registry / weavatrix / 0.2.1

weavatrix@0.2.1

Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 978 KB of source, external domains: api.osv.dev, osv.dev, www.apache.org

Source & flagged code

4 flagged

src/analysis/dep-check.jsView file

Lines 167-207javascript

167 severity: dev ? "info" : "low",

168 confidence: dev || ecosystem ? "low" : "medium",

169 title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,

170 reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",

171 detail: `"${name}" is declared in ${section} but never imported in source, never referenced by a script, and not mentioned in any known config file. Dynamic/config-convention usage can't be fully ruled out — review before removing.`,

172 package: name,

173 source: "internal",

174 fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,

175 ...meta,

176 }));

177 }

178 }

179

180 // ---- missing (phantom) dependencies: imported but declared nowhere ----

181 for (const [name, use] of usedPackages) {

182 if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;

183 const files = [...use.files];

184 if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;

186 const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);

187 const usageReason = stylesheetOnly

188 ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`

189 : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L187

190 ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`

191 : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;

192 findings.push(makeFinding({

193 category: "unused",

194 rule: "missing-dep",

195 severity: testOnly ? "low" : "medium",

196 confidence: "high",

197 title: `Missing dependency: ${name}`,

198 reason: usageReason,

199 detail: `"${name}" is imported by ${files.length} file(s) in scope ${meta.scope} but not declared in ${manifest} — it only works via a transitive install (phantom dependency) and can break on any lockfile change.`,

200 package: name,

201 file: files[0],

202 line: use.lines.get(files[0]) || 0,

203 evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),

204 source: "internal",

205 fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,

206 ...meta,

207 }));

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const SEVERITY_ORDER = ["critical"

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])

src/analysis/endpoints-java.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = weavatrix@0.1.4 matchedIdentity = npm:d2VhdmF0cml4:0.1.4 similarity = 0.589 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/analysis/endpoints-java.jsView on unpkg

Source & flagged code

4 flagged · loading source

src/analysis/dep-check.jsView file

187const usageReason = stylesheetOnly L188: ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.` L189: : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L187

src/analysis/findings.jsView file

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3). L2: // Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

src/security/registry-sig.rules.jsView file

36// canonical reverse/bind shells — a shell wired to a socket. Essentially never legitimate inside a L37: // published package: /dev/tcp redirection, netcat -e, interactive-shell redirect, mkfifo pipe shell. L38: pattern: "/dev/tcp/[0-9]|\\bnc(at)?\\s+-e\\b|\\b(ba)?sh\\s+-i\\b\\s*(2)?>&|mkfifo\\b.{0,60}(ba)?sh\\b|0<&196|socket\\.socket\\(.{0,40}(SOCK_STREAM).{0,80}(/bin/sh|exec)", L39: re: /\/dev\/tcp\/[0-9]|\bnc(at)?\s+-e\b|\b(ba)?sh\s+-i\b\s*(2)?>&|mkfifo\b[\s\S]{0,60}?\b(ba)?sh\b|0<&196|socket\.socket\([\s\S]{0,120}?(connect|SOCK_STREAM)[\s\S]{0,180}?(\/bin\/s... ... L48: // bun-types false positive). /etc/passwd + .netrc dropped (too common in prose). L49: pattern: "\\.ssh/(id_rsa|id_ed25519|id_dsa|authorized_keys)|\\.aws/credentials|\\.git-credentials|/etc/shadow|\\.docker/config\\.json|\\.kube/config", L50: re: /(readFileSync|readFile|createReadStream|openSync|\.read\(|copyFile|readlink|Get-Content|\bcat\s|\bscp\s|\bcurl\b[^\n]*-[TF])[\s\S]{0,80}?(\.ssh\/(id_(rsa|ed25519|dsa)|authoriz... L51: what: "reads a credential/secret file (SSH key, cloud creds) in a filesystem-read context", ... L61: re: /require\(\s*(Buffer\.from|atob)\(|module\.constructor\._load|globalThis\[['"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/registry-sig.rules.jsView on unpkg · L36

src/analysis/endpoints-java.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/analysis/endpoints-java.jsView on unpkg

Findings

2 High4 Medium5 Low

HighCloud Metadata Accesssrc/security/registry-sig.rules.js

HighPrevious Version Dangerous Deltasrc/analysis/endpoints-java.js

MediumDynamic Requiresrc/analysis/dep-check.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/analysis/findings.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/analysis/dep-check.jsView file

Lines 167-207javascript

167 severity: dev ? "info" : "low",

168 confidence: dev || ecosystem ? "low" : "medium",

169 title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,

170 reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",

172 package: name,

173 source: "internal",

174 fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,

175 ...meta,

176 }));

177 }

178 }

179

180 // ---- missing (phantom) dependencies: imported but declared nowhere ----

181 for (const [name, use] of usedPackages) {

182 if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;

183 const files = [...use.files];

184 if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;

186 const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);

187 const usageReason = stylesheetOnly

188 ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`

189 : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L187

190 ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`

191 : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;

192 findings.push(makeFinding({

193 category: "unused",

194 rule: "missing-dep",

195 severity: testOnly ? "low" : "medium",

196 confidence: "high",

197 title: `Missing dependency: ${name}`,

198 reason: usageReason,

200 package: name,

201 file: files[0],

202 line: use.lines.get(files[0]) || 0,

203 evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),

204 source: "internal",

205 fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,

206 ...meta,

207 }));

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const SEVERITY_ORDER = ["critical"

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])

src/analysis/endpoints-java.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/analysis/endpoints-java.jsView on unpkg