registry / @massu/core / 1.16.2

@massu/core@1.16.2

AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 26 file(s), 4.26 MB of source, external domains: api.massu.ai, massu.ai, registry.massu.ai, unpkg.com

Source & flagged code

5 flagged

dist/hooks/post-tool-use.jsView file

Lines 1278-1318javascript

1278 for (let i = 0; i < 8; i++) {

1279 if (existsSync5(join3(dir, "package.json"))) {

1280 root = dir;

1281

Source & flagged code

5 flagged · loading source

dist/hooks/post-tool-use.jsView file

1298try { L1299: const req = createRequire(import.meta.url); L1300: const main2 = req.resolve(ORT_PKG);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hooks/post-tool-use.jsView on unpkg · L1298

4179severity: "high", L4180: description: "Use of eval() - code injection risk" L4181: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L4179

dist/hooks/security-gate.jsView file

49} from "fs"; L50: function credentialsDir(home = homedir()) { L51: return resolve(home, ".massu"); ... L59: if (!existsSync(p)) return void 0; L60: const parsed = JSON.parse(readFileSync(p, "utf-8")); L61: const key = typeof parsed?.apiKey === "string" ? parsed.apiKey.trim() : ""; ... L70: function resolveApiKey(opts = {}) { L71: const env = opts.env ?? process.env; L72: const home = opts.home ?? homedir(); ... L102: MASSU_ENV_CLOUD_ENDPOINT = "MASSU_CLOUD_ENDPOINT"; L103: DEFAULT_CLOUD_ENDPOINT = "https://api.massu.ai/v1"; L104: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/hooks/security-gate.jsView on unpkg · L49

dist/hooks/memory-recall.jsView file

850package = @massu/core; repositoryIdentity = massu; dependency = better-sqlite3 L850: // src/db-backup.ts L851: import Database from "better-sqlite3"; L852: import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync2 } from "fs";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hooks/memory-recall.jsView on unpkg · L850

patterns/testing-patterns.mdView file

532patternName = generic_password severity = medium line = 532 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in patterns/testing-patterns.md

patterns/testing-patterns.mdView on unpkg · L532

Findings

2 High5 Medium7 Low

HighObfuscated Payload Loaderdist/hooks/security-gate.js

HighCopied Package Dependency Bridgedist/hooks/memory-recall.js

MediumDynamic Requiredist/hooks/post-tool-use.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpatterns/testing-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/hooks/post-tool-use.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Lines 4159-4199javascript

4159 fileFilter: /\.(ts|tsx)$/

4160 },

4161 {

4162 regex: /(password|secret|token|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,

4163 severity: "critical",

4164 description: "Hardcoded credential or secret"

4165 },

4166 {

4167 regex: /\bdangerouslySetInnerHTML\b/,

4168 severity: "high",

4169 description: "XSS risk via dangerouslySetInnerHTML",

4170 fileFilter: /\.tsx$/

4171 },

4172 {

4173 regex: /\.raw\s*\(`/,

4174 severity: "high",

4175 description: "Raw SQL query with template literal (SQL injection risk)"

4176 },

4177 {

4178 regex: /eval\s*\(/,

4179 severity: "high",

4180 description: "Use of eval() - code injection risk"

4181 },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/hooks/post-tool-use.jsView on unpkg · L4179

4182 {

4183 regex: /process\.env\.\w+.*\bconsole\.(log|info|debug)/,

4184 severity: "medium",

4185 description: "Environment variable logged to console"

4186 },

4187 {

4188 regex: /catch\s*$[^)]*$\s*\{[^}]*res\.(json|send)\([^)]*err/,

4189 severity: "medium",

4190 description: "Error details exposed in response"

4191 },

4192 {

4193 regex: /Access-Control-Allow-Origin.*\*/,

4194 severity: "medium",

4195 description: "Overly permissive CORS (allows all origins)"

4196 },

4197 {

4198 regex: /new\s+URL\s*\(\s*(?:req|input|params|query)/,

4199 severity: "medium",

dist/hooks/security-gate.jsView file

Lines 29-69javascript

29// src/lib/memory-path.ts

30function encodeMemoryDirName(projectRoot) {

31 return projectRoot.replace(/\//g, "-");

32}

33var init_memory_path = __esm({

34 "src/lib/memory-path.ts"() {

35 "use strict";

36 }

37});

39// src/credentials.ts

40import { homedir } from "os";

41import { resolve } from "path";

42import {

43 existsSync,

44 readFileSync,

45 writeFileSync,

46 mkdirSync,

47 rmSync,

48 chmodSync

49} from "fs";

50function credentialsDir(home = homedir()) {

51 return resolve(home, ".massu");

52}

53function credentialsPath(home = homedir()) {

54 return resolve(credentialsDir(home), "credentials");

55}

56function readUserCredentials(home = homedir()) {

57 try {

58 const p = credentialsPath(home);

59 if (!existsSync(p)) return void 0;

60 const parsed = JSON.parse(readFileSync(p, "utf-8"));

61 const key = typeof parsed?.apiKey === "string" ? parsed.apiKey.trim() : "";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/hooks/security-gate.jsView on unpkg · L49

62 return key.length > 0 ? key : void 0;

63 } catch {

64 return void 0;

65 }

66}

67function isUnresolvedLiteral(v) {

68 return /^\$\{[^}]+\}$/.test(v);

69}

dist/hooks/memory-recall.jsView file

Lines 830-870javascript

830 if (a.length !== b.length || a.length === 0) return 0;

831 let dot = 0;

832 let na = 0;

833 let nb = 0;

834 for (let i = 0; i < a.length; i++) {

835 dot += a[i] * b[i];

836 na += a[i] * a[i];

837 nb += b[i] * b[i];

838 }

839 if (na === 0 || nb === 0) return 0;

840 const denom = Math.sqrt(na) * Math.sqrt(nb);

841 if (denom === 0 || !Number.isFinite(denom)) return 0;

842 return dot / denom;

843}

844var init_memory_vector = __esm({

845 "src/memory-vector.ts"() {

846 "use strict";

847 }

848});

849

850// src/db-backup.ts

851import Database from "better-sqlite3";

852import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync2 } from "fs";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hooks/memory-recall.jsView on unpkg · L850

853import { resolve as resolve3, join, basename, dirname as dirname2 } from "path";

854import { homedir as homedir3 } from "os";

855function dbBackupsRoot(home = homedir3()) {

856 return resolve3(home, ".massu", "db-backups");

857}

858function projectBackupDir(projectRoot, home = homedir3()) {

859 const slug = basename(projectRoot).replace(/[^A-Za-z0-9._-]/g, "_") || "project";

860 return join(dbBackupsRoot(home), slug);

861}

862function backupStamp(nowMs) {

863 return new Date(nowMs).toISOString().replace(/[:.]/g, "-");

864}

865function listDbBackups(projectRoot, home = homedir3()) {

866 const dir = projectBackupDir(projectRoot, home);

867 if (!existsSync3(dir)) return [];

868 const out = [];

869 for (const f of readdirSync(dir)) {

870 if (!f.endsWith(".db")) continue;

patterns/testing-patterns.mdView file

Lines 512-552markdown

512 expect.objectContaining({ method: 'POST' })

513 );

514});

515```

516

517### Testing React Components

518```typescript

519import { render, screen } from '@testing-library/react';

520import userEvent from '@testing-library/user-event';

521

522it('should submit form', async () => {

523 const handleSubmit = vi.fn();

524 render(<LoginForm onSubmit={handleSubmit} />);

525

526 await userEvent.type(screen.getByLabelText('Email'), 'test@example.com');

527 await userEvent.type(screen.getByLabelText('Password'), 'password123');

528 await userEvent.click(screen.getByRole('button', { name: /submit/i }));

529

530 expect(handleSubmit).toHaveBeenCalledWith({

531 email: 'test@example.com',

532 password: 'password123'

Medium

Secret Pattern

Hardcoded password in patterns/testing-patterns.md

patterns/testing-patterns.mdView on unpkg · L532

533 });

534});

535```

536

537---

538

539## 7. Troubleshooting

540

541| Issue | Solution |

542|-------|---------|

543| Tests timing out | Increase timeout: `{ timeout: 10000 }` or globally in `vitest.config.ts` |

544| Database tests failing | Clean database: `await prisma.$executeRaw\`TRUNCATE TABLE orders CASCADE\`` |

545| Flaky E2E tests | Use `toPass` with retry: `await expect(async () => { ... }).toPass({ timeout: 5000 })` |

546

547---

548

549## Quick Reference

550

551| Scenario | Test Type | Location |

552|----------|-----------|----------|