github JavaScript analyzed 3cc4bbc deep scan · partial (289/994 files)

JunHwan-Kwon/deepbom

github

Local static analysis and evidence generation for deployed AI model artifacts

maintainer
JunHwan-Kwon
licence
Apache-2.0
first seen
2026-09-07
last seen
2026-09-10
releases · 30d
16
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  2. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  3. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  4. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  5. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  6. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
  7. HIGH code analysis flagged dynamic code execution in JunHwan-Kwon/deepbom
capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3cc4bbc · analyzer v33 · 3h ago

skills & prompt files 1

danger signals2

code evidence vchannels-v1.96.12 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 811

filesystem 208

  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-agent-integration.mjs :2 import { lstat, mkdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-automation.mjs :2 import { access, mkdir, open, rename, unlink } from "node:fs/promises";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-input.mjs :1 import { lstat, open, readdir } from "node:fs/promises";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-mcp.mjs :1 import { existsSync, realpathSync } from "node:fs";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom.mjs :4 import { access, readFile } from "node:fs/promises";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/nvidia-accelerator-collector.mjs :2 import { createReadStream } from "node:fs";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/remote-artifact-closure.mjs :2 import { readFile, stat } from "node:fs/promises";
  • fs JunHwan-Kwon-deepbom-3cc4bbc/bin/remote-artifact-resolver.mjs :2 import { createReadStream, createWriteStream } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/benchmark-streaming-wasm-candidates.mjs :3 import { mkdir, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :2 import { createReadStream, createWriteStream } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/browser-launch.mjs :1 import { existsSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-cargo-engine-release.mjs :3 import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
show 28 more
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-channel-artifacts.mjs :3 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-coreml-legacy-quantization-corpus.mjs :1 import { mkdir, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-cyclonedx-generalization-evidence.mjs :2 import { readFile, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-mcpb-bundle.mjs :2 import { readFile, readdir, rm, writeFile, mkdir } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :3 import { readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-extension-contract-corpus.mjs :2 import { mkdir, readFile, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-pages.mjs :1 import { readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-public-multiformat-corpus-manifest.mjs :2 import { readFile, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-public-multiformat-residual-sweep.mjs :2 import { readFileSync, writeFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-release.mjs :2 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-residual-coverage-ledger.mjs :2 import { readFileSync, writeFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-safetensors-quantization-corpus.mjs :2 import { mkdir, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-wasm.mjs :2 import { readFile, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-gguf-runtime.mjs :2 import { createReadStream } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-pinned-runtime.mjs :1 import { access, mkdir, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-tensorrt-engine-inspector.mjs :4 import { readFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-tensorrt-parser.mjs :4 import { readFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-access-hierarchy.mjs :1 import { existsSync, readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas-viewer.mjs :2 import { mkdtemp, readFile, rm } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas.mjs :1 import { readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability-viewer.mjs :2 import { mkdtemp, readFile, rm } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability.mjs :1 import { readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-advanced-copy-contract.mjs :1 import { readFileSync } from "node:fs";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-evaluation.mjs :3 import { readFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-native.mjs :3 import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-analysis-invariants.mjs :8 import { readFile } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir-consumers.mjs :1 import { readFile, readdir } from "node:fs/promises";
  • fs (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir-import-boundary.mjs :1 import { readFile, readdir } from "node:fs/promises";

168 more not shown — this panel samples each group; the count above is the real total.

shell / exec 68

  • shell JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-agent-skill.mjs :138 'import { spawnSync } from "node:child_process";',
  • shell JunHwan-Kwon-deepbom-3cc4bbc/bin/deepbom-mcp.mjs :2 import { spawn } from "node:child_process";
  • shell JunHwan-Kwon-deepbom-3cc4bbc/bin/nvidia-accelerator-collector.mjs :5 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :280 return import("node:child_process").then(({ execFile }) => new Promise((resolve, reject) => {
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-channel-artifacts.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-release.mjs :1 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-gguf-runtime.mjs :6 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/capture-pinned-runtime.mjs :142 const { spawn } = await import("node:child_process");
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-evaluation.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-agent-native.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-analysis-summary-contract.mjs :2 import { spawnSync } from "node:child_process";
show 28 more
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-artifact-ir.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cargo-engine-release.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-channel-equivalence.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli-automation.mjs :5 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli-graph-export.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-cli.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-conversion-receipt.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-expected-output.mjs :2 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-explorer-redesign.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-coreml-correctness.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-defect-gate.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-gguf-correctness.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-onnx-correctness.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-review-tflite-correctness.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-finding-rule-registry.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-gguf-backend-contract.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-git-privacy.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ir-stabilization-ui.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-js.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcp-inspector.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcp-server.mjs :2 import { spawn, spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-mcpb-bundle.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-parser-robustness-isolated.mjs :1 import { spawn } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-private-wasm-build.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-private-wasm-contract.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-public-product-boundary.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-semantic-artifact-diff.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-sw-version.mjs :1 import { execFileSync } from "node:child_process";

28 more not shown — this panel samples each group; the count above is the real total.

network 73

  • net JunHwan-Kwon-deepbom-3cc4bbc/pkg/tflite_wasm_audit.js :1214 module_or_path = fetch(module_or_path);
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/bootstrap-instrumented-runtime.mjs :165 const response = await fetch(source.url, { redirect: "follow" });
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-contract-conflict-corpus.mjs :34 const response = await fetch(url, { redirect: "follow" });
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-onnx-extension-contract-corpus.mjs :121 const response = await fetch(url, { redirect: "follow", headers: { "User-Agent": "DeepBOM-contract-corpus/1.0" } });
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/build-safetensors-quantization-corpus.mjs :70 const response = await fetch(`${base}${configPath}`);
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-atlas-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-accumulator-reachability-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-bootstrap-retry.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-calibration-validation-viewer.mjs :4 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-channel-vitality-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-contract-migration-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-conversion-receipt.mjs :6 import { createServer } from "node:http";
show 28 more
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-core-isolation-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-delegation-repair-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-deployment-delta-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-deployment-frontier-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-dynamic-shape-cost-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-evidence-package-profile-ui.mjs :2 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-execution-placement-viewer.mjs :2 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-explorer-redesign-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-export-contract-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-test-access.mjs :96 const issueResponse = await worker.fetch(new Request("https://deepbom.test/api/admin/test-links", {
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-external-test-page.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-format-capability-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-format-quant-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-input-counterexample-viewer.mjs :4 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ir-stabilization-ui.mjs :2 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-kernel-witness-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-live-product.mjs :3 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-live-sw.mjs :49 const response = await fetch(url, { cache: "no-store" });
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-numerical-abi-propagation-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-on-device-llm-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-onnx-domain-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ort-native-capture.mjs :3 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-ort-profile-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-preprocessing-consequence-viewer.mjs :4 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-preprocessing-realizability-viewer.mjs :4 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-protected-selector-viewer.mjs :1 import { createServer } from "node:http";
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-public-samples.mjs :63 const response = await fetch(sample.path);
  • net (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-quant-evidence-chains-viewer.mjs :1 import { createServer } from "node:http";

33 more not shown — this panel samples each group; the count above is the real total.

secrets 1

  • secrets (weak) JunHwan-Kwon-deepbom-3cc4bbc/scripts/huggingface-community-corpus-lib.mjs :291 if (process.env.HF_TOKEN) return String(process.env.HF_TOKEN).trim();

install hooks 1

  • postinstall JunHwan-Kwon-deepbom-3cc4bbc/package.json :23 node scripts/patch-litert-int8.mjs && node scripts/write-build-metadata.mjs --auto-distribution

declared dependencies 20

  • @litertjs/core@^2.5.2
  • onnxruntime-web@^1.26.0
  • acorn@^8.15.0
  • adm-zip@0.6.0
  • ajv@8.20.0
  • ajv-draft-04@1.0.0
  • ajv-formats@3.0.1
  • ajv-formats-draft2019@1.6.1
  • es-module-lexer@1.7.0
  • esbuild@0.28.1
  • onnxruntime-node@1.26.0
  • playwright@^1.61.1
show 8 more
  • postject@1.0.0-alpha.6
  • serde@1
  • serde_json@1
  • serde-wasm-bindgen@0.6
  • sha2@0.10
  • wasm-bindgen@0.2
  • js-sys@0.3
  • miniz_oxide@0.9

obfuscation 3

  • dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/scripts/check-dist-assets.mjs :18 const { ANALYZER_BUNDLE_CONTENT_SHA256 } = await import(`${pathToFileURL(path.resolve(distBuildMetadataPath)).href}?dist-asset-check=${Date.now()}`);
  • dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/web/bootstrap.js :35 : import(`./app.js?bootstrap-retry=${attempt}`);
  • dynamic require()/import() JunHwan-Kwon-deepbom-3cc4bbc/web/workers/deepbom-analysis-worker.js :16 const module = await import(`${moduleUrl}${moduleUrl.includes("?") ? "&" : "?"}v=${encodeURIComponent(version || "1")}`);