registry / @codyswann/lisa / 2.187.0

@codyswann/lisa@2.187.0

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 354 file(s), 2.18 MB of source, external domains: agents.md, api.expo.dev, api.github.com, github.com, opencode.ai, registry.npmjs.org

Source & flagged code

11 flagged

package.jsonView file

Lines 1-26json

2 "scripts": {

3 "build": "bun run build:dist && bun run build:plugins",

4 "build:dist": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",

5 "test:integration": "vitest run tests/integration",

6 "postinstall": "bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 "pretest": "[ -d dist/configs ] || bun run build",

8 "test": "vitest run",

9 "test:unit": "vitest run --exclude='**/integration/**'",

10 "test:cov": "vitest run --coverage",

11 "lint": "oxlint --disable-nested-config && eslint . --quiet",

12 "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",

13 "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",

14 "typecheck": "tsc --noEmit",

15 "format:check": "prettier --check .",

16 "format": "prettier --check . --write",

17 "knip:check": "knip",

18 "knip:fix": "knip --fix",

19 "sg:scan": "ast-grep scan",

20 "build:plugins": "bash scripts/build-plugins.sh",

21 "prepare": "node -e \"if (process.env.INIT_CWD && process.env.INIT_CWD.includes('.serverless')) { process.exit(0); }\" && husky install || true",

22 "start": "node dist/index.js",

23 "dev": "tsx src/index.ts",

24 "test:watch": "vitest",

25 "update-node-version": "tsx scripts/update-node-version.ts",

26 "cleanup:amplify-branches": "bash scripts/cleanup-amplify-branches.sh",

harper-fabric/create-only/.github/workflows/deploy.ymlView file

72patternName = generic_password severity = medium line = 72 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L72

cdk/copy-overwrite/eslint.config.tsView file

Lines 6-42typescript

6/**

7 * ESLint 9 Flat Config - Main Entry Point (CDK)

8 *

9 * Thin wrapper around @codyswann/lisa eslint config factory.

10 * Customize via eslint.config.local.ts and eslint.thresholds.json.

11 *

12 * @see https://eslint.org/docs/latest/use/configure/configuration-files-new

13 * @module eslint.config

14 */

15import { createRequire }

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 2921 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

typescript/copy-overwrite/.claude/hooks/worktree-create.shView file

•path = typescript/copy-overwrite/.claude/hooks/worktree-create.sh kind = payload_in_excluded_dir sizeBytes = 2879 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

typescript/copy-overwrite/.claude/hooks/worktree-create.shView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

11 ssn:

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

11 ssn:

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

72patternName = generic_password severity = medium line = 72 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L72

cdk/copy-overwrite/eslint.config.tsView file

26L27: const require = createRequire(import.meta.url); L28: const ignoreConfig = require("./eslint.ignore.config.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cdk/copy-overwrite/eslint.config.tsView on unpkg · L26

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 2921 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

typescript/copy-overwrite/.claude/hooks/worktree-create.shView file

•path = typescript/copy-overwrite/.claude/hooks/worktree-create.sh kind = payload_in_excluded_dir sizeBytes = 2879 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

typescript/copy-overwrite/.claude/hooks/worktree-create.shView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14

Findings

2 High12 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtypescript/copy-overwrite/.claude/hooks/worktree-create.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternharper-fabric/create-only/.github/workflows/deploy.yml

MediumDynamic Requirecdk/copy-overwrite/eslint.config.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperharper-fabric/create-only/scripts/zap-baseline.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternplugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki-agy/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

MediumSecret Patternplugins/src/wiki/scripts/wiki-safety.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

package.jsonView file

Lines 1-26json

2 "scripts": {

3 "build": "bun run build:dist && bun run build:plugins",

4 "build:dist": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",

5 "test:integration": "vitest run tests/integration",

6 "postinstall": "bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 "pretest": "[ -d dist/configs ] || bun run build",

8 "test": "vitest run",

9 "test:unit": "vitest run --exclude='**/integration/**'",

10 "test:cov": "vitest run --coverage",

11 "lint": "oxlint --disable-nested-config && eslint . --quiet",

12 "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",

13 "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",

14 "typecheck": "tsc --noEmit",

15 "format:check": "prettier --check .",

16 "format": "prettier --check . --write",

17 "knip:check": "knip",

18 "knip:fix": "knip --fix",

19 "sg:scan": "ast-grep scan",

20 "build:plugins": "bash scripts/build-plugins.sh",

21 "prepare": "node -e \"if (process.env.INIT_CWD && process.env.INIT_CWD.includes('.serverless')) { process.exit(0); }\" && husky install || true",

22 "start": "node dist/index.js",

23 "dev": "tsx src/index.ts",

24 "test:watch": "vitest",

25 "update-node-version": "tsx scripts/update-node-version.ts",

26 "cleanup:amplify-branches": "bash scripts/cleanup-amplify-branches.sh",

harper-fabric/create-only/.github/workflows/deploy.ymlView file

72patternName = generic_password severity = medium line = 72 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L72

cdk/copy-overwrite/eslint.config.tsView file

Lines 6-42typescript

6/**

7 * ESLint 9 Flat Config - Main Entry Point (CDK)

8 *

9 * Thin wrapper around @codyswann/lisa eslint config factory.

10 * Customize via eslint.config.local.ts and eslint.thresholds.json.

11 *

12 * @see https://eslint.org/docs/latest/use/configure/configuration-files-new

13 * @module eslint.config

14 */

15import { createRequire }

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 2921 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

typescript/copy-overwrite/.claude/hooks/worktree-create.shView file

•path = typescript/copy-overwrite/.claude/hooks/worktree-create.sh kind = payload_in_excluded_dir sizeBytes = 2879 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

typescript/copy-overwrite/.claude/hooks/worktree-create.shView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

11 ssn:

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

11 ssn:

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

10const PLACEHOLDERS = {

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14