registry / whyfile / 0.7.0

whyfile@0.7.0

Whyfile: intent-driven development for your codebase. Runs the whyfile CLI via uv.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.54 KB of source, external domains: astral.sh

Source & flagged code

1 flagged

bin/whyfile.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2'use strict';

3const { spawnSync } = require('node:child_process');

4const fs = require(

Source & flagged code

1 flagged · loading source

bin/whyfile.jsView file

2'use strict'; L3: const { spawnSync } = require('node:child_process'); L4: const fs = require('node:fs'); ... L6: L7: const PKG_VERSION = require('../package.json').version; L8: L9: function resolveUv() { L10: const isWin = process.platform === 'win32'; L11: const exts = isWin ? (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : ['']; L12: for (const dir of (process.env.PATH || '').split(path.delimiter)) { ... L24: case 'win32': return 'winget install --id=astral-sh.uv -e'; L25: case 'darwin': return 'brew install uv # or: curl -LsSf https://astral.sh/uv/install.sh | sh';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code