npm analyzed 0.2.31

ruvector

v0.2.31

npm

Self-learning vector database for Node.js — hybrid search, Graph RAG, FlashAttention-3, HNSW, 50+ attention mechanisms

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.2.31 · analyzer v18 · 10h ago

dynamic code executionnew Function()package/dist/core/onnx/pkg/ruvector_onnx_embeddings_wasm_bg.js:539const ret = new Function(getStringFromWasm0(arg0, arg1));
dynamic code executionnew Function()package/src/decompiler/module-splitter.js:112new Function(stripped);
dynamic code executionnew Function()package/src/decompiler/reconstructor.js:352new Function(code);
dynamic code executionnew Function()package/src/decompiler/validator.js:122new Function(source);

code evidence v0.2.31 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs package/bin/cli.js :9 const fs = require('fs');
fs package/bin/mcp-server.js :26 const fs = require('fs');
fs package/dist/analysis/complexity.js :48 const fs = __importStar(require("fs"));
fs package/dist/analysis/patterns.js :51 const fs = __importStar(require("fs"));
fs package/dist/analysis/security.js :47 const fs = __importStar(require("fs"));
fs package/dist/core/ast-parser.js :48 const fs = __importStar(require("fs"));
fs package/dist/core/coverage-router.js :50 const fs = __importStar(require("fs"));
fs package/dist/core/onnx-embedder.js :73 const fs = __importStar(require("fs"));
fs package/dist/core/onnx-optimized.js :56 const fs = __importStar(require("fs"));
fs package/dist/core/onnx/embed-worker.mjs :19 import * as fs from 'node:fs';
fs package/dist/core/onnx/loader.js :256 fs.readFile(modelPath),
fs package/dist/core/onnx/pkg/loader.js :143 fs.readFile(modelPath),
fs package/dist/core/parallel-workers.js :215 const fs = require('fs');
fs package/dist/workers/native-worker.js :50 const fs = __importStar(require("fs"));
fs package/src/decompiler/index.js :15 const fs = require('fs');
fs package/src/decompiler/model-decompiler.js :9 const fs = require('fs');
fs package/src/decompiler/name-predictor.js :13 const fs = require('fs');
fs package/src/decompiler/subcategories.js :252 'fs.readdir', 'fs.mkdir', 'fs.stat', 'fs.lstat',
fs package/wasm/ruvector_decompiler_wasm.js :217 const wasmBytes = require('fs').readFileSync(wasmPath);

shell package/bin/cli.js :504 const { execSync } = require('child_process');
shell package/bin/mcp-server.js :27 const { execSync, execFileSync } = require('child_process');
shell package/dist/analysis/security.js :59 { pattern: /exec\s*\(/g, rule: 'no-exec', severity: 'high', message: 'Avoid exec() - command injection risk', suggestion: 'Use execFile or spawn with args array' },
shell package/dist/core/diff-embeddings.js :21 const child_process_1 = require("child_process");
shell package/dist/core/parallel-workers.js :312 { pattern: /exec\\s*\\(/g, rule: 'no-exec', severity: 'high', message: 'Avoid exec(), use execFile or spawn' },
shell package/src/decompiler/index.js :112 const { execSync } = require('child_process');
shell package/src/decompiler/reference-tracker.js :66 'crypto', 'fs', 'path', 'os', 'http', 'https', 'net', 'child_process',
shell package/src/decompiler/subcategories.js :16 'BashTool', 'child_process', 'execSync', 'spawnSync', 'spawn(',

net package/bin/cli.js :8021 const https = require('https');
net package/bin/mcp-server.js :3669 const res = await fetch('https://edge-net-genesis-875130704813.us-central1.run.app/api/status');
net package/dist/core/onnx/loader.js :317 const response = await fetch(url);
net package/dist/core/onnx/pkg/loader.js :204 const response = await fetch(url);
net package/src/decompiler/api-prober.js :131 const resp = await fetch('https://api.anthropic.com/v1/messages', {
net package/src/decompiler/index.js :363 const resp = await fetch(url, { redirect: 'follow' });
net package/src/decompiler/npm-fetch.js :21 const resp = await fetch(url, {
net package/src/decompiler/subcategories.js :257 'http.*request', 'https.*request', 'fetch(',