registry / @dreb/coding-agent / 2.36.1

@dreb/coding-agent@2.36.1

Coding agent CLI with read, bash, edit, write tools and session management

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 252 file(s), 2.40 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.search.brave.com, chat.qwen.ai, claude.ai, cloud.gitlab.com, console.anthropic.com, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.aliyuncs.com, distro.ibiblio.org, git-scm.com, github.com, gitlab.com, html.duckduckgo.com, mistral.ai, ollama.com, registry.npmjs.org

Source & flagged code

6 flagged

dist/core/secret-scrubber.jsView file

Lines 1-23javascript

1// Multi-line patterns (processed first)

2const pemPrivateKey = /-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/g;

3const opensshPrivateKey = /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/secret-scrubber.jsView on unpkg · L3

Critical

Secret Pattern

OpenSSH private key in dist/core/secret-scrubber.js

dist/core/secret-scrubber.jsView on unpkg · L3

4// Single-line patterns

5const awsAccessKey = /\bAKIA[0-9A-Z]{16}\b/g;

6const githubToken = /ghp_[A-Za-z0-9_]{36,}|gho_[A-Za-z0-9_]{36,}|ghu_[A-Za-z0-9_]{36,}|ghs_[A-Za-z0-9_]{36,}|ghr_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,}/g;

7const gitlabToken = /glpat-[0-9a-zA-Z_-]{20,}/g;

8const anthropicKey = /sk-ant-[a-zA-Z0-9_-]{90,}/g;

9const openaiKey = /sk-(?!ant-)[a-zA-Z0-9_-]{20,}/g;

10const slackToken = /xox[baprs]-[0-9a-zA-Z-]{10,}/g;

11const stripeKey = /[sr]k_(?:test|live)_[0-9a-zA-Z]{24,}/g;

12const urlCredentials = /(https?:\/\/)([^\s:]+):([^\s@]+)@/g;

13const MULTILINE_PATTERNS = [

14 { name: "pem_private_key", pattern: pemPrivateKey },

15 { name: "openssh_private_key", pattern: opensshPrivateKey },

16];

17const SINGLELINE_PATTERNS = [

18 { name: "aws_access_key", pattern: awsAccessKey },

19 { name: "github_token", pattern: githubToken },

20 { name: "gitlab_token", pattern: gitlabToken },

21 { name: "anthropic_key", pattern: anthropicKey },

22 { name: "openai_key", pattern: openaiKey },

23 { name: "slack_token", pattern: slackToken },

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 15-55javascript

15import { createJiti } from "@mariozechner/jiti";

16// Static imports of packages that extensions may use.

17// These MUST be static so Bun bundles them into the compiled binary.

18// The virtualModules option then makes them available to extensions.

19import * as _bundledTypebox from "@sinclair/typebox";

20import { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from "../../config.js";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/core/secret-scrubber.jsView file

3patternName = private_key_openssh severity = critical line = 3 matchedText = const op...-/g;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/secret-scrubber.jsView on unpkg · L3

3patternName = private_key_openssh severity = critical line = 3 matchedText = const op...-/g;

Critical

Secret Pattern

OpenSSH private key in dist/core/secret-scrubber.js

dist/core/secret-scrubber.jsView on unpkg · L3

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

35}; L36: const require = createRequire(import.meta.url); L37: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L35

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Findings

2 Critical7 Medium6 Low

CriticalCritical Secretdist/core/secret-scrubber.js

CriticalSecret Patterndist/core/secret-scrubber.js

MediumDynamic Requiredist/core/extensions/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/core/secret-scrubber.jsView file

Lines 1-23javascript

1// Multi-line patterns (processed first)

2const pemPrivateKey = /-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/g;

3const opensshPrivateKey = /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/secret-scrubber.jsView on unpkg · L3

Critical

Secret Pattern

OpenSSH private key in dist/core/secret-scrubber.js

dist/core/secret-scrubber.jsView on unpkg · L3

4// Single-line patterns

5const awsAccessKey = /\bAKIA[0-9A-Z]{16}\b/g;

6const githubToken = /ghp_[A-Za-z0-9_]{36,}|gho_[A-Za-z0-9_]{36,}|ghu_[A-Za-z0-9_]{36,}|ghs_[A-Za-z0-9_]{36,}|ghr_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,}/g;

7const gitlabToken = /glpat-[0-9a-zA-Z_-]{20,}/g;

8const anthropicKey = /sk-ant-[a-zA-Z0-9_-]{90,}/g;

9const openaiKey = /sk-(?!ant-)[a-zA-Z0-9_-]{20,}/g;

10const slackToken = /xox[baprs]-[0-9a-zA-Z-]{10,}/g;

11const stripeKey = /[sr]k_(?:test|live)_[0-9a-zA-Z]{24,}/g;

12const urlCredentials = /(https?:\/\/)([^\s:]+):([^\s@]+)@/g;

13const MULTILINE_PATTERNS = [

14 { name: "pem_private_key", pattern: pemPrivateKey },

15 { name: "openssh_private_key", pattern: opensshPrivateKey },

16];

17const SINGLELINE_PATTERNS = [

18 { name: "aws_access_key", pattern: awsAccessKey },

19 { name: "github_token", pattern: githubToken },

20 { name: "gitlab_token", pattern: gitlabToken },

21 { name: "anthropic_key", pattern: anthropicKey },

22 { name: "openai_key", pattern: openaiKey },

23 { name: "slack_token", pattern: slackToken },

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 15-55javascript

15import { createJiti } from "@mariozechner/jiti";

16// Static imports of packages that extensions may use.

17// These MUST be static so Bun bundles them into the compiled binary.

18// The virtualModules option then makes them available to extensions.

19import * as _bundledTypebox from "@sinclair/typebox";

20import { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from "../../config.js";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg