registry / whyfile / 0.7.0

whyfile@0.7.0

Whyfile: intent-driven development for your codebase. Runs the whyfile CLI via uv.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.54 KB of source, external domains: astral.sh

Source & flagged code

1 flagged

bin/whyfile.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2'use strict';

3const { spawnSync } = require('node:child_process');

4const fs = require('node:fs');

5const path = require('node:path');

7const PKG_VERSION = require('../package.json').version;

9function resolveUv() {

10 const isWin = process.platform === 'win32';

11 const exts = isWin ? (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : [''];

12 for (const dir of (process.env.PATH || '').split(path.delimiter)) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/whyfile.jsView on unpkg · L2

13 if (!dir) continue;

14 for (const ext of exts) {

15 const candidate = path.join(dir, 'uv' + ext);

16 try { fs.accessSync(candidate, fs.constants.X_OK); return candidate; } catch { /* keep looking */ }

17 }

18 }

19 return null;

20}

22function installHint() {

Source & flagged code

1 flagged · loading source

bin/whyfile.jsView file

2'use strict'; L3: const { spawnSync } = require('node:child_process'); L4: const fs = require('node:fs'); ... L6: L7: const PKG_VERSION = require('../package.json').version; L8: L9: function resolveUv() { L10: const isWin = process.platform === 'win32'; L11: const exts = isWin ? (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : ['']; L12: for (const dir of (process.env.PATH || '').split(path.delimiter)) { ... L24: case 'win32': return 'winget install --id=astral-sh.uv -e'; L25: case 'darwin': return 'brew install uv # or: curl -LsSf https://astral.sh/uv/install.sh | sh';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code