registry / weavatrix / 0.1.4

weavatrix@0.1.4

Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 600 KB of source, external domains: api.osv.dev, osv.dev, www.apache.org

Source & flagged code

3 flagged

src/graph/internal-builder.langs.jsView file

Lines 1-40javascript

1// Language registry, parser lifecycle (web-tree-sitter init + grammar loading), and the cycle-safe

2// repo file walk for the internal graph builder (split from internal-builder.js — see its doc comment).

3//

4// Loaded via createRequire: web-tree-sitter's ESM build throws on fs/promises in pure-ESM Node, but its CJS

5// build works — and Electron main runs Node, so this needs no external runtime.

6import { readdirSync, statSync, realpathSync } from "node:fs";

7import { join, extname, dirname } from "node:path";

8import { execFileSync } from "node:child_process";

9import { createRequire } from "node:module";

10import { isPathInside } from "../repo-path.js";

11import { childProcessEnv } from "../child-env.js";

12import LANG_JS from "./builder/lang-js.js";

13import LANG_PY from "./builder/lang-python.js";

14import LANG_GO from "./builder/lang-go.js";

15import LANG_JAVA from "./builder/lang-java.js";

16import LANG_CSHARP from "./builder/lang-csharp.js";

17import LANG_RUST from "./builder/lang-rust.js";

18import LANG_HTML from "./builder/lang-html.js";

19import LANG_CSS from "./builder/lang-css.js";

21const require = createRequire(import.meta.url);

22const { Parser, Language, Query } = require("web-tree-sitter");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/graph/internal-builder.langs.jsView on unpkg · L20

24const WTS_DIR = dirname(require.resolve("web-tree-sitter"));

25const NODE_MODULES = dirname(WTS_DIR);

26const DEFAULT_RUNTIME_WASM = join(WTS_DIR, "tree-sitter.wasm");

27const DEFAULT_WASM_DIR = join(NODE_MODULES, "tree-sitter-wasms", "out");

29// ---- language registry (derived from the per-language modules) ----

30const LANG_MODULES = [LANG_JS, LANG_PY, LANG_GO, LANG_JAVA, LANG_CSHARP, LANG_RUST, LANG_HTML, LANG_CSS];

31const LANGS = {}; // family -> module

32const EXT_LANG = {}; // ext -> grammar

33const FAMILY = {}; // grammar -> family

34const GRAMMARS_SET = new Set();

35for (const L of LANG_MODULES) {

36 LANGS[L.family] = L;

37 for (const g of L.grammars) GRAMMARS_SET.add(g);

38 for (const [ext, g] of Object.entries(L.exts)) { EXT_LANG[ext] = g; FAMILY[g] = L.family; }

39}

40const GRAMMARS = [...GRAMMARS_SET];

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const SEVERITY_ORDER = ["critical"

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])

Source & flagged code

3 flagged · loading source

src/graph/internal-builder.langs.jsView file

20L21: const require = createRequire(import.meta.url); L22: const { Parser, Language, Query } = require("web-tree-sitter");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/graph/internal-builder.langs.jsView on unpkg · L20

src/analysis/findings.jsView file

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3). L2: // Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

src/security/registry-sig.rules.jsView file

36// canonical reverse/bind shells — a shell wired to a socket. Essentially never legitimate inside a L37: // published package: /dev/tcp redirection, netcat -e, interactive-shell redirect, mkfifo pipe shell. L38: pattern: "/dev/tcp/[0-9]|\\bnc(at)?\\s+-e\\b|\\b(ba)?sh\\s+-i\\b\\s*(2)?>&|mkfifo\\b.{0,60}(ba)?sh\\b|0<&196|socket\\.socket\\(.{0,40}(SOCK_STREAM).{0,80}(/bin/sh|exec)", L39: re: /\/dev\/tcp\/[0-9]|\bnc(at)?\s+-e\b|\b(ba)?sh\s+-i\b\s*(2)?>&|mkfifo\b[\s\S]{0,60}?\b(ba)?sh\b|0<&196|socket\.socket\([\s\S]{0,120}?(connect|SOCK_STREAM)[\s\S]{0,180}?(\/bin\/s... ... L48: // bun-types false positive). /etc/passwd + .netrc dropped (too common in prose). L49: pattern: "\\.ssh/(id_rsa|id_ed25519|id_dsa|authorized_keys)|\\.aws/credentials|\\.git-credentials|/etc/shadow|\\.docker/config\\.json|\\.kube/config", L50: re: /(readFileSync|readFile|createReadStream|openSync|\.read\(|copyFile|readlink|Get-Content|\bcat\s|\bscp\s|\bcurl\b[^\n]*-[TF])[\s\S]{0,80}?(\.ssh\/(id_(rsa|ed25519|dsa)|authoriz... L51: what: "reads a credential/secret file (SSH key, cloud creds) in a filesystem-read context", ... L61: re: /require\(\s*(Buffer\.from|atob)\(|module\.constructor\._load|globalThis\[['"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/registry-sig.rules.jsView on unpkg · L36

Findings

1 High4 Medium5 Low

HighCloud Metadata Accesssrc/security/registry-sig.rules.js

MediumDynamic Requiresrc/graph/internal-builder.langs.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/analysis/findings.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/graph/internal-builder.langs.jsView file

Lines 1-40javascript

1// Language registry, parser lifecycle (web-tree-sitter init + grammar loading), and the cycle-safe

2// repo file walk for the internal graph builder (split from internal-builder.js — see its doc comment).

3//

4// Loaded via createRequire: web-tree-sitter's ESM build throws on fs/promises in pure-ESM Node, but its CJS

5// build works — and Electron main runs Node, so this needs no external runtime.

6import { readdirSync, statSync, realpathSync } from "node:fs";

7import { join, extname, dirname } from "node:path";

8import { execFileSync } from "node:child_process";

9import { createRequire } from "node:module";

10import { isPathInside } from "../repo-path.js";

11import { childProcessEnv } from "../child-env.js";

12import LANG_JS from "./builder/lang-js.js";

13import LANG_PY from "./builder/lang-python.js";

14import LANG_GO from "./builder/lang-go.js";

15import LANG_JAVA from "./builder/lang-java.js";

16import LANG_CSHARP from "./builder/lang-csharp.js";

17import LANG_RUST from "./builder/lang-rust.js";

18import LANG_HTML from "./builder/lang-html.js";

19import LANG_CSS from "./builder/lang-css.js";

21const require = createRequire(import.meta.url);

22const { Parser, Language, Query } = require("web-tree-sitter");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/graph/internal-builder.langs.jsView on unpkg · L20

24const WTS_DIR = dirname(require.resolve("web-tree-sitter"));

25const NODE_MODULES = dirname(WTS_DIR);

26const DEFAULT_RUNTIME_WASM = join(WTS_DIR, "tree-sitter.wasm");

27const DEFAULT_WASM_DIR = join(NODE_MODULES, "tree-sitter-wasms", "out");

29// ---- language registry (derived from the per-language modules) ----

30const LANG_MODULES = [LANG_JS, LANG_PY, LANG_GO, LANG_JAVA, LANG_CSHARP, LANG_RUST, LANG_HTML, LANG_CSS];

31const LANGS = {}; // family -> module

32const EXT_LANG = {}; // ext -> grammar

33const FAMILY = {}; // grammar -> family

34const GRAMMARS_SET = new Set();

35for (const L of LANG_MODULES) {

36 LANGS[L.family] = L;

37 for (const g of L.grammars) GRAMMARS_SET.add(g);

38 for (const [ext, g] of Object.entries(L.exts)) { EXT_LANG[ext] = g; FAMILY[g] = L.family; }

39}

40const GRAMMARS = [...GRAMMARS_SET];

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const SEVERITY_ORDER = ["critical"

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])