Loading npm security reports…

weavatrix@0.2.5: Suspicious npm security report (Warn) | LPM Firewall

registry / weavatrix / 0.2.5

weavatrix@0.2.5

Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 138 file(s), 1.16 MB of source, external domains: api.osv.dev, osv.dev, www.apache.org

Source & flagged code

4 flagged

src/analysis/dep-check.jsView file

Lines 167-207javascript

167 severity: dev ? "info" : "low",

168 confidence: dev || ecosystem ? "low" : "medium",

169 title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,

170 reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",

171 detail: `"${name}" is declared in ${section} but never imported in source, never referenced by a script, and not mentioned in any known config file. Dynamic/config-convention usage can't be fully ruled out — review before removing.`,

172 package: name,

173 source: "internal",

174 fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,

175 ...meta,

176 }));

177 }

178 }

179

180 // ---- missing (phantom) dependencies: imported but declared nowhere ----

181 for (const [name, use] of usedPackages) {

182 if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;

183 const files = [...use.files];

184 if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;

186 const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);

187 const usageReason = stylesheetOnly

188 ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`

189 : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L187

190 ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`

191 : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;

192 findings.push(makeFinding({

193 category: "unused",

194 rule: "missing-dep",

195 severity: testOnly ? "low" : "medium",

196 confidence: "high",

197 title: `Missing dependency: ${name}`,

198 reason: usageReason,

199 detail: `"${name}" is imported by ${files.length} file(s) in scope ${meta.scope} but not declared in ${manifest} — it only works via a transitive install (phantom dependency) and can break on any lockfile change.`,

200 package: name,

201 file: files[0],

202 line: use.lines.get(files[0]) || 0,

203 evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),

204 source: "internal",

205 fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,

206 ...meta,

207 }));

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168

src/precision/lsp-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = weavatrix@0.2.2 matchedIdentity = npm:d2VhdmF0cml4:0.2.2 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/precision/lsp-client.jsView on unpkg

Source & flagged code

4 flagged · loading source

src/analysis/dep-check.jsView file

Source & flagged code

4 flagged

src/analysis/dep-check.jsView file

Lines 167-207javascript

167 severity: dev ? "info" : "low",

168 confidence: dev || ecosystem ? "low" : "medium",

169 title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,

170 reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",

172 package: name,

173 source: "internal",

174 fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,

175 ...meta,

176 }));

177 }

178 }

179

180 // ---- missing (phantom) dependencies: imported but declared nowhere ----

181 for (const [name, use] of usedPackages) {

182 if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;

183 const files = [...use.files];

184 if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;

186 const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);

187 const usageReason = stylesheetOnly

188 ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`

189 : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L187

190 ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`

191 : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;

192 findings.push(makeFinding({

193 category: "unused",

194 rule: "missing-dep",

195 severity: testOnly ? "low" : "medium",

196 confidence: "high",

197 title: `Missing dependency: ${name}`,

198 reason: usageReason,

200 package: name,

201 file: files[0],

202 line: use.lines.get(files[0]) || 0,

203 evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),

204 source: "internal",

205 fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,

206 ...meta,

207 }));

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168

src/precision/lsp-client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/precision/lsp-client.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code