registry / @andespindola/pingu-dev-agent / 0.1.49

@andespindola/pingu-dev-agent@0.1.49

Pingu - Dev Agent: agente de pair programming em tempo real (diagnosticos, quick fixes e geracao) para Vim/Neovim, e para qualquer editor via servidor LSP (VS Code, Helix, Zed, Emacs, Sublime).

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 1.24 MB of source

Source & flagged code

5 flagged

lib/generation.jsView file

Lines 2418-2458javascript

2418 ' Keyword.merge([',

2419 ' hostname: "localhost",',

2420 ' username: "root",',

2421 ' password: "root",',

2422 ' database: "app_dev",',

2423 ' ], opts)',

2424 ' )',

2425 'end',

2426 ].join('\n'),

2427 dependencies: [],

2428 };

2429 }

2430

2431 return {

2432 snippet: [

2433 `def ${functionName}(opts \\\\ []) do`,

2434 ' Postgrex.start_link(',

2435 ' Keyword.merge([',

2436 ' hostname: "localhost",',

2437 ' username: "postgres",',

2438 ' password: "postgres",',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/generation.jsView on unpkg · L2438

2439 ' database: "app_dev",',

2440 ' ], opts)',

2441 ' )',

2442 'end',

2443 ].join('\n'),

2444 dependencies: [],

2445 };

2446}

2447function generateCrudSnippet(instruction, ext) {

2448 const entityName = parseCrudEntityName(instruction);

2449 const lowerExt = String(ext || '').toLowerCase();

2450

2451 if (isJavaScriptLikeExtension(lowerExt)) {

2452 return generateJavaScriptCrudSnippet(entityName);

2453 }

2454 if (isPythonLikeExtension(lowerExt)) {

2455 return generatePythonCrudSnippet(entityName);

2456 }

2457 if (['.ex', '.exs'].includes(lowerExt)) {

2458 return generateElixirCrudSnippet(entityName);

lib/analyzer-security.jsView file

Lines 39-79javascript

39}

41function isLineInFocus(focusRange, lineNumber) {

42 if (!focusRange) {

43 return true;

44 }

45 return lineNumber >= focusRange.start && lineNumber

vim/autoload/pingu_dev_agent/guard_runtime.jsView file

Lines 1-22javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vim/autoload/pingu_dev_agent/guard_runtime.jsView on unpkg · L2

lib/analyzer.jsView file

Lines 68-108javascript

68 normalizeFocusedLineRange,

69 shouldAnalyzeDocumentationIssues,

70 shouldAnalyzeFlowComments,

71 shouldRunLightAnalysisDeepPass,

72} = require('./analyzer-options');

73const { checkCommentTask, checkUnitTestCoverage, checkMissingDependencies, buildLeadingFunctionDocumentation, isJavaScriptLikeExtension, isPythonLikeExtension, isGoExtension,

README.mdView file

Lines 73-113markdown

73| Atribuicao acidental em condicao | `if (x = y)` | JS/TS |

74| Codigo inalcancavel | instrucao apos `return`/`throw`/`raise` | JS/TS, Python |

75| `case` duplicado em `switch` | dois `case 1:` no mesmo switch | JS/TS |

76| Desvio de fluxo em `finally` | `return`/`break`/`continue` no `finally` | JS/TS |

77| Erro engolido | `catch {}`

Source & flagged code

5 flagged · loading source

lib/generation.jsView file

2438patternName = generic_password severity = medium line = 2438 matchedText = ' p...",',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/generation.jsView on unpkg · L2438

lib/analyzer-security.jsView file

59if (/\beval\s*\(\s*[A-Za-z_$`]/.test(masked)) { L60: return buildIssue(file, lineNumber, 'command_injection', 'eval() com entrada dinamica executa codigo arbitrario', 'Evite eval; use uma alternativa estruturada (JSON.parse, mapa de ... L61: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/analyzer-security.jsView on unpkg · L59

vim/autoload/pingu_dev_agent/guard_runtime.jsView file

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vim/autoload/pingu_dev_agent/guard_runtime.jsView on unpkg · L2

lib/analyzer.jsView file

88const DEFAULT_MAX_LINE_LENGTH = 120; L89: const DEBUG_ANALYZE_STEPS = /^(?:1|true|yes|on)$/i.test(String(process.env.PINGU_DEBUG_ANALYZE_STEPS || '')); L90: ... L123: if (DEBUG_ANALYZE_STEPS) { L124: process.stderr.write(`[PINGU_DEBUG] start ${label}\n`); L125: } ... L1293: () => source.match(/^(?:export\s+)?(?:default\s+)?(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?(?:<[^>]+>\s*)?(?:$([^)]*)$|([A-Za-z_$][A-Za-z0-9_$]*))\s*(?::... L1294: () => source.match(/^(?:(?:public|private|protected|static|readonly|declare|override|abstract)\s+)*(#?[A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?(?:<[^>]+>\s*)?(?:$([^)]*)$|([A... L1295: () => source.match(/^(?:(?:public|private|protected|static|async|get|set|override|readonly|abstract|declare)\s+)*(#?[A-Za-z_$][A-Za-z0-9_$]*)\s*(?:<[^>]+>)?\s*$([^)]*)$\s*(?::\s*...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/analyzer.jsView on unpkg · L88

README.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = | Segred...as |

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L93

Findings

5 Medium5 Low

MediumSecret Patternlib/generation.js

MediumDynamic Requirevim/autoload/pingu_dev_agent/guard_runtime.js

MediumNetwork

MediumEnvironment Vars

MediumSecret PatternREADME.md

LowScripts Present

LowEvallib/analyzer-security.js

LowWeak Cryptolib/analyzer.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

lib/generation.jsView file

Lines 2418-2458javascript

2418 ' Keyword.merge([',

2419 ' hostname: "localhost",',

2420 ' username: "root",',

2421 ' password: "root",',

2422 ' database: "app_dev",',

2423 ' ], opts)',

2424 ' )',

2425 'end',

2426 ].join('\n'),

2427 dependencies: [],

2428 };

2429 }

2430

2431 return {

2432 snippet: [

2433 `def ${functionName}(opts \\\\ []) do`,

2434 ' Postgrex.start_link(',

2435 ' Keyword.merge([',

2436 ' hostname: "localhost",',

2437 ' username: "postgres",',

2438 ' password: "postgres",',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/generation.jsView on unpkg · L2438

2439 ' database: "app_dev",',

2440 ' ], opts)',

2441 ' )',

2442 'end',

2443 ].join('\n'),

2444 dependencies: [],

2445 };

2446}

2447function generateCrudSnippet(instruction, ext) {

2448 const entityName = parseCrudEntityName(instruction);

2449 const lowerExt = String(ext || '').toLowerCase();

2450

2451 if (isJavaScriptLikeExtension(lowerExt)) {

2452 return generateJavaScriptCrudSnippet(entityName);

2453 }

2454 if (isPythonLikeExtension(lowerExt)) {

2455 return generatePythonCrudSnippet(entityName);

2456 }

2457 if (['.ex', '.exs'].includes(lowerExt)) {

2458 return generateElixirCrudSnippet(entityName);

lib/analyzer-security.jsView file

Lines 39-79javascript

39}

41function isLineInFocus(focusRange, lineNumber) {

42 if (!focusRange) {

43 return true;

44 }

45 return lineNumber >= focusRange.start && lineNumber

vim/autoload/pingu_dev_agent/guard_runtime.jsView file

Lines 1-22javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vim/autoload/pingu_dev_agent/guard_runtime.jsView on unpkg · L2

lib/analyzer.jsView file

Lines 68-108javascript

68 normalizeFocusedLineRange,

69 shouldAnalyzeDocumentationIssues,

70 shouldAnalyzeFlowComments,

71 shouldRunLightAnalysisDeepPass,

72} = require('./analyzer-options');

73const { checkCommentTask, checkUnitTestCoverage, checkMissingDependencies, buildLeadingFunctionDocumentation, isJavaScriptLikeExtension, isPythonLikeExtension, isGoExtension,

README.mdView file

Lines 73-113markdown

73| Atribuicao acidental em condicao | `if (x = y)` | JS/TS |

74| Codigo inalcancavel | instrucao apos `return`/`throw`/`raise` | JS/TS, Python |

75| `case` duplicado em `switch` | dois `case 1:` no mesmo switch | JS/TS |

76| Desvio de fluxo em `finally` | `return`/`break`/`continue` no `finally` | JS/TS |

77| Erro engolido | `catch {}`