Loading npm security reports…

@dreb/coding-agent@2.42.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @dreb/coding-agent / 2.42.0

@dreb/coding-agent@2.42.0

Coding agent CLI with read, bash, edit, write tools and session management

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 252 file(s), 2.43 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.search.brave.com, chat.qwen.ai, claude.ai, cloud.gitlab.com, console.anthropic.com, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.aliyuncs.com, distro.ibiblio.org, git-scm.com, github.com, gitlab.com, html.duckduckgo.com, mistral.ai, ollama.com, registry.npmjs.org

Source & flagged code

7 flagged

dist/core/secret-scrubber.jsView file

Lines 1-23javascript

1// Multi-line patterns (processed first)

2const pemPrivateKey = /-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/g;

3const opensshPrivateKey = /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/secret-scrubber.jsView on unpkg · L3

Critical

Secret Pattern

OpenSSH private key in dist/core/secret-scrubber.js

dist/core/secret-scrubber.jsView on unpkg · L3

4// Single-line patterns

5const awsAccessKey = /\bAKIA[0-9A-Z]{16}\b/g;

6const githubToken = /ghp_[A-Za-z0-9_]{36,}|gho_[A-Za-z0-9_]{36,}|ghu_[A-Za-z0-9_]{36,}|ghs_[A-Za-z0-9_]{36,}|ghr_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,}/g;

7const gitlabToken = /glpat-[0-9a-zA-Z_-]{20,}/g;

8const anthropicKey = /sk-ant-[a-zA-Z0-9_-]{90,}/g;

9const openaiKey = /sk-(?!ant-)[a-zA-Z0-9_-]{20,}/g;

10const slackToken = /xox[baprs]-[0-9a-zA-Z-]{10,}/g;

11const stripeKey = /[sr]k_(?:test|live)_[0-9a-zA-Z]{24,}/g;

12const urlCredentials = /(https?:\/\/)([^\s:]+):([^\s@]+)@/g;

13const MULTILINE_PATTERNS = [

14 { name: "pem_private_key", pattern: pemPrivateKey },

15 { name: "openssh_private_key", pattern: opensshPrivateKey },

16];

17const SINGLELINE_PATTERNS = [

18 { name: "aws_access_key", pattern: awsAccessKey },

19 { name: "github_token", pattern: githubToken },

20 { name: "gitlab_token", pattern: gitlabToken },

21 { name: "anthropic_key", pattern: anthropicKey },

22 { name: "openai_key", pattern: openaiKey },

23 { name: "slack_token", pattern: slackToken },

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/core/extensions/loader.jsView file

Lines 15-55javascript

15import { createJiti } from "@mariozechner/jiti";

16// Static imports of packages that extensions may use.

17// These MUST be static so Bun bundles them into the compiled binary.

18// The virtualModules option then makes them available to extensions.

19import * as _bundledTypebox from "@sinclair/typebox";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/modes/interactive/interactive-mode.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dreb/coding-agent@2.38.0 matchedIdentity = npm:QGRyZWIvY29kaW5nLWFnZW50:2.38.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/modes/interactive/interactive-mode.jsView on unpkg

Source & flagged code

7 flagged

dist/core/secret-scrubber.jsView file

Lines 1-23javascript

1// Multi-line patterns (processed first)

2const pemPrivateKey = /-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/g;

3const opensshPrivateKey = /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/secret-scrubber.jsView on unpkg · L3

Critical

Secret Pattern

OpenSSH private key in dist/core/secret-scrubber.js

dist/core/secret-scrubber.jsView on unpkg · L3

4// Single-line patterns

5const awsAccessKey = /\bAKIA[0-9A-Z]{16}\b/g;

6const githubToken = /ghp_[A-Za-z0-9_]{36,}|gho_[A-Za-z0-9_]{36,}|ghu_[A-Za-z0-9_]{36,}|ghs_[A-Za-z0-9_]{36,}|ghr_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,}/g;

7const gitlabToken = /glpat-[0-9a-zA-Z_-]{20,}/g;

8const anthropicKey = /sk-ant-[a-zA-Z0-9_-]{90,}/g;

9const openaiKey = /sk-(?!ant-)[a-zA-Z0-9_-]{20,}/g;

10const slackToken = /xox[baprs]-[0-9a-zA-Z-]{10,}/g;

11const stripeKey = /[sr]k_(?:test|live)_[0-9a-zA-Z]{24,}/g;

12const urlCredentials = /(https?:\/\/)([^\s:]+):([^\s@]+)@/g;

13const MULTILINE_PATTERNS = [

14 { name: "pem_private_key", pattern: pemPrivateKey },

15 { name: "openssh_private_key", pattern: opensshPrivateKey },

16];

17const SINGLELINE_PATTERNS = [

18 { name: "aws_access_key", pattern: awsAccessKey },

19 { name: "github_token", pattern: githubToken },

20 { name: "gitlab_token", pattern: gitlabToken },

21 { name: "anthropic_key", pattern: anthropicKey },

22 { name: "openai_key", pattern: openaiKey },

23 { name: "slack_token", pattern: slackToken },

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/core/extensions/loader.jsView file

Lines 15-55javascript

15import { createJiti } from "@mariozechner/jiti";

16// Static imports of packages that extensions may use.

17// These MUST be static so Bun bundles them into the compiled binary.

18// The virtualModules option then makes them available to extensions.

19import * as _bundledTypebox from "@sinclair/typebox";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/modes/interactive/interactive-mode.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/modes/interactive/interactive-mode.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code