registry / @mmnto/totem / 1.101.0

@mmnto/totem@1.101.0

Core engine for Totem, the local-first toolkit that keeps AI-agent work queryable, enforceable, and derivable as plain files in your codebase

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 263 file(s), 3.03 MB of source, external domains: agents.md, claude.ai, example.com, github.com, img.shields.io, ollama.com, opensource.org, other.com, pkg.go.dev, raw.githubusercontent.com, www.gstatic.com

Source & flagged code

6 flagged

dist/sanitize.test.jsView file

Lines 161-211javascript

161 filePath: 'src/auth.ts',

162 onWarn,

163 });

164 expect(result).not.toContain('\u202E');

165 expect(result).not.toContain('\u2066');

166 expect(result).not.toContain('\u2069');

167 expect(onWarn).toHaveBeenCalled();

168 });

169});

170// ---------------------------------------------------------------------------

171// DLP Secret Masking

172// ---------------------------------------------------------------------------

173describe('maskSecrets', () => {

174 it('masks OpenAI API keys', () => {

175 expect(maskSecrets('key is sk-abc123def456ghi789jkl012mno')).toContain('[REDACTED]');

176 });

177 it('masks GitHub tokens', () => {

178 expect(maskSecrets('token ghp_abc123def456ghi789jkl012mno345')).toContain('[REDACTED]');

179 });

180 it('masks AWS access keys', () => {

181 expect(maskSecrets('AKIAIOSFODNN7EXAMPLE')).toContain('[REDACTED]');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/sanitize.test.jsView on unpkg · L181

Critical

Secret Pattern

AWS access key ID in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L181

182 });

183 it('masks npm tokens', () => {

184 expect(maskSecrets('npm_abcdefghijklmnopqrstu')).toContain('[REDACTED]');

185 });

186 it('masks Google API keys', () => {

187 expect(maskSecrets('AIzaSyD1234567890abcdefghijklmnopqrstuv')).toContain('[REDACTED]');

High

Secret Pattern

Google API key in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L187

188 });

189 it('masks quoted secret assignments preserving key name', () => {

190 expect(maskSecrets('api_key = "sk_live_abc123def456ghi789"')).toBe('api_key = "[REDACTED]"');

191 expect(maskSecrets("password: 'supersecrettoken12345678'")).toBe("password: '[REDACTED]'");

Medium

Secret Pattern

Hardcoded password in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L191

192 });

193 it('masks unquoted secret assignments', () => {

194 expect(maskSecrets('api_key=sk_live_abc123def456ghi789')).toContain('[REDACTED]');

195 expect(maskSecrets('SECRET=myverylongsecrettokenvalue1234')).toContain('[REDACTED]');

196 });

197 it('preserves normal text', () => {

198 const text = 'This is a normal code comment about authentication.';

199 expect(maskSecrets(text)).toBe(text);

200 });

201 it('preserves short strings that look like keys', () => {

202 // Too short to be a real key

203 expect(maskSecrets('sk-short')).toBe('sk-short');

204 });

205 it('fully redacts sk-proj- tokens without partial leakage', () => {

206 const token = 'sk-proj-abcdef1234567890abcdef1234567890';

207 const result = maskSecrets(`key is ${token}`);

208 expect(result).toBe('key is [REDACTED]');

209 expect(result).not.toContain('sk-proj-');

210 });

211 it('still redacts plain sk- tokens', () => {

dist/retired-lessons.test.jsView file

Lines 6-46javascript

6import { isRetiredHeading, readRetiredLessons, retireLesson, writeRetiredLessons, } from './retired-lessons.js';

7// ─── Helpers ────────────────────────────────────────────

8let tmpDir;

9beforeEach(() => {

10 tmpDir = path.join(os.tmpdir(), `totem-retired-${

dist/ast-grep-wasm-shim.test.jsView file

Lines 1-38javascript

1/**

2 * Unit tests for the ast-grep WASM shim.

3 *

4 * The WASM runtime itself cannot be tested in Vitest because Node's ESM

5 * loader doesn't support `.wasm` imports. Full end-to-end verification

6 * is done via the esbuild bundle: `node dist/lite/totem-lite.mjs lint`

7 * exercises ensureInit → parse → findAll through the real WASM engine.

8 *

9 * These tests cover the synchronous, non-WASM parts of the shim.

10 */

Source & flagged code

6 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code