registry / @massu/core / 1.15.1

@massu/core@1.15.1

AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 2.17 MB of source, external domains: code.claude.com, massu.ai, registry.massu.ai, unpkg.com

Source & flagged code

3 flagged

dist/hooks/post-tool-use.jsView file

Lines 1890-1930javascript

1890 fileFilter: /\.(ts|tsx)$/

1891 },

1892 {

1893 regex: /(password|secret|token|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,

1894 severity: "critical",

1895 description: "Hardcoded credential or secret"

1896 },

1897 {

1898 regex: /\bdangerouslySetInnerHTML\b/,

1899 severity: "high",

1900 description: "XSS risk via dangerouslySetInnerHTML",

1901 fileFilter: /\.tsx$/

1902 },

1903 {

1904 regex: /\.raw\s*\(`/,

1905 severity: "high",

1906 description: "Raw SQL query with template literal (SQL injection risk)"

1907 },

1908 {

1909 regex: /eval\s*\(/,

1910 severity: "high",

1911 description: "Use of eval() - code injection risk"

1912 },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L1910

1913 {

1914 regex: /process\.env\.\w+.*\bconsole\.(log|info|debug)/,

1915 severity: "medium",

1916 description: "Environment variable logged to console"

1917 },

1918 {

1919 regex: /catch\s*$[^)]*$\s*\{[^}]*res\.(json|send)\([^)]*err/,

1920 severity: "medium",

1921 description: "Error details exposed in response"

1922 },

1923 {

1924 regex: /Access-Control-Allow-Origin.*\*/,

1925 severity: "medium",

1926 description: "Overly permissive CORS (allows all origins)"

1927 },

1928 {

1929 regex: /new\s+URL\s*\(\s*(?:req|input|params|query)/,

1930 severity: "medium",

dist/cli.jsView file

67function findProjectRoot() { L68: const cwd = process.cwd(); L69: let dir = cwd; ... L79: while (true) { L80: if (existsSync(resolve(dir, "package.json"))) { L81: return dir; ... L178: }; L179: if (!_config.cloud?.apiKey && process.env.MASSU_API_KEY) { L180: _config.cloud = { ... L1429: created_at: r2.created_at, L1430: metadata: safeJsonParse(r2.metadata_json) ?? {} L1431: }));

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L67

patterns/testing-patterns.mdView file

Lines 510-550markdown

510 expect.objectContaining({ method: 'POST' })

511 );

512});

513```

514

515### Testing React Components

516```typescript

517import { render, screen } from '@testing-library/react';

518import userEvent from '@testing-library/user-event';

519

520it('should submit form', async () => {

521 const handleSubmit = vi.fn();

522 render(<LoginForm onSubmit={handleSubmit} />);

Source & flagged code

3 flagged · loading source

dist/hooks/post-tool-use.jsView file

1910severity: "high", L1911: description: "Use of eval() - code injection risk" L1912: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L1910

dist/cli.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L67

patterns/testing-patterns.mdView file

530patternName = generic_password severity = medium line = 530 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in patterns/testing-patterns.md

patterns/testing-patterns.mdView on unpkg · L530

Findings

1 High5 Medium7 Low

HighObfuscated Payload Loaderdist/cli.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpatterns/testing-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/hooks/post-tool-use.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/hooks/post-tool-use.jsView file

Lines 1890-1930javascript

1890 fileFilter: /\.(ts|tsx)$/

1891 },

1892 {

1893 regex: /(password|secret|token|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,

1894 severity: "critical",

1895 description: "Hardcoded credential or secret"

1896 },

1897 {

1898 regex: /\bdangerouslySetInnerHTML\b/,

1899 severity: "high",

1900 description: "XSS risk via dangerouslySetInnerHTML",

1901 fileFilter: /\.tsx$/

1902 },

1903 {

1904 regex: /\.raw\s*\(`/,

1905 severity: "high",

1906 description: "Raw SQL query with template literal (SQL injection risk)"

1907 },

1908 {

1909 regex: /eval\s*\(/,

1910 severity: "high",

1911 description: "Use of eval() - code injection risk"

1912 },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L1910

1913 {

1914 regex: /process\.env\.\w+.*\bconsole\.(log|info|debug)/,

1915 severity: "medium",

1916 description: "Environment variable logged to console"

1917 },

1918 {

1919 regex: /catch\s*$[^)]*$\s*\{[^}]*res\.(json|send)\([^)]*err/,

1920 severity: "medium",

1921 description: "Error details exposed in response"

1922 },

1923 {

1924 regex: /Access-Control-Allow-Origin.*\*/,

1925 severity: "medium",

1926 description: "Overly permissive CORS (allows all origins)"

1927 },

1928 {

1929 regex: /new\s+URL\s*\(\s*(?:req|input|params|query)/,

1930 severity: "medium",

dist/cli.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L67

patterns/testing-patterns.mdView file

Lines 510-550markdown

510 expect.objectContaining({ method: 'POST' })

511 );

512});

513```

514

515### Testing React Components

516```typescript

517import { render, screen } from '@testing-library/react';

518import userEvent from '@testing-library/user-event';

519

520it('should submit form', async () => {

521 const handleSubmit = vi.fn();

522 render(<LoginForm onSubmit={handleSubmit} />);