registry / toiljs / 0.0.93

toiljs@0.0.93

The modern React framework: a file-based React frontend and a ToilScript-compiled WebAssembly backend.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 343 file(s), 3.25 MB of source, external domains: 127.0.0.1, analytics.example.com, api.anthropic.com, api.example.com, api.openai.com, api.resend.com, cdn.example-analytics.com, cdn.example.com, cdn.jsdelivr.net, chatgpt.com, claude.ai, example.com, github.com, myaccount.google.com, nodejs.org, registry.npmjs.org, schema.org, toil.example, toil.org, vitejs.dev, widget.example.com, www.sitemaps.org, www.w3.org

Source & flagged code

5 flagged

tests/data-parity/generated-parity.tsView file

Lines 1-29typescript

1// Proves the fork's GENERATED @data class (from --rpcModule) matches the AS @data

2// wire byte-for-byte. Compiles spec.ts (which has `@data class Foo`) with the

3// ToilScript fork, emitting both the wasm and the generated server.ts, then checks

4// the generated Foo class against the AS Foo.encode() bytes, both directions.

5// Run with: node tests/data-parity/generated-parity.ts

6import { readFileSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";

7import { tmpdir } from "node:os";

8import { join, dirname } from "node:path";

9import { fileURLToPath, pathToFileURL } from "node:url";

10import { spawnSync } from "node:child_process";

11const here = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

tests/data-parity/generated-parity.tsView on unpkg · L9

12// The generated module imports DataWriter/DataReader from this specifier.

13const codec = join(here, "..", "..", "src", "io", "codec.ts");

14const fork = "/root/toil-stuff/toilscript";

15const spec = join(here, "spec.ts");

16const tmp = mkdtempSync(join(tmpdir(), "gen-parity-"));

17const wasmPath = join(tmp, "spec.wasm");

18const modPath = join(tmp, "server.ts");

19writeFileSync(join(tmp, "package.json"), '{ "type": "module" }\n');

21const compile = spawnSync(

22 "node",

23 [join(fork, "bin", "toilscript.js"), spec, "-o", wasmPath, "--runtime", "stub", "--initialMemory", "32", "--rpcModule", modPath, "--rpcRuntime", codec],

24 { stdio: "inherit" },

25);

26if (compile.status !== 0) {

27 console.error("generated parity: COMPILE FAILED");

28 rmSync(tmp, { recursive: true, force: true });

29 process.exit(1);

Lines 40-80typescript

40 return true;

41}

42const hex = (b: Uint8Array): string => Buffer.from(b).toString("hex");

44// the known sample (must match spec.ts `sample()`)

45const ID =

build/cli/index.jsView file

Lines 1581-1621javascript

1581 client: { images: ${value} },`

1582 );

1583 }

1584 return null;

1585}

1586function detectPreprocessor(deps) {

1587 if ("sass" in deps) return "sass";

1588 if ("less" in deps) return "less";

1589 if ("stylus" in deps) return "stylus";

1590 return "css";

1591}

build/compiler/plugin.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import fs from 'node:fs';

3import { createRequire } from 'node:module';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

build/compiler/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = toiljs@0.0.92 matchedIdentity = npm:dG9pbGpz:0.0.92 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/compiler/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

tests/data-parity/generated-parity.tsView file

9import { fileURLToPath, pathToFileURL } from "node:url"; L10: import { spawnSync } from "node:child_process"; L11: const here = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

tests/data-parity/generated-parity.tsView on unpkg · L9

60// Generated side: build the same value with the generated Foo class and encode. L61: const gen = (await import(pathToFileURL(modPath).href)) as { L62: Foo: new () => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/data-parity/generated-parity.tsView on unpkg · L60

build/cli/index.jsView file

1601const stdio = opts.stdio ?? "ignore"; L1602: const child = onWindows ? spawn([cmd, ...args].join(" "), { cwd, stdio, shell: true }) : spawn(cmd, args, { cwd, stdio }); L1603: child.on("error", reject);

High

Shell

Package source references shell execution.

build/cli/index.jsView on unpkg · L1601

build/compiler/plugin.jsView file

1import { spawn } from 'node:child_process'; L2: import fs from 'node:fs'; ... L11: async function aiComplete(ai, prompt) { L12: const key = ai.apiKeyEnv ? process.env[ai.apiKeyEnv] : undefined; L13: if (ai.endpoint) { L14: const r = await fetch(ai.endpoint, { L15: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

build/compiler/plugin.jsView on unpkg · L1

build/compiler/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/compiler/index.jsView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processtests/data-parity/generated-parity.ts

HighShellbuild/cli/index.js

HighSame File Env Network Executionbuild/compiler/plugin.js

HighPrevious Version Dangerous Deltabuild/compiler/index.js

MediumDynamic Requiretests/data-parity/generated-parity.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

tests/data-parity/generated-parity.tsView file

Lines 1-29typescript

1// Proves the fork's GENERATED @data class (from --rpcModule) matches the AS @data

2// wire byte-for-byte. Compiles spec.ts (which has `@data class Foo`) with the

3// ToilScript fork, emitting both the wasm and the generated server.ts, then checks

4// the generated Foo class against the AS Foo.encode() bytes, both directions.

5// Run with: node tests/data-parity/generated-parity.ts

6import { readFileSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";

7import { tmpdir } from "node:os";

8import { join, dirname } from "node:path";

9import { fileURLToPath, pathToFileURL } from "node:url";

10import { spawnSync } from "node:child_process";

11const here = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

tests/data-parity/generated-parity.tsView on unpkg · L9

12// The generated module imports DataWriter/DataReader from this specifier.

13const codec = join(here, "..", "..", "src", "io", "codec.ts");

14const fork = "/root/toil-stuff/toilscript";

15const spec = join(here, "spec.ts");

16const tmp = mkdtempSync(join(tmpdir(), "gen-parity-"));

17const wasmPath = join(tmp, "spec.wasm");

18const modPath = join(tmp, "server.ts");

19writeFileSync(join(tmp, "package.json"), '{ "type": "module" }\n');

21const compile = spawnSync(

22 "node",

23 [join(fork, "bin", "toilscript.js"), spec, "-o", wasmPath, "--runtime", "stub", "--initialMemory", "32", "--rpcModule", modPath, "--rpcRuntime", codec],

24 { stdio: "inherit" },

25);

26if (compile.status !== 0) {

27 console.error("generated parity: COMPILE FAILED");

28 rmSync(tmp, { recursive: true, force: true });

29 process.exit(1);

Lines 40-80typescript

40 return true;

41}

42const hex = (b: Uint8Array): string => Buffer.from(b).toString("hex");

44// the known sample (must match spec.ts `sample()`)

45const ID =

build/cli/index.jsView file

Lines 1581-1621javascript

1581 client: { images: ${value} },`

1582 );

1583 }

1584 return null;

1585}

1586function detectPreprocessor(deps) {

1587 if ("sass" in deps) return "sass";

1588 if ("less" in deps) return "less";

1589 if ("stylus" in deps) return "stylus";

1590 return "css";

1591}

build/compiler/plugin.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import fs from 'node:fs';

3import { createRequire } from 'node:module';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

build/compiler/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/compiler/index.jsView on unpkg