registry / tjs-lang / 0.9.1

tjs-lang@0.9.1

Type-safe JavaScript dialect with runtime validation, sandboxed VM execution, and AI agent orchestration. Transpiles TypeScript to validated JS with fuel-metered execution for untrusted code.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

WildcardDependency

scanned 239 file(s), 3.92 MB of source, external domains: 10.0.0.1, 127.0.0.1, 169.254.169.254, 172.16.0.1, 192.168.1.1, api.anthropic.com, api.bank.com, api.data, api.deepseek.com, api.github.com, api.open-meteo.com, api.openai.com, api.xml, cdn.example.com, cdn.jsdelivr.net, esm.sh, evil.com, evil.internal, example.com, flaky.example.com, generativelanguage.googleapis.com, github.com, itunes.apple.com, metadata.google.internal, raw.githubusercontent.com, slow.example.com, tosijs.net, ui.tosijs.net, unpkg.com, www.npmjs.com

Source & flagged code

9 flagged

demo/src/firebase-auth.tsView file

Lines 3-43typescript

3 *

4 * Provides:

5 * - Google Sign-In / Sign-Out

6 * - Auth state management

7 * - ID token retrieval for Cloud Functions

8 */

10import { initializeApp, FirebaseApp } from 'firebase/app'

11import {

12 getAuth,

13 GoogleAuthProvider,

14 signInWithPopup,

15 signOut as firebaseSignOut,

16 onAuthStateChanged,

17 User,

18 Auth,

19} from 'firebase/auth'

21// Firebase configuration - these are public client-side values

22const firebaseConfig = {

23 apiKey: 'AIzaSyBYyEixJ0Kr33TvJBcjoqtcNuNElUbX2g4',

High

High Secret

Package contains a high-severity secret pattern.

demo/src/firebase-auth.tsView on unpkg · L23

High

Secret Pattern

Google API key in demo/src/firebase-auth.ts

demo/src/firebase-auth.tsView on unpkg · L23

24 authDomain: 'tjs-platform.firebaseapp.com',

25 projectId: 'tjs-platform',

26 storageBucket: 'tjs-platform.firebasestorage.app',

27 messagingSenderId: '380998649944',

28 appId: '1:380998649944:web:f7f075791fd849e083a22d',

29}

31// Singleton instances

32let app: FirebaseApp | null = null

33let auth: Auth | null = null

35// Auth state

36export interface AuthState {

37 user: User | null

38 loading: boolean

39 error: string | null

40}

42// Subscribers for auth state changes

43type AuthSubscriber = (state: AuthState) => void

demo/examples.test.tsView file

Lines 61-101typescript

61let hasVision = false

63// Check if a model ID indicates vision capability (same logic as capabilities.ts)

64function isVisionModel(id: string): boolean {

65 return (

dist/tjs-eval.jsView file

Lines 1-21javascript

1import{s as m,validate as xe,filter as ze}from"tosijs-schema";function Oe(e,n){return(e instanceof String||e instanceof Number

bin/install-vscode.shView file

•path = bin/install-vscode.sh kind = build_helper sizeBytes = 2181 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-vscode.shView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tjs-lang@0.8.7 matchedIdentity = npm:dGpzLWxhbmc:0.8.7 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

demo/src/agent-client.tsView file

Lines 1-31typescript

1/*

2 * agent-client.ts - Client for calling the universal AJS endpoint

3 */

5import { getApps, initializeApp } from 'firebase/app'

6import { getAuth } from 'firebase/auth'

7import { getFunctions, httpsCallable } from 'firebase/functions'

demo/src/user-store.tsView file

Lines 2-42typescript

2 * user-store.ts - Firestore user document management with client-side encryption

3 *

4 * Provides:

5 * - User document initialization on first sign-in

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code