registry / weavatrix / 0.2.7

weavatrix@0.2.7

Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 146 file(s), 1.23 MB of source, external domains: api.osv.dev, osv.dev, www.apache.org

Source & flagged code

3 flagged

src/analysis/dep-check.jsView file

Lines 180-220javascript

180 packageScripts: { status: "CHECKED", matched: false },

181 knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },

182 frameworkPeerContract: "NOT_FOUND",

183 implicitCompilerInput: "NOT_FOUND",

184 dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",

185 decision: "REVIEW_REQUIRED",

186 },

187 fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,

188 ...meta,

189 }));

190 }

191 }

192

193 // ---- missing (phantom) dependencies: imported but declared nowhere ----

194 for (const [name, use] of usedPackages) {

195 if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;

196 const files = [...use.files];

197 if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;

199 const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);

200 const usageReason = stylesheetOnly

201 ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`

202 : use.typeOnly

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/analysis/dep-check.jsView on unpkg · L200

203 ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`

204 : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;

205 findings.push(makeFinding({

206 category: "unused",

207 rule: "missing-dep",

208 severity: testOnly ? "low" : "medium",

209 confidence: "high",

210 title: `Missing dependency: ${name}`,

211 reason: usageReason,

212 detail: `"${name}" is imported by ${files.length} file(s) in scope ${meta.scope} but not declared in ${manifest} — it only works via a transitive install (phantom dependency) and can break on any lockfile change.`,

213 package: name,

214 file: files[0],

215 line: use.lines.get(files[0]) || 0,

216 evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),

217 source: "internal",

218 actionability: "STRONG_MANIFEST_MISMATCH",

219 autoInstall: false,

220 verification: {

src/analysis/findings.jsView file

Lines 1-21javascript

1// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).

2// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/analysis/findings.jsView on unpkg · L1

3// so the renderer and the AI summarizer consume one contract regardless of engine.

4import { createHash } from "node:crypto";

6export const

src/security/registry-sig.rules.jsView file

Lines 16-56javascript

16// external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)

17const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168

Source & flagged code

3 flagged · loading source

src/analysis/dep-check.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code