 'mem-pressure native addon build OK'",

97 "build:cli": "cd crates/sweet-search-cli && cargo build --release && echo 'CLI build OK'",

98 "search": "node core/search/sweet-search.js",

99 "index": "node core/indexing/index-codebase-v21.js",

100 "index:full": "node core/indexing/index-codebase-v21.js --full",

101 "hcgs": "node core/graph/hcgs-generator.js generate",

102 "hcgs:stats": "node core/graph/hcgs-generator.js stats",

103 "warmup": "node core/cli.js prewarm-vocab",

104 "warmup:full": "node scripts/vocabulary-warmup.js",

105 "benchmark": "node scripts/benchmark.js",

106 "optimize:onnx": "bash scripts/optimize-onnx-model.sh",

crates/wasm-router/pkg/query_router_wasm.jsView file

Lines 246-272javascript

246};

247

248exports.__wbg_stack_0ed75d68575b0f3c = function(arg0, arg1) {

249 const ret = arg1.stack;

250 const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);

core/indexing/index-codebase-v21.jsView file

Lines 15-55javascript

15 * Incremental Mode (default - RECOMMENDED):

16 * - Code graph: ALWAYS full rebuild (relationships span files) - ensures GraphRAG accuracy

17 * - Summaries: Auto-regenerated for changed files (uses Cerebras GLM-

core/search/search-fusion.jsView file

Lines 21-61javascript

21 'lexical': 0.85, // Alias

22 'conceptual': 0.25, // Heavy semantic

23 'semantic': 0.25, // Alias

24 'structural': 0.90, // Lexical + graph

25 'mixed': 0.55, // Balanced

crates/wasm-router/pkg/query_router_wasm_bg.wasmView file

•path = crates/wasm-router/pkg/query_router_wasm_bg.wasm kind = wasm_module sizeBytes = 201196 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

crates/wasm-router/pkg/query_router_wasm_bg.wasmView on unpkg

core/incremental-indexing/application/production-reconciler.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = sweet-search@2.6.10 matchedIdentity = npm:c3dlZXQtc2VhcmNo:2.6.10 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/incremental-indexing/application/production-reconciler.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-banner.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

crates/wasm-router/pkg/query_router_wasm.jsView file

266const wasmPath = `${__dirname}/query_router_wasm_bg.wasm`; L267: const wasmBytes = require('fs').readFileSync(wasmPath); L268: const wasmModule = new WebAssembly.Module(wasmBytes);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

crates/wasm-router/pkg/query_router_wasm.jsView on unpkg · L266

core/indexing/index-codebase-v21.jsView file

35// enable. libuv reads this lazily on first thread pool use. L36: if (process.env.SWEET_SEARCH_UV_THREADPOOL_SIZE && !process.env.UV_THREADPOOL_SIZE) { L37: process.env.UV_THREADPOOL_SIZE = process.env.SWEET_SEARCH_UV_THREADPOOL_SIZE; ... L121: // Animated banner (best-effort; interactive TTY only, never in CI / quiet / stdin-fed runs). L122: if (!quiet && !help && !filesFromStdin && process.stdout.isTTY && !process.env.CI && !process.env.NO_BANNER && !process.env.SWEET_SEARCH_NO_BANNER) { L123: try { const { showBanner } = await import('../banner/render-banner.js'); await showBanner({ clear: true }); } catch { /* non-fatal */ } ... L136: } else { L137: applyPersistedLiModel(process.env.SWEET_SEARCH_PROJECT_ROOT || process.cwd()); L138: } ... L446: // form silently no-op'd under three real-world conditions: L447: // 1. `npm install ../sweet-search-private` (file install) symlinks L448: // `node_modules/sweet-search/` to the source — `process.argv[1]` is the

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

core/indexing/index-codebase-v21.jsView on unpkg · L35

core/search/search-fusion.jsView file

41if (result.name) return String(result.name); L42: if (process.env.DEBUG_CATCHES) { L43: _fallbackKeyCount++; L44: if (_fallbackKeyCount <= 5 || _fallbackKeyCount % 100 === 0) { L45: process.stderr.write(`[search-fusion] fallback hash dedup path used (${_fallbackKeyCount})\n`); L46: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

core/search/search-fusion.jsView on unpkg · L41

crates/wasm-router/pkg/query_router_wasm_bg.wasmView file

•path = crates/wasm-router/pkg/query_router_wasm_bg.wasm kind = wasm_module sizeBytes = 201196 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

crates/wasm-router/pkg/query_router_wasm_bg.wasmView on unpkg

core/incremental-indexing/application/production-reconciler.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/incremental-indexing/application/production-reconciler.mjsView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltacore/incremental-indexing/application/production-reconciler.mjs

MediumDynamic Requirecrates/wasm-router/pkg/query_router_wasm.js

MediumUnsafe Vm Contextcore/indexing/index-codebase-v21.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulecrates/wasm-router/pkg/query_router_wasm_bg.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptocore/search/search-fusion.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 66-106json

66 "scripts/install-tool-enforcement.js",

67 "scripts/hooks/",

68 "core/training/query-router/features/",

69 "core/training/query-router/output/v45_router_d4.js",

70 "core/training/query-router/output/v46_router_d4.js",

71 "core/prompt-optimization/data/p7-final/",

72 "eval/agent-read-workflows/bin/ss-search",

73 "eval/agent-read-workflows/bin/ss-find",

74 "eval/agent-read-workflows/bin/ss-grep",

75 "eval/agent-read-workflows/bin/ss-semantic",

76 "eval/agent-read-workflows/bin/ss-trace",

77 "eval/agent-read-workflows/bin/ss-read",

78 "eval/agent-read-workflows/bin/_ss-helpers.mjs",

79 "eval/agent-read-workflows/bin/_ss-argparse.mjs",

80 "crates/wasm-router/pkg/",

81 "LICENSE",

82 "NOTICE"

83 ],

84 "scripts": {

85 "init": "node scripts/init.js",

86 "postinstall": "node scripts/postinstall-banner.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

87 "bake:banner": "node scripts/bake-banner.mjs",

88 "build:assets": "node scripts/generate-asset-manifest.js",

89 "lint": "eslint core/",

90 "build": "node -e \"import('./core/search/sweet-search.js')\" && echo 'Build OK'",

92 "build:native": "cd crates/sweet-search-native && npx napi build --release --platform --features coreml,accelerate && echo 'Native build OK'",

95 "build:bg-priority": "cd native/bg-priority && npx napi build --platform --release && echo 'bg-priority native addon build OK'",

96 "build:mem-pressure": "cd native/mem-pressure && npx napi build --platform --release && echo 'mem-pressure native addon build OK'",

97 "build:cli": "cd crates/sweet-search-cli && cargo build --release && echo 'CLI build OK'",

98 "search": "node core/search/sweet-search.js",

99 "index": "node core/indexing/index-codebase-v21.js",

100 "index:full": "node core/indexing/index-codebase-v21.js --full",

101 "hcgs": "node core/graph/hcgs-generator.js generate",

102 "hcgs:stats": "node core/graph/hcgs-generator.js stats",

103 "warmup": "node core/cli.js prewarm-vocab",

104 "warmup:full": "node scripts/vocabulary-warmup.js",

105 "benchmark": "node scripts/benchmark.js",

106 "optimize:onnx": "bash scripts/optimize-onnx-model.sh",

crates/wasm-router/pkg/query_router_wasm.jsView file

Lines 246-272javascript

246};

247

248exports.__wbg_stack_0ed75d68575b0f3c = function(arg0, arg1) {

249 const ret = arg1.stack;

250 const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);

core/indexing/index-codebase-v21.jsView file

Lines 15-55javascript

15 * Incremental Mode (default - RECOMMENDED):

16 * - Code graph: ALWAYS full rebuild (relationships span files) - ensures GraphRAG accuracy

17 * - Summaries: Auto-regenerated for changed files (uses Cerebras GLM-

core/search/search-fusion.jsView file

Lines 21-61javascript

21 'lexical': 0.85, // Alias

22 'conceptual': 0.25, // Heavy semantic

23 'semantic': 0.25, // Alias

24 'structural': 0.90, // Lexical + graph

25 'mixed': 0.55, // Balanced

crates/wasm-router/pkg/query_router_wasm_bg.wasmView file

•path = crates/wasm-router/pkg/query_router_wasm_bg.wasm kind = wasm_module sizeBytes = 201196 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

crates/wasm-router/pkg/query_router_wasm_bg.wasmView on unpkg

core/incremental-indexing/application/production-reconciler.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

core/incremental-indexing/application/production-reconciler.mjsView on unpkg