registry / @cat-factory/kernel / 0.89.1

@cat-factory/kernel@0.89.1

Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a shared ESM kernel with pure logic, type/port definitions, in-memory registries, URL safety helpers, and model catalog metadata.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing package entrypoint or calling exported helpers

Impact

No source evidence of execution, persistence, credential harvesting, exfiltration, destructive behavior, or install-time mutation

Mechanism

Pure domain logic and in-memory registry operations

Rationale

Static inspection shows scanner hits are package-aligned parsing/catalog/registry code, with no lifecycle hooks or reachable malicious primitive. The Unicode finding is a BOM-tolerant regex character in front-matter stripping, not Trojan Source control text.

Evidence

package.jsondist/index.jsdist/domain/doc-quality-logic.jsdist/domain/models.jsdist/domain/provider-registry.jsdist/shared/redact-secrets.logic.jsdist/shared/atlassian.logic.jsdist/shared/ip-host.logic.js

Network endpoints3

api.z.ai/api/anthropicapi.moonshot.ai/anthropicapi.deepseek.com/anthropic

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks and exports only ./dist/index.js.
dist/index.js is a barrel exporting domain logic, registries, ports, and shared pure helpers.
dist/domain/doc-quality-logic.js performs Markdown parsing/link extraction only; no I/O, process, network, or shell use.
Trojan-source hint is a benign FEFF/BOM-tolerant regex in stripFrontMatter, not bidi control flow hiding.
Search found no child_process, eval/Function, fs imports, dynamic require/import, or lifecycle mutation code.
Network URLs are static model/provider catalog metadata in dist/domain/models.js, not contacted by this package.

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 119 file(s), 182 KB of source, external domains: api.deepseek.com, api.moonshot.ai, api.z.ai

Source & flagged code

2 flagged

dist/domain/doc-quality-logic.jsView file

Lines 1-29javascript

1// Pure structural analysis of a drafted Markdown document, shared by the `doc-quality`

2// gate's provider and its unit tests. Lives in kernel (like `gate-logic.ts`) so the check

3// is a deterministic, runtime-neutral reduction over the document text + the required

4// section list — the gate's provider (in `@cat-factory/server`) resolves the section list

5// from the WS1 template (`docTemplateFor`, the single source of truth) and the file bytes

6// via the checkout-free `RepoFiles` port, then calls this to classify. No I/O here.

7/** Strip a leading YAML front-matter block (`--- … ---`) — it is config, not document prose. */

8function stripFrontMatter(content) {

9 const m = content.match(/^?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

10 return m ? content.slice(m[0].length) : content;

11}

12/** Strip fenced code blocks (``` / ~~~) so their contents aren't parsed as headings/placeholders. */

13function stripFencedCode(content) {

14 const lines = content.split(/\r?\n/);

15 const out = [];

16 let fence = null;

17 for (const line of lines) {

18 const open = line.match(/^\s*(`{3,}|~{3,})/);

19 if (fence) {

20 // Inside a fence: a matching (or longer) fence of the same char closes it.

21 if (open && open[1][0] === fence[0] && open[1].length >= fence.length)

22 fence = null;

23 continue;

24 }

25 if (open) {

26 fence = open[1];

27 continue;

28 }

29 out.push(line);

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/domain/doc-quality-logic.jsView file

9contains invisible/control Unicode U+FEFF (zero width no-break space) const m = content.match(/^<U+FEFF>?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg

Findings

2 Critical1 Medium4 Low

CriticalTrojan Source Unicodedist/domain/doc-quality-logic.js

CriticalTrigger Reachable Dangerous Capabilitydist/domain/doc-quality-logic.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/domain/doc-quality-logic.jsView file

Lines 1-29javascript

1// Pure structural analysis of a drafted Markdown document, shared by the `doc-quality`

2// gate's provider and its unit tests. Lives in kernel (like `gate-logic.ts`) so the check

3// is a deterministic, runtime-neutral reduction over the document text + the required

4// section list — the gate's provider (in `@cat-factory/server`) resolves the section list

5// from the WS1 template (`docTemplateFor`, the single source of truth) and the file bytes

6// via the checkout-free `RepoFiles` port, then calls this to classify. No I/O here.

7/** Strip a leading YAML front-matter block (`--- … ---`) — it is config, not document prose. */

8function stripFrontMatter(content) {

9 const m = content.match(/^?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

10 return m ? content.slice(m[0].length) : content;

11}

12/** Strip fenced code blocks (``` / ~~~) so their contents aren't parsed as headings/placeholders. */

13function stripFencedCode(content) {

14 const lines = content.split(/\r?\n/);

15 const out = [];

16 let fence = null;

17 for (const line of lines) {

18 const open = line.match(/^\s*(`{3,}|~{3,})/);

19 if (fence) {

20 // Inside a fence: a matching (or longer) fence of the same char closes it.

21 if (open && open[1][0] === fence[0] && open[1].length >= fence.length)

22 fence = null;

23 continue;

24 }

25 if (open) {

26 fence = open[1];

27 continue;

28 }

29 out.push(line);

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg