registry / zero-query / 1.3.1

zero-query@1.3.1

Lightweight modern frontend library - jQuery-like selectors, reactive components, SPA router, and state management with zero dependencies.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 119 file(s), 2.18 MB of source, external domains: 127.0.0.1, api.example.com, api.myapp.com, api.test.com, example.com, github.com, jsonplaceholder.typicode.com, marketplace.visualstudio.com, mutated.com, myapi.com, test.example.com, updated.com, www.npmjs.com, www.w3.org, z-query.com

Source & flagged code

8 flagged

tests/test-ssr.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2const { execSync, spawn } = require('child_process');

3const { mkdtempSync, rmSync } = require('fs');

High

Child Process

Package source references child process execution.

tests/test-ssr.jsView on unpkg · L1

4const { join } = require('path');

5const os = require('os');

7const root = join(__dirname, '..');

8const tmp = mkdtempSync(join(os.tmpdir(), 'zq-ssr-'));

10console.log(`Scaffolding SSR app to ${tmp}\n`);

11execSync(`node cli/index.js create "${tmp}" --ssr`, { cwd: root, stdio: 'inherit' });

12console.log(`\nInstalling local zero-query...\n`);

13execSync(`npm install "${root}"`, { cwd: tmp, stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/test-ssr.jsView on unpkg · L12

15console.log(`\nStarting SSR server...\n`);

16const child = spawn('node', ['server/index.js'], { cwd: tmp, stdio: 'inherit' });

18setTimeout(() => {

19 const open = process.platform === 'win32' ? 'start'

20 : process.platform === 'darwin' ? 'open' : 'xdg-open';

21 try { execSync(`${open} http://localhost:3000`, { stdio: 'ignore' }); } catch {}

22}, 500);

24function cleanup() { try { rmSync(tmp, { recursive: true, force: true }); } catch {} }

25process.on('SIGINT', () => { child.kill(); cleanup(); process.exit(); });

26process.on('SIGTERM', () => { child.kill(); cleanup(); process.exit(); });

27child.on('exit', () => { cleanup(); process.exit(); });

tests/audit.test.jsView file

Lines 4087-4127javascript

4087 expect(obj.prototype).toBeUndefined();

4088 });

4089

4090 it('still sets safe paths normally', () => {

4091 const obj = {};

4092 setPath(obj, 'a.b.c',

dist/zquery.jsView file

Lines 1346-1386javascript

1346const DEFAULT_MAX_ICE_CANDIDATES = 30;

1347

1348

1349/**

1350 * One remote peer over a shared `SignalingClient`. Caller owns the lifetime

1351 * (construct, attach tracks, eventually call `.close()`).

1352 *

1353 * const peer = new Peer('peer_42', signaling, { polite: true });

1354 * peer.addTrack(localAudio, localStream);

1355 * peer.on('track', ({ track, streams }) => attachToVideoEl(streams[0]));

cli/commands/create.jsView file

Lines 1-28javascript

1// cli/commands/create.js - scaffold a new zQuery project

2//

3// Templates live in cli/scaffold/<variant>/ (default, minimal, ssr, webrtc).

4// Reads template files, replaces {{NAME}} with the project name,

5// and writes them into the target directory.

7const fs = require('fs');

8const path = require('path'

dist/zquery.dist.zipView file

•path = dist/zquery.dist.zip kind = high_entropy_blob sizeBytes = 215531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = compressed_blob sizeBytes = 215531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = nested_archive_needs_inspection sizeBytes = 215531 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/zquery.dist.zipView on unpkg

Source & flagged code

8 flagged · loading source

tests/test-ssr.jsView file

1#!/usr/bin/env node L2: const { execSync, spawn } = require('child_process'); L3: const { mkdtempSync, rmSync } = require('fs');

High

Child Process

Package source references child process execution.

tests/test-ssr.jsView on unpkg · L1

12console.log(`\nInstalling local zero-query...\n`); L13: execSync(`npm install "${root}"`, { cwd: tmp, stdio: 'inherit' }); L14:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/test-ssr.jsView on unpkg · L12

tests/audit.test.jsView file

4107it('blocks Function constructor', () => { L4108: expect(eval_('new Function("return 1")')).toBeUndefined(); L4109: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/audit.test.jsView on unpkg · L4107

dist/zquery.jsView file

1366* @param {string} peerId - remote peer id (the `from`/`to` value on the wire). L1367: * @param {import('./signaling.js').SignalingClient} signaling - shared signaling client. L1368: * @param {object} [options]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/zquery.jsView on unpkg · L1366

cli/commands/create.jsView file

8Cross-file remote execution chain: cli/commands/create.js spawns dist/zquery.min.js; helper contains network access plus dynamic code execution. L8: const path = require('path'); L9: const { execSync, spawn } = require('child_process'); L10: const { flag } = require('../args'); ... L32: function openBrowser(url) { L33: const cmd = process.platform === 'win32' ? 'start ""' L34: : process.platform === 'darwin' ? 'open' : 'xdg-open'; ... L43: * On Windows we deliberately DO NOT use `shell: true` for `node` invocations: L44: * a shell wrapper (cmd.exe) intercepts Ctrl-C and `child.kill()` only kills L45: * the shell, leaving the node server orphaned. Spawning `node` directly ... L55: const killChild = () => { L56: if (killing || child.exitCode !== null) return; L57: killing = true;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/commands/create.jsView on unpkg · L8

dist/zquery.dist.zipView file

•path = dist/zquery.dist.zip kind = high_entropy_blob sizeBytes = 215531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = compressed_blob sizeBytes = 215531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = nested_archive_needs_inspection sizeBytes = 215531 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/zquery.dist.zipView on unpkg

Findings

5 High5 Medium6 Low

HighChild Processtests/test-ssr.js

HighShell

HighCross File Remote Execution Contextcli/commands/create.js

HighRuntime Package Installtests/test-ssr.js

HighShips High Entropy Blobdist/zquery.dist.zip

MediumDynamic Requiredist/zquery.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/zquery.dist.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaltests/audit.test.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/zquery.dist.zip

Source & flagged code

8 flagged

tests/test-ssr.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2const { execSync, spawn } = require('child_process');

3const { mkdtempSync, rmSync } = require('fs');

High

Child Process

Package source references child process execution.

tests/test-ssr.jsView on unpkg · L1

4const { join } = require('path');

5const os = require('os');

7const root = join(__dirname, '..');

8const tmp = mkdtempSync(join(os.tmpdir(), 'zq-ssr-'));

10console.log(`Scaffolding SSR app to ${tmp}\n`);

11execSync(`node cli/index.js create "${tmp}" --ssr`, { cwd: root, stdio: 'inherit' });

12console.log(`\nInstalling local zero-query...\n`);

13execSync(`npm install "${root}"`, { cwd: tmp, stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/test-ssr.jsView on unpkg · L12

15console.log(`\nStarting SSR server...\n`);

16const child = spawn('node', ['server/index.js'], { cwd: tmp, stdio: 'inherit' });

18setTimeout(() => {

19 const open = process.platform === 'win32' ? 'start'

20 : process.platform === 'darwin' ? 'open' : 'xdg-open';

21 try { execSync(`${open} http://localhost:3000`, { stdio: 'ignore' }); } catch {}

22}, 500);

24function cleanup() { try { rmSync(tmp, { recursive: true, force: true }); } catch {} }

25process.on('SIGINT', () => { child.kill(); cleanup(); process.exit(); });

26process.on('SIGTERM', () => { child.kill(); cleanup(); process.exit(); });

27child.on('exit', () => { cleanup(); process.exit(); });

tests/audit.test.jsView file

Lines 4087-4127javascript

4087 expect(obj.prototype).toBeUndefined();

4088 });

4089

4090 it('still sets safe paths normally', () => {

4091 const obj = {};

4092 setPath(obj, 'a.b.c',

dist/zquery.jsView file

Lines 1346-1386javascript

1346const DEFAULT_MAX_ICE_CANDIDATES = 30;

1347

1348

1349/**

1350 * One remote peer over a shared `SignalingClient`. Caller owns the lifetime

1351 * (construct, attach tracks, eventually call `.close()`).

1352 *

1353 * const peer = new Peer('peer_42', signaling, { polite: true });

1354 * peer.addTrack(localAudio, localStream);

1355 * peer.on('track', ({ track, streams }) => attachToVideoEl(streams[0]));

cli/commands/create.jsView file

Lines 1-28javascript

1// cli/commands/create.js - scaffold a new zQuery project

2//

3// Templates live in cli/scaffold/<variant>/ (default, minimal, ssr, webrtc).

4// Reads template files, replaces {{NAME}} with the project name,

5// and writes them into the target directory.

7const fs = require('fs');

8const path = require('path'

dist/zquery.dist.zipView file

•path = dist/zquery.dist.zip kind = high_entropy_blob sizeBytes = 215531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = compressed_blob sizeBytes = 215531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/zquery.dist.zipView on unpkg

•path = dist/zquery.dist.zip kind = nested_archive_needs_inspection sizeBytes = 215531 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/zquery.dist.zipView on unpkg