registry / @mmnto/totem / 1.98.0

@mmnto/totem@1.98.0

Core engine for Totem — a local-first, file-anchored substrate that makes AI-agent work queryable, enforceable, and derivable in your codebase

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 263 file(s), 3.01 MB of source, external domains: agents.md, claude.ai, example.com, github.com, img.shields.io, ollama.com, opensource.org, other.com, pkg.go.dev, raw.githubusercontent.com, www.gstatic.com

Source & flagged code

6 flagged

dist/sanitize.test.jsView file

Lines 161-211javascript

161 filePath: 'src/auth.ts',

162 onWarn,

163 });

164 expect(result).not.toContain('\u202E');

165 expect(result).not.toContain('\u2066');

166 expect(result).not.toContain('\u2069');

167 expect(onWarn).toHaveBeenCalled();

168 });

169});

170// ---------------------------------------------------------------------------

171// DLP Secret Masking

172// ---------------------------------------------------------------------------

173describe('maskSecrets', () => {

174 it('masks OpenAI API keys', () => {

175 expect(maskSecrets('key is sk-abc123def456ghi789jkl012mno')).toContain('[REDACTED]');

176 });

177 it('masks GitHub tokens', () => {

178 expect(maskSecrets('token ghp_abc123def456ghi789jkl012mno345')).toContain('[REDACTED]');

179 });

180 it('masks AWS access keys', () => {

181 expect(maskSecrets('AKIAIOSFODNN7EXAMPLE')).toContain('[REDACTED]');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/sanitize.test.jsView on unpkg · L181

Critical

Secret Pattern

AWS access key ID in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L181

182 });

183 it('masks npm tokens', () => {

184 expect(maskSecrets('npm_abcdefghijklmnopqrstu')).toContain('[REDACTED]');

185 });

186 it('masks Google API keys', () => {

187 expect(maskSecrets('AIzaSyD1234567890abcdefghijklmnopqrstuv')).toContain('[REDACTED]');

High

Secret Pattern

Google API key in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L187

188 });

189 it('masks quoted secret assignments preserving key name', () => {

190 expect(maskSecrets('api_key = "sk_live_abc123def456ghi789"')).toBe('api_key = "[REDACTED]"');

191 expect(maskSecrets("password: 'supersecrettoken12345678'")).toBe("password: '[REDACTED]'");

Medium

Secret Pattern

Hardcoded password in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L191

192 });

193 it('masks unquoted secret assignments', () => {

194 expect(maskSecrets('api_key=sk_live_abc123def456ghi789')).toContain('[REDACTED]');

195 expect(maskSecrets('SECRET=myverylongsecrettokenvalue1234')).toContain('[REDACTED]');

196 });

197 it('preserves normal text', () => {

198 const text = 'This is a normal code comment about authentication.';

199 expect(maskSecrets(text)).toBe(text);

200 });

201 it('preserves short strings that look like keys', () => {

202 // Too short to be a real key

203 expect(maskSecrets('sk-short')).toBe('sk-short');

204 });

205 it('fully redacts sk-proj- tokens without partial leakage', () => {

206 const token = 'sk-proj-abcdef1234567890abcdef1234567890';

207 const result = maskSecrets(`key is ${token}`);

208 expect(result).toBe('key is [REDACTED]');

209 expect(result).not.toContain('sk-proj-');

210 });

211 it('still redacts plain sk- tokens', () => {

dist/retired-lessons.test.jsView file

Lines 6-46javascript

6import { isRetiredHeading, readRetiredLessons, retireLesson, writeRetiredLessons, } from './retired-lessons.js';

7// ─── Helpers ────────────────────────────────────────────

8let tmpDir;

9beforeEach(() => {

10 tmpDir = path.join(os.tmpdir(), `totem-retired-${crypto.randomUUID()}`);

11 fs.

dist/ast-grep-wasm-shim.test.jsView file

Lines 1-38javascript

1/**

2 * Unit tests for the ast-grep WASM shim.

3 *

4 * The WASM runtime itself cannot be tested in Vitest because Node's ESM

5 * loader doesn't support `.wasm` imports. Full end-to-end verification

6 * is done via the esbuild bundle: `node dist/lite/totem-lite.mjs lint`

7 * exercises ensureInit → parse → findAll through the real WASM engine.

8 *

9 * These tests cover the synchronous, non-WASM parts of the shim.

10 */

11import { describe, expect, it } from

Source & flagged code

6 flagged · loading source

dist/sanitize.test.jsView file

181patternName = aws_access_key severity = critical line = 181 matchedText = expect(m...]');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/sanitize.test.jsView on unpkg · L181

181patternName = aws_access_key severity = critical line = 181 matchedText = expect(m...]');

Critical

Secret Pattern

AWS access key ID in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L181

187patternName = google_api_key severity = high line = 187 matchedText = expect(m...]');

High

Secret Pattern

Google API key in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L187

191patternName = generic_password severity = medium line = 191 matchedText = expect(m...'");

Medium

Secret Pattern

Hardcoded password in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L191

dist/retired-lessons.test.jsView file

26const entries = [ L27: { heading: 'Avoid eval()', reason: 'Too broad', retiredAt: '2026-04-01T00:00:00.000Z' }, L28: {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/retired-lessons.test.jsView on unpkg · L26

dist/ast-grep-wasm-shim.test.jsView file

18try { L19: const mod = await import(shimPath); L20: Lang = mod.Lang;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ast-grep-wasm-shim.test.jsView on unpkg · L18

Findings

2 Critical1 High5 Medium6 Low

CriticalCritical Secretdist/sanitize.test.js

CriticalSecret Patterndist/sanitize.test.js

HighSecret Patterndist/sanitize.test.js

MediumDynamic Requiredist/ast-grep-wasm-shim.test.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/sanitize.test.js

LowScripts Present

LowEvaldist/retired-lessons.test.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/sanitize.test.jsView file

Lines 161-211javascript

161 filePath: 'src/auth.ts',

162 onWarn,

163 });

164 expect(result).not.toContain('\u202E');

165 expect(result).not.toContain('\u2066');

166 expect(result).not.toContain('\u2069');

167 expect(onWarn).toHaveBeenCalled();

168 });

169});

170// ---------------------------------------------------------------------------

171// DLP Secret Masking

172// ---------------------------------------------------------------------------

173describe('maskSecrets', () => {

174 it('masks OpenAI API keys', () => {

175 expect(maskSecrets('key is sk-abc123def456ghi789jkl012mno')).toContain('[REDACTED]');

176 });

177 it('masks GitHub tokens', () => {

178 expect(maskSecrets('token ghp_abc123def456ghi789jkl012mno345')).toContain('[REDACTED]');

179 });

180 it('masks AWS access keys', () => {

181 expect(maskSecrets('AKIAIOSFODNN7EXAMPLE')).toContain('[REDACTED]');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/sanitize.test.jsView on unpkg · L181

Critical

Secret Pattern

AWS access key ID in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L181

182 });

183 it('masks npm tokens', () => {

184 expect(maskSecrets('npm_abcdefghijklmnopqrstu')).toContain('[REDACTED]');

185 });

186 it('masks Google API keys', () => {

187 expect(maskSecrets('AIzaSyD1234567890abcdefghijklmnopqrstuv')).toContain('[REDACTED]');

High

Secret Pattern

Google API key in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L187

188 });

189 it('masks quoted secret assignments preserving key name', () => {

190 expect(maskSecrets('api_key = "sk_live_abc123def456ghi789"')).toBe('api_key = "[REDACTED]"');

191 expect(maskSecrets("password: 'supersecrettoken12345678'")).toBe("password: '[REDACTED]'");

Medium

Secret Pattern

Hardcoded password in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L191

192 });

193 it('masks unquoted secret assignments', () => {

194 expect(maskSecrets('api_key=sk_live_abc123def456ghi789')).toContain('[REDACTED]');

195 expect(maskSecrets('SECRET=myverylongsecrettokenvalue1234')).toContain('[REDACTED]');

196 });

197 it('preserves normal text', () => {

198 const text = 'This is a normal code comment about authentication.';

199 expect(maskSecrets(text)).toBe(text);

200 });

201 it('preserves short strings that look like keys', () => {

202 // Too short to be a real key

203 expect(maskSecrets('sk-short')).toBe('sk-short');

204 });

205 it('fully redacts sk-proj- tokens without partial leakage', () => {

206 const token = 'sk-proj-abcdef1234567890abcdef1234567890';

207 const result = maskSecrets(`key is ${token}`);

208 expect(result).toBe('key is [REDACTED]');

209 expect(result).not.toContain('sk-proj-');

210 });

211 it('still redacts plain sk- tokens', () => {

dist/retired-lessons.test.jsView file

Lines 6-46javascript

6import { isRetiredHeading, readRetiredLessons, retireLesson, writeRetiredLessons, } from './retired-lessons.js';

7// ─── Helpers ────────────────────────────────────────────

8let tmpDir;

9beforeEach(() => {

10 tmpDir = path.join(os.tmpdir(), `totem-retired-${crypto.randomUUID()}`);

11 fs.

dist/ast-grep-wasm-shim.test.jsView file

Lines 1-38javascript

1/**

2 * Unit tests for the ast-grep WASM shim.

3 *

4 * The WASM runtime itself cannot be tested in Vitest because Node's ESM

5 * loader doesn't support `.wasm` imports. Full end-to-end verification

6 * is done via the esbuild bundle: `node dist/lite/totem-lite.mjs lint`

7 * exercises ensureInit → parse → findAll through the real WASM engine.

8 *

9 * These tests cover the synchronous, non-WASM parts of the shim.

10 */

11import { describe, expect, it } from