@lh8ppl/core-memory-kit: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 135 file(s), 1.59 MB of source, external domains: www.apple.com

Source & flagged code

4 flagged

src/poison-guard.mjsView file

Lines 86-126javascript

86 },

87 // AWS secret access key in a key=value shape. The value pattern is

88 // intentionally lenient (40-char Base64-ish) because real AWS secret

89 // keys are 40 chars of Base64. We require the `aws_secret` token

90 // nearby to gate on intent.

91 {

92 id: 'secret_aws_secret_access_key',

93 category: 'secret',

94 re: /(?:aws[_-]?secret[_-]?(?:access[_-]?)?key)[\s:=]+["']?[A-Za-z0-9/+=]{16,}/i,

95 },

96 // Generic api_key / secret / password / passwd / token / bearer

97 // in a key=value shape. 20-char minimum on the value catches

98 // realistic key shapes without flagging short test fixtures

99 // (api_key=abc123 → only 6 chars, skipped).

100 {

101 id: 'secret_generic_credential',

102 category: 'secret',

103 re: /(?:api[_-]?key|secret|password|passwd|token|bearer)[\s:=]+["']?[A-Za-z0-9_\-/+=]{20,}/i,

104 },

105 // PEM private key armor. The "RSA "/"EC "/"OPENSSH "/"PGP "

106 // variants are optional, so plain `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/poison-guard.mjsView on unpkg · L106

Critical

Secret Pattern

RSA private key in src/poison-guard.mjs

src/poison-guard.mjsView on unpkg · L106

107 // also matches.

108 {

109 id: 'secret_pem_private_key',

110 category: 'secret',

111 re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA |ENCRYPTED )?PRIVATE KEY-----/,

112 },

113 // GitHub personal access token: ghp_ prefix + 36 alphanumeric.

114 // No trailing \b — adjacent alphanumeric padding (in tests; rare in

115 // real input but possible) shouldn't suppress detection. Leading \b

116 // is enough to prevent matching mid-identifier (e.g. "xghp_..." is

117 // not a token).

118 {

119 id: 'secret_github_pat',

120 category: 'secret',

121 re: /\bghp_[A-Za-z0-9]{36}/,

122 },

123 // Task 134: the other GitHub token classes — OAuth (gho_), user-to-server

124 // (ghu_), server-to-server (ghs_), refresh (ghr_). Same ghp_ shape (prefix

125 // + 36 alnum); the 36-char floor is what keeps "ghost"/"ghs config" prose

126 // out (a real English word can't reach prefix+36 alphanumerics).

bin/cmk-weekly-curate.mjsView file

Lines 8-48javascript

8//

9// Composes on weeklyCurate() per design §8.7.1. Always exits 0 — a

10// crashed cron job rotates noise into the scheduler logs without any

11// recovery affordance for the user; the kit's curate.log NDJSON +

12// cooldown marker are the load-bearing observability surfaces.

14import { dirname, join } from 'node:path';

15import { homedir } from

src/register-crons.mjsView file

Lines 1-24javascript

1// Cross-platform host-scheduler registration (Task 33.2, T-028).

2//

3// Composes the platform-native scheduler primitive on each OS so the

4// daily-distill bin wrapper runs at 23:00 local time without users

5// learning crontab / launchd / schtasks themselves.

6//

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/register-crons.mjsView on unpkg · L4

7// Per design §8.6.2:

8// Linux → crontab pipe pattern (idempotent via grep -v + re-add)

Source & flagged code

4 flagged · loading source

src/poison-guard.mjsView file

106

@lh8ppl/core-memory-kit: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

src/poison-guard.mjsView file

Lines 86-126javascript

86 },

87 // AWS secret access key in a key=value shape. The value pattern is

88 // intentionally lenient (40-char Base64-ish) because real AWS secret

89 // keys are 40 chars of Base64. We require the `aws_secret` token

90 // nearby to gate on intent.

91 {

92 id: 'secret_aws_secret_access_key',

93 category: 'secret',

94 re: /(?:aws[_-]?secret[_-]?(?:access[_-]?)?key)[\s:=]+["']?[A-Za-z0-9/+=]{16,}/i,

95 },

96 // Generic api_key / secret / password / passwd / token / bearer

97 // in a key=value shape. 20-char minimum on the value catches

98 // realistic key shapes without flagging short test fixtures

99 // (api_key=abc123 → only 6 chars, skipped).

100 {

101 id: 'secret_generic_credential',

102 category: 'secret',

103 re: /(?:api[_-]?key|secret|password|passwd|token|bearer)[\s:=]+["']?[A-Za-z0-9_\-/+=]{20,}/i,

104 },

105 // PEM private key armor. The "RSA "/"EC "/"OPENSSH "/"PGP "

106 // variants are optional, so plain `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/poison-guard.mjsView on unpkg · L106

Critical

Secret Pattern

RSA private key in src/poison-guard.mjs

src/poison-guard.mjsView on unpkg · L106

107 // also matches.

108 {

109 id: 'secret_pem_private_key',

110 category: 'secret',

111 re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA |ENCRYPTED )?PRIVATE KEY-----/,

112 },

113 // GitHub personal access token: ghp_ prefix + 36 alphanumeric.

114 // No trailing \b — adjacent alphanumeric padding (in tests; rare in

115 // real input but possible) shouldn't suppress detection. Leading \b

116 // is enough to prevent matching mid-identifier (e.g. "xghp_..." is

117 // not a token).

118 {

119 id: 'secret_github_pat',

120 category: 'secret',

121 re: /\bghp_[A-Za-z0-9]{36}/,

122 },

123 // Task 134: the other GitHub token classes — OAuth (gho_), user-to-server

124 // (ghu_), server-to-server (ghs_), refresh (ghr_). Same ghp_ shape (prefix

125 // + 36 alnum); the 36-char floor is what keeps "ghost"/"ghs config" prose

126 // out (a real English word can't reach prefix+36 alphanumerics).

bin/cmk-weekly-curate.mjsView file

Lines 8-48javascript

8//

9// Composes on weeklyCurate() per design §8.7.1. Always exits 0 — a

10// crashed cron job rotates noise into the scheduler logs without any

11// recovery affordance for the user; the kit's curate.log NDJSON +

12// cooldown marker are the load-bearing observability surfaces.

14import { dirname, join } from 'node:path';

15import { homedir } from

src/register-crons.mjsView file

Lines 1-24javascript

1// Cross-platform host-scheduler registration (Task 33.2, T-028).

2//

3// Composes the platform-native scheduler primitive on each OS so the

4// daily-distill bin wrapper runs at 23:00 local time without users

5// learning crontab / launchd / schtasks themselves.

6//

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/register-crons.mjsView on unpkg · L4

7// Per design §8.6.2:

8// Linux → crontab pipe pattern (idempotent via grep -v + re-add)

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code