registry / @massu/core / 1.15.7

@massu/core@1.15.7

AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 26 file(s), 4.15 MB of source, external domains: api.massu.ai, massu.ai, registry.massu.ai, unpkg.com

Source & flagged code

5 flagged

dist/hooks/post-tool-use.jsView file

Lines 1178-1218javascript

1178 for (let i = 0; i < 8; i++) {

1179 if (existsSync5(join3(dir, "package.json"))) {

1180 root = dir;

1181 break;

1182 }

1183 const parent = dirname4(dir);

1184 if (parent === dir) break;

1185 dir = parent;

1186 }

1187 if (!root) return null;

1188 for (const rel of ["dist/embedder", "assets/embedder"]) {

1189 const candidate = join3(root, rel);

1190 if (existsSync5(join3(candidate, "model_quantized.onnx"))) return candidate;

1191 }

1192 return null;

1193 } catch {

1194 return null;

1195 }

1196}

1197function resolveWasmDir() {

1198 try {

1199 const req = createRequire(import.meta.url);

1200 const main2 = req.resolve(ORT_PKG);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hooks/post-tool-use.jsView on unpkg · L1198

1201 return dirname4(main2);

1202 } catch {

1203 return null;

1204 }

1205}

1206async function getSession() {

1207 if (_sessionPromise) return _sessionPromise;

1208 _sessionPromise = (async () => {

1209 try {

1210 const modelDir = resolveModelDir();

1211 const wasmDir = resolveWasmDir();

1212 if (!modelDir || !wasmDir) return null;

1213 const ort = await import(

1214 /* @vite-ignore */

1215 ORT_PKG

1216 );

1217 ort.env.wasm.numThreads = 1;

1218 ort.env.wasm.proxy = false;

Lines 4074-4114javascript

4074 fileFilter: /\.(ts|tsx)$/

4075 },

4076 {

4077 regex: /(password|secret|token|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,

4078 severity:

dist/hooks/security-gate.jsView file

Lines 29-69javascript

29// src/lib/memory-path.ts

30function encodeMemoryDirName(projectRoot) {

31 return projectRoot.replace(/\//g, "-");

32}

33var init_memory_path = __esm({

34 "src/lib/memory-path.ts"() {

dist/hooks/memory-recall.jsView file

Lines 830-870javascript

830 if (a.length !== b.length || a.length === 0) return 0;

831 let dot = 0;

832 let na = 0;

833

patterns/testing-patterns.mdView file

Lines 512-552markdown

512 expect.objectContaining({ method: 'POST' })

513 );

514});

515```

516

517### Testing React Components

518```typescript

519import { render, screen } from '@testing-library/react';

520import userEvent from '@testing-library/user-event';

521

522it('should submit form', async () => {

523 const handleSubmit = vi.fn();

524 render(<LoginForm onSubmit={handleSubmit} />);

Source & flagged code

5 flagged · loading source

dist/hooks/post-tool-use.jsView file

1198try { L1199: const req = createRequire(import.meta.url); L1200: const main2 = req.resolve(ORT_PKG);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hooks/post-tool-use.jsView on unpkg · L1198

4094severity: "high", L4095: description: "Use of eval() - code injection risk" L4096: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L4094

dist/hooks/security-gate.jsView file

49} from "fs"; L50: function credentialsDir(home = homedir()) { L51: return resolve(home, ".massu"); ... L59: if (!existsSync(p)) return void 0; L60: const parsed = JSON.parse(readFileSync(p, "utf-8")); L61: const key = typeof parsed?.apiKey === "string" ? parsed.apiKey.trim() : ""; ... L70: function resolveApiKey(opts = {}) { L71: const env = opts.env ?? process.env; L72: const home = opts.home ?? homedir(); ... L102: MASSU_ENV_CLOUD_ENDPOINT = "MASSU_CLOUD_ENDPOINT"; L103: DEFAULT_CLOUD_ENDPOINT = "https://api.massu.ai/v1"; L104: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/hooks/security-gate.jsView on unpkg · L49

dist/hooks/memory-recall.jsView file

850package = @massu/core; repositoryIdentity = massu; dependency = better-sqlite3 L850: // src/db-backup.ts L851: import Database from "better-sqlite3"; L852: import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync2 } from "fs";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hooks/memory-recall.jsView on unpkg · L850

patterns/testing-patterns.mdView file

532patternName = generic_password severity = medium line = 532 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in patterns/testing-patterns.md

patterns/testing-patterns.mdView on unpkg · L532

Findings

2 High5 Medium7 Low

HighObfuscated Payload Loaderdist/hooks/security-gate.js

HighCopied Package Dependency Bridgedist/hooks/memory-recall.js

MediumDynamic Requiredist/hooks/post-tool-use.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpatterns/testing-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/hooks/post-tool-use.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/hooks/post-tool-use.jsView file

Lines 1178-1218javascript

1178 for (let i = 0; i < 8; i++) {

1179 if (existsSync5(join3(dir, "package.json"))) {

1180 root = dir;

1181 break;

1182 }

1183 const parent = dirname4(dir);

1184 if (parent === dir) break;

1185 dir = parent;

1186 }

1187 if (!root) return null;

1188 for (const rel of ["dist/embedder", "assets/embedder"]) {

1189 const candidate = join3(root, rel);

1190 if (existsSync5(join3(candidate, "model_quantized.onnx"))) return candidate;

1191 }

1192 return null;

1193 } catch {

1194 return null;

1195 }

1196}

1197function resolveWasmDir() {

1198 try {

1199 const req = createRequire(import.meta.url);

1200 const main2 = req.resolve(ORT_PKG);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hooks/post-tool-use.jsView on unpkg · L1198

1201 return dirname4(main2);

1202 } catch {

1203 return null;

1204 }

1205}

1206async function getSession() {

1207 if (_sessionPromise) return _sessionPromise;

1208 _sessionPromise = (async () => {

1209 try {

1210 const modelDir = resolveModelDir();

1211 const wasmDir = resolveWasmDir();

1212 if (!modelDir || !wasmDir) return null;

1213 const ort = await import(

1214 /* @vite-ignore */

1215 ORT_PKG

1216 );

1217 ort.env.wasm.numThreads = 1;

1218 ort.env.wasm.proxy = false;

Lines 4074-4114javascript

4074 fileFilter: /\.(ts|tsx)$/

4075 },

4076 {

4077 regex: /(password|secret|token|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,

4078 severity:

dist/hooks/security-gate.jsView file

Lines 29-69javascript

29// src/lib/memory-path.ts

30function encodeMemoryDirName(projectRoot) {

31 return projectRoot.replace(/\//g, "-");

32}

33var init_memory_path = __esm({

34 "src/lib/memory-path.ts"() {

dist/hooks/memory-recall.jsView file

Lines 830-870javascript

830 if (a.length !== b.length || a.length === 0) return 0;

831 let dot = 0;

832 let na = 0;

833

patterns/testing-patterns.mdView file

Lines 512-552markdown

512 expect.objectContaining({ method: 'POST' })

513 );

514});

515```

516

517### Testing React Components

518```typescript

519import { render, screen } from '@testing-library/react';

520import userEvent from '@testing-library/user-event';

521

522it('should submit form', async () => {

523 const handleSubmit = vi.fn();

524 render(<LoginForm onSubmit={handleSubmit} />);