registry / @devp2ild/dak / 1.0.4

@devp2ild/dak@1.0.4

DHIS2 AI Kit for Claude skills, API probing, cache helpers, and setup automation.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 60.2 KB of source

Source & flagged code

2 flagged

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView file

Lines 162-202javascript

162 if (raw.baseUrl) {

163 const legacyKey = hostnameFromUrl(raw.baseUrl);

164 raw = {

165 active: legacyKey,

166 instances: {

167 [legacyKey]: { baseUrl: raw.baseUrl, username: raw.username, password: raw.password, authorization: raw.authorization },

168 },

169 };

170 } else {

171 raw = { active: hostname, instances: {} };

172 }

173 }

174 } else {

175 created = true;

176 }

177

178 const existed = !!raw.instances[hostname];

179 raw.instances[hostname] = {

180 baseUrl,

181 username: 'your-username',

182 password: 'your-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView on unpkg · L182

183 };

184 raw.active = hostname;

185

186 writeFileSync(cPath, JSON.stringify(raw, null, 2) + '\n', 'utf8');

187 return { ok: true, created: !existed, hostname, cPath };

188}

189

190/** Wipe probe cache for the active version. Preserves other versions. */

191function clearActiveCache(dir) {

192 // Read active version from config

193 const cPath = join(dir, 'secret', 'instances.config.json');

194 let version = null;

195 try {

196 const raw = JSON.parse(readFileSync(cPath, 'utf8'));

197 let entry = null;

198 if (raw.instances && raw.active) entry = raw.instances[raw.active];

199 else if (raw.baseUrl) entry = raw;

200 if (entry && entry.version) {

201 const parts = entry.version.split('.');

202 version = parts.slice(0, 2).join('.');

dhis2-kit/setup/installer.shView file

•path = dhis2-kit/setup/installer.sh kind = build_helper sizeBytes = 7429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dhis2-kit/setup/installer.shView on unpkg

Source & flagged code

2 flagged · loading source

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView file

182patternName = generic_password severity = medium line = 182 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView on unpkg · L182

dhis2-kit/setup/installer.shView file

•path = dhis2-kit/setup/installer.sh kind = build_helper sizeBytes = 7429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dhis2-kit/setup/installer.shView on unpkg

Findings

4 Medium3 Low

MediumSecret Pattern.claude/skills/dk-shared/scripts/dhis2-guard.mjs

MediumEnvironment Vars

MediumShips Build Helperdhis2-kit/setup/installer.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView file

Lines 162-202javascript

162 if (raw.baseUrl) {

163 const legacyKey = hostnameFromUrl(raw.baseUrl);

164 raw = {

165 active: legacyKey,

166 instances: {

167 [legacyKey]: { baseUrl: raw.baseUrl, username: raw.username, password: raw.password, authorization: raw.authorization },

168 },

169 };

170 } else {

171 raw = { active: hostname, instances: {} };

172 }

173 }

174 } else {

175 created = true;

176 }

177

178 const existed = !!raw.instances[hostname];

179 raw.instances[hostname] = {

180 baseUrl,

181 username: 'your-username',

182 password: 'your-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

.claude/skills/dk-shared/scripts/dhis2-guard.mjsView on unpkg · L182

183 };

184 raw.active = hostname;

185

186 writeFileSync(cPath, JSON.stringify(raw, null, 2) + '\n', 'utf8');

187 return { ok: true, created: !existed, hostname, cPath };

188}

189

190/** Wipe probe cache for the active version. Preserves other versions. */

191function clearActiveCache(dir) {

192 // Read active version from config

193 const cPath = join(dir, 'secret', 'instances.config.json');

194 let version = null;

195 try {

196 const raw = JSON.parse(readFileSync(cPath, 'utf8'));

197 let entry = null;

198 if (raw.instances && raw.active) entry = raw.instances[raw.active];

199 else if (raw.baseUrl) entry = raw;

200 if (entry && entry.version) {

201 const parts = entry.version.split('.');

202 version = parts.slice(0, 2).join('.');

dhis2-kit/setup/installer.shView file

•path = dhis2-kit/setup/installer.sh kind = build_helper sizeBytes = 7429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dhis2-kit/setup/installer.shView on unpkg