Loading npm security reports…

@agent-native/core@0.109.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @agent-native/core / 0.109.0

@agent-native/core@0.109.0

Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 38 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5,017 file(s), 48.8 MB of source, external domains: 127.0.0.1, accounts.google.com, agent-native-artifact.invalid, agent-native.com, agent-native.invalid, agent-native.local, aistudio.google.com, amplitude.com, an.invalid, analytics.agent-native.com, analytics.example.com, analytics.local, analyticsdata.googleapis.com, api.anthropic.com, api.apollo.io, api.atlassian.com, api.botframework.com, api.builder.io, api.clay.com, api.commonroom.io, api.dataforseo.com, api.exa.ai, api.example.com, api.figma.com, api.firecrawl.dev, api.github.com, api.githubcopilot.com, api.gong.io, api.groq.com, api.hubapi.com, api.logo.dev, api.notion.com, api.openai.com, api.resend.com, api.search.brave.com, api.sendgrid.com, api.slack.com, api.stripe.com, api.tavily.com, api.telegram.org, api.twitterapi.io, api.usepylon.com, apis.google.com, app.apollo.io, app.gong.io, app.hubspot.com, app.posthog.com, app.sendgrid.com, assets.agent-native.com, auth.atlassian.com

Source & flagged code

30 flagged

dist/server/onboarding-html.jsView file

Lines 49-89javascript

49 languageLabel: "Language",

50 systemLanguage: "System",

51 pageTitleSignIn: "Sign in",

52 pageTitleWelcome: "Welcome",

53 welcomeTitle: "Welcome",

54 signInTitle: "Sign in",

55 welcomeBackTitle: "Welcome back",

56 checkEmailTitle: "Check your email",

57 resetPasswordTitle: "Reset password",

58 createAccountSubtitle: "Create an account to get started",

59 googleOnlySubtitle: "Use your workspace Google account to continue",

60 signInSubtitle: "Sign in to your account",

61 finishAccountSubtitle: "Finish creating your account",

62 resetPasswordSubtitle: "Reset your password",

63 upgradeCopy: "Continue signing in to attach this app to your account and migrate local data.",

64 googleButton: "Sign in with Google",

65 dividerOr: "or",

66 createAccount: "Create account",

67 signIn: "Sign in",

68 email: "Email",

69 password: "Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/onboarding-html.jsView on unpkg · L69

70 confirmPassword: "Confirm password",

71 passwordMinPlaceholder: "At least 8 characters",

72 confirmPasswordPlaceholder: "Confirm password",

73 enterPasswordPlaceholder: "Enter password",

74 signupProgress: "Signup progress",

75 progressAccount: "Account",

76 progressVerify: "Verify",

77 progressStart: "Start",

78 verificationSent: "Verification email sent",

79 verifyCopyPrefix: "We sent a secure link to",

80 verifyCopySuffix: ". Click it, return here, and this app will finish signing you in automatically.",

81 verificationNote: "You can keep this tab open. If it has not refreshed after you come back, use Continue.",

82 continue: "Continue",

83 resendEmail: "Resend email",

84 back: "Back",

85 forgotPassword: "Forgot password?",

86 sendResetLink: "Send reset link",

87 backToSignIn: "Back to sign in",

88 localNotePrefix: "Your account is stored in this app's own DB",

89 localNoteSuffix: ", not a third-party service.",

329patternName = generic_password severity = medium line = 329 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L329

415patternName = generic_password severity = medium line = 415 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L415

501patternName = generic_password severity = medium line = 501 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L501

931patternName = generic_password severity = medium line = 931 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L931

bin/agent-native.jsView file

Lines 1-54javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/agent-native.jsView on unpkg · L2

5import { dirname, join } from

dist/coding-tools/index.jsView file

Lines 287-327javascript

287 const existed = fs.existsSync(filePath);

288 fs.writeFileSync(filePath, content, "utf8");

289 const bytes = Buffer.byteLength(content, "utf8"

dist/server/prompts/framework-core.jsView file

Lines 15-55javascript

15 * appear in the core prompt.

16 */

17export function buildFrameworkCore(examples, options) {

18 const appActionExamples =

dist/cli/migrate.jsView file

Lines 1-26javascript

1import crypto from "crypto";

2import fs from "fs";

3import path from "path";

4import { fileURLToPath } from "url";

dist/terminal/pty-server.jsView file

Lines 64-104javascript

64 }

65 catch { }

66 }

67 try {

68 process.kill(pid, "SIGTERM");

69 }

70 catch { }

dist/server/design-token-utils.jsView file

Lines 1-23javascript

1/**

2 * Shared design-token extraction utilities.

3 *

4 * Pure functions for parsing Tailwind configs, CSS files, package.json,

5 * documents, and URLs to extract colors, fonts, spacing, border-radius,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/design-token-utils.jsView on unpkg · L3

6 * and CSS custom properties. Used by the import-* actions across all

7 * templates (design and slides).

8 *

dist/server/action-discovery.jsView file

225package = @agent-native/core; repositoryIdentity = agent-native; dependency = jiti L225: throw err; L226: const { createJiti } = await import("jiti"); L227: const jiti = createJiti(pathToFileURL(filePath).href, {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/server/action-discovery.jsView on unpkg · L225

dist/cli/skills.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-native/core@0.101.3 matchedIdentity = npm:QGFnZW50LW5hdGl2ZS9jb3Jl:0.101.3 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/skills.jsView on unpkg

corpus/core/src/server/onboarding-html.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L92

366patternName = generic_password severity = medium line = 366 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L366

463patternName = generic_password severity = medium line = 463 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L463

561patternName = generic_password severity = medium line = 561 matchedText = password...rt",

Medium

Secret Pattern

corpus/templates/clips/app/i18n/fr-FR.tsView file

1421patternName = generic_password severity = medium line = 1421 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/fr-FR.ts

corpus/templates/clips/app/i18n/fr-FR.tsView on unpkg · L1421

corpus/templates/clips/app/i18n/ar-SA.tsView file

1399patternName = generic_password severity = medium line = 1399 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/ar-SA.ts

corpus/templates/clips/app/i18n/ar-SA.tsView on unpkg · L1399

corpus/templates/clips/app/i18n/de-DE.tsView file

1428patternName = generic_password severity = medium line = 1428 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/de-DE.ts

corpus/templates/clips/app/i18n/de-DE.tsView on unpkg · L1428

corpus/templates/clips/app/i18n/en-US.tsView file

1388patternName = generic_password severity = medium line = 1388 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/en-US.ts

corpus/templates/clips/app/i18n/en-US.tsView on unpkg · L1388

corpus/templates/clips/app/i18n/es-ES.tsView file

1420patternName = generic_password severity = medium line = 1420 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/es-ES.ts

corpus/templates/clips/app/i18n/es-ES.tsView on unpkg · L1420

corpus/templates/plan/app/i18n/fr-FR.tsView file

472patternName = generic_password severity = medium line = 472 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/fr-FR.ts

corpus/templates/plan/app/i18n/fr-FR.tsView on unpkg · L472

corpus/templates/plan/app/i18n/ar-SA.tsView file

649patternName = generic_password severity = medium line = 649 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/ar-SA.ts

corpus/templates/plan/app/i18n/ar-SA.tsView on unpkg · L649

corpus/templates/plan/app/i18n/de-DE.tsView file

661patternName = generic_password severity = medium line = 661 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/de-DE.ts

corpus/templates/plan/app/i18n/de-DE.tsView on unpkg · L661

corpus/templates/plan/app/i18n/en-US.tsView file

638patternName = generic_password severity = medium line = 638 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/en-US.ts

corpus/templates/plan/app/i18n/en-US.tsView on unpkg · L638

corpus/templates/plan/app/i18n/es-ES.tsView file

470patternName = generic_password severity = medium line = 470 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/es-ES.ts

corpus/templates/plan/app/i18n/es-ES.tsView on unpkg · L470

corpus/templates/analytics/server/lib/demo-source.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...RD",

Medium

Secret Pattern

Hardcoded password in corpus/templates/analytics/server/lib/demo-source.ts

corpus/templates/analytics/server/lib/demo-source.tsView on unpkg · L28

Source & flagged code

30 flagged · loading source

dist/server/onboarding-html.jsView file

69patternName = generic_password severity = medium line = 69 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/onboarding-html.jsView on unpkg · L69

329patternName = generic_password severity = medium line = 329 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L329

415patternName = generic_password severity = medium line = 415 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L415

501patternName = generic_password severity = medium line = 501 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L501

931patternName = generic_password severity = medium line = 931 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L931

bin/agent-native.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/agent-native.jsView on unpkg · L2

34if (!shouldUseSourceFallback() && existsSync(distEntry)) { L35: await import(pathToFileURL(distEntry).href); L36: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agent-native.jsView on unpkg · L34

dist/coding-tools/index.jsView file

307cwd, L308: shell: true, L309: stdio: ["pipe", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/coding-tools/index.jsView on unpkg · L307

dist/server/prompts/framework-core.jsView file

35const securityRule = hasDatabaseWrites L36: ? "7. **Security** — Always use `defineAction` with a Zod `schema:` for input validation. Never construct SQL with string concatenation — use parameterized queries via db-query/db-... L37: : hasDatabaseTools

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server/prompts/framework-core.jsView on unpkg · L35

dist/cli/migrate.jsView file

6const __filename = fileURLToPath(import.meta.url); L7: const __dirname = path.dirname(__filename); L8: const DEFAULT_APP_NAME = "migration"; ... L21: "COHERE_API_KEY", L22: "BUILDER_PRIVATE_KEY", L23: ]; ... L291: cwd, L292: metadata: { L293: source, ... L437: ` App: ${appDir}`, L438: ` URL: http://localhost:${MIGRATION_DEV_PORT}/`, L439: "",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/migrate.jsView on unpkg · L6

dist/terminal/pty-server.jsView file

84} L85: export async function createPtyWebSocketServer(options = {}) { L86: const { appDir = process.cwd(), command: defaultCommand = "claude", port = 0, authCheck, logPrefix = "[terminal]", } = options; ... L90: const resolvedAppDir = path.resolve(appDir); L91: const shell = os.platform() === "win32" ? "cmd.exe" : process.env.SHELL || "/bin/zsh"; L92: const server = createHttpServer((req, res) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/terminal/pty-server.jsView on unpkg · L84

dist/server/design-token-utils.jsView file

3* L4: * Pure functions for parsing Tailwind configs, CSS files, package.json, L5: * documents, and URLs to extract colors, fonts, spacing, border-radius, ... L129: throw new Error("Could not parse GitHub owner/repo from URL. " + L130: 'Expected format: "https://github.com/org/repo", "org/repo", or "git@github.com:org/repo.git"'); L131: } ... L150: try { L151: const body = (await res.json()); L152: if (typeof body.message === "string") ... L164: } L165: return { ok: false, status: res.status, data: null, message }; L166: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/design-token-utils.jsView on unpkg · L3

dist/server/action-discovery.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/server/action-discovery.jsView on unpkg · L225

dist/cli/skills.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/skills.jsView on unpkg

corpus/core/src/server/onboarding-html.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L92

366patternName = generic_password severity = medium line = 366 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L366

463patternName = generic_password severity = medium line = 463 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L463

561patternName = generic_password severity = medium line = 561 matchedText = password...rt",

Medium

Secret Pattern

corpus/templates/clips/app/i18n/fr-FR.tsView file

1421patternName = generic_password severity = medium line = 1421 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/fr-FR.ts

corpus/templates/clips/app/i18n/fr-FR.tsView on unpkg · L1421

corpus/templates/clips/app/i18n/ar-SA.tsView file

1399patternName = generic_password severity = medium line = 1399 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/ar-SA.ts

corpus/templates/clips/app/i18n/ar-SA.tsView on unpkg · L1399

corpus/templates/clips/app/i18n/de-DE.tsView file

1428patternName = generic_password severity = medium line = 1428 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/de-DE.ts

corpus/templates/clips/app/i18n/de-DE.tsView on unpkg · L1428

corpus/templates/clips/app/i18n/en-US.tsView file

1388patternName = generic_password severity = medium line = 1388 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/en-US.ts

corpus/templates/clips/app/i18n/en-US.tsView on unpkg · L1388

corpus/templates/clips/app/i18n/es-ES.tsView file

1420patternName = generic_password severity = medium line = 1420 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/es-ES.ts

corpus/templates/clips/app/i18n/es-ES.tsView on unpkg · L1420

corpus/templates/plan/app/i18n/fr-FR.tsView file

472patternName = generic_password severity = medium line = 472 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/fr-FR.ts

corpus/templates/plan/app/i18n/fr-FR.tsView on unpkg · L472

corpus/templates/plan/app/i18n/ar-SA.tsView file

649patternName = generic_password severity = medium line = 649 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/ar-SA.ts

corpus/templates/plan/app/i18n/ar-SA.tsView on unpkg · L649

corpus/templates/plan/app/i18n/de-DE.tsView file

661patternName = generic_password severity = medium line = 661 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/de-DE.ts

corpus/templates/plan/app/i18n/de-DE.tsView on unpkg · L661

corpus/templates/plan/app/i18n/en-US.tsView file

638patternName = generic_password severity = medium line = 638 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/en-US.ts

corpus/templates/plan/app/i18n/en-US.tsView on unpkg · L638

corpus/templates/plan/app/i18n/es-ES.tsView file

470patternName = generic_password severity = medium line = 470 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/es-ES.ts

corpus/templates/plan/app/i18n/es-ES.tsView on unpkg · L470

corpus/templates/analytics/server/lib/demo-source.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...RD",

Medium

Secret Pattern

Hardcoded password in corpus/templates/analytics/server/lib/demo-source.ts

corpus/templates/analytics/server/lib/demo-source.tsView on unpkg · L28

Source & flagged code

30 flagged

dist/server/onboarding-html.jsView file

Lines 49-89javascript

49 languageLabel: "Language",

50 systemLanguage: "System",

51 pageTitleSignIn: "Sign in",

52 pageTitleWelcome: "Welcome",

53 welcomeTitle: "Welcome",

54 signInTitle: "Sign in",

55 welcomeBackTitle: "Welcome back",

56 checkEmailTitle: "Check your email",

57 resetPasswordTitle: "Reset password",

58 createAccountSubtitle: "Create an account to get started",

59 googleOnlySubtitle: "Use your workspace Google account to continue",

60 signInSubtitle: "Sign in to your account",

61 finishAccountSubtitle: "Finish creating your account",

62 resetPasswordSubtitle: "Reset your password",

63 upgradeCopy: "Continue signing in to attach this app to your account and migrate local data.",

64 googleButton: "Sign in with Google",

65 dividerOr: "or",

66 createAccount: "Create account",

67 signIn: "Sign in",

68 email: "Email",

69 password: "Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/onboarding-html.jsView on unpkg · L69

70 confirmPassword: "Confirm password",

71 passwordMinPlaceholder: "At least 8 characters",

72 confirmPasswordPlaceholder: "Confirm password",

73 enterPasswordPlaceholder: "Enter password",

74 signupProgress: "Signup progress",

75 progressAccount: "Account",

76 progressVerify: "Verify",

77 progressStart: "Start",

78 verificationSent: "Verification email sent",

79 verifyCopyPrefix: "We sent a secure link to",

80 verifyCopySuffix: ". Click it, return here, and this app will finish signing you in automatically.",

81 verificationNote: "You can keep this tab open. If it has not refreshed after you come back, use Continue.",

82 continue: "Continue",

83 resendEmail: "Resend email",

84 back: "Back",

85 forgotPassword: "Forgot password?",

86 sendResetLink: "Send reset link",

87 backToSignIn: "Back to sign in",

88 localNotePrefix: "Your account is stored in this app's own DB",

89 localNoteSuffix: ", not a third-party service.",

329patternName = generic_password severity = medium line = 329 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L329

415patternName = generic_password severity = medium line = 415 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L415

501patternName = generic_password severity = medium line = 501 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L501

931patternName = generic_password severity = medium line = 931 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in dist/server/onboarding-html.js

dist/server/onboarding-html.jsView on unpkg · L931

bin/agent-native.jsView file

Lines 1-54javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/agent-native.jsView on unpkg · L2

5import { dirname, join } from

dist/coding-tools/index.jsView file

Lines 287-327javascript

287 const existed = fs.existsSync(filePath);

288 fs.writeFileSync(filePath, content, "utf8");

289 const bytes = Buffer.byteLength(content, "utf8"

dist/server/prompts/framework-core.jsView file

Lines 15-55javascript

15 * appear in the core prompt.

16 */

17export function buildFrameworkCore(examples, options) {

18 const appActionExamples =

dist/cli/migrate.jsView file

Lines 1-26javascript

1import crypto from "crypto";

2import fs from "fs";

3import path from "path";

4import { fileURLToPath } from "url";

dist/terminal/pty-server.jsView file

Lines 64-104javascript

64 }

65 catch { }

66 }

67 try {

68 process.kill(pid, "SIGTERM");

69 }

70 catch { }

dist/server/design-token-utils.jsView file

Lines 1-23javascript

1/**

2 * Shared design-token extraction utilities.

3 *

4 * Pure functions for parsing Tailwind configs, CSS files, package.json,

5 * documents, and URLs to extract colors, fonts, spacing, border-radius,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/design-token-utils.jsView on unpkg · L3

6 * and CSS custom properties. Used by the import-* actions across all

7 * templates (design and slides).

8 *

dist/server/action-discovery.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/server/action-discovery.jsView on unpkg · L225

dist/cli/skills.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/skills.jsView on unpkg

corpus/core/src/server/onboarding-html.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L92

366patternName = generic_password severity = medium line = 366 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L366

463patternName = generic_password severity = medium line = 463 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/core/src/server/onboarding-html.ts

corpus/core/src/server/onboarding-html.tsView on unpkg · L463

561patternName = generic_password severity = medium line = 561 matchedText = password...rt",

Medium

Secret Pattern

corpus/templates/clips/app/i18n/fr-FR.tsView file

1421patternName = generic_password severity = medium line = 1421 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/fr-FR.ts

corpus/templates/clips/app/i18n/fr-FR.tsView on unpkg · L1421

corpus/templates/clips/app/i18n/ar-SA.tsView file

1399patternName = generic_password severity = medium line = 1399 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/ar-SA.ts

corpus/templates/clips/app/i18n/ar-SA.tsView on unpkg · L1399

corpus/templates/clips/app/i18n/de-DE.tsView file

1428patternName = generic_password severity = medium line = 1428 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/de-DE.ts

corpus/templates/clips/app/i18n/de-DE.tsView on unpkg · L1428

corpus/templates/clips/app/i18n/en-US.tsView file

1388patternName = generic_password severity = medium line = 1388 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/en-US.ts

corpus/templates/clips/app/i18n/en-US.tsView on unpkg · L1388

corpus/templates/clips/app/i18n/es-ES.tsView file

1420patternName = generic_password severity = medium line = 1420 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/clips/app/i18n/es-ES.ts

corpus/templates/clips/app/i18n/es-ES.tsView on unpkg · L1420

corpus/templates/plan/app/i18n/fr-FR.tsView file

472patternName = generic_password severity = medium line = 472 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/fr-FR.ts

corpus/templates/plan/app/i18n/fr-FR.tsView on unpkg · L472

corpus/templates/plan/app/i18n/ar-SA.tsView file

649patternName = generic_password severity = medium line = 649 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/ar-SA.ts

corpus/templates/plan/app/i18n/ar-SA.tsView on unpkg · L649

corpus/templates/plan/app/i18n/de-DE.tsView file

661patternName = generic_password severity = medium line = 661 matchedText = password...rt",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/de-DE.ts

corpus/templates/plan/app/i18n/de-DE.tsView on unpkg · L661

corpus/templates/plan/app/i18n/en-US.tsView file

638patternName = generic_password severity = medium line = 638 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/en-US.ts

corpus/templates/plan/app/i18n/en-US.tsView on unpkg · L638

corpus/templates/plan/app/i18n/es-ES.tsView file

470patternName = generic_password severity = medium line = 470 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in corpus/templates/plan/app/i18n/es-ES.ts

corpus/templates/plan/app/i18n/es-ES.tsView on unpkg · L470

corpus/templates/analytics/server/lib/demo-source.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...RD",

Medium

Secret Pattern

Hardcoded password in corpus/templates/analytics/server/lib/demo-source.ts

corpus/templates/analytics/server/lib/demo-source.tsView on unpkg · L28

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code