registry / @mmnto/totem / 1.98.0

@mmnto/totem@1.98.0

Core engine for Totem — a local-first, file-anchored substrate that makes AI-agent work queryable, enforceable, and derivable in your codebase

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 263 file(s), 3.01 MB of source, external domains: agents.md, claude.ai, example.com, github.com, img.shields.io, ollama.com, opensource.org, other.com, pkg.go.dev, raw.githubusercontent.com, www.gstatic.com

Source & flagged code

6 flagged

dist/sanitize.test.jsView file

Lines 161-211javascript

161 filePath: 'src/auth.ts',

162 onWarn,

163 });

164 expect(result).not.toContain('\u202E');

165 expect(result).not.toContain('\u2066');

Source & flagged code

6 flagged · loading source

dist/sanitize.test.jsView file

181patternName = aws_access_key severity = critical line = 181 matchedText = expect(m...]');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/sanitize.test.jsView on unpkg · L181

181patternName = aws_access_key severity = critical line = 181 matchedText = expect(m...]');

Critical

Secret Pattern

AWS access key ID in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L181

187patternName = google_api_key severity = high line = 187 matchedText = expect(m...]');

High

Secret Pattern

Google API key in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L187

191patternName = generic_password severity = medium line = 191 matchedText = expect(m...'");

Medium

Secret Pattern

Hardcoded password in dist/sanitize.test.js

dist/sanitize.test.jsView on unpkg · L191

dist/retired-lessons.test.jsView file

26const entries = [ L27: { heading: 'Avoid eval()', reason: 'Too broad', retiredAt: '2026-04-01T00:00:00.000Z' }, L28: {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/retired-lessons.test.jsView on unpkg · L26

dist/ast-grep-wasm-shim.test.jsView file

18try { L19: const mod = await import(shimPath); L20: Lang = mod.Lang;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ast-grep-wasm-shim.test.jsView on unpkg · L18

Findings

2 Critical1 High5 Medium6 Low

CriticalCritical Secretdist/sanitize.test.js

CriticalSecret Patterndist/sanitize.test.js

HighSecret Patterndist/sanitize.test.js

MediumDynamic Requiredist/ast-grep-wasm-shim.test.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/sanitize.test.js

LowScripts Present

LowEvaldist/retired-lessons.test.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/retired-lessons.test.jsView file

Lines 6-46javascript

6import { isRetiredHeading, readRetiredLessons, retireLesson, writeRetiredLessons, } from './retired-lessons.js';

7// ─── Helpers ────────────────────────────────────────────

8let tmpDir;

9beforeEach(() => {

10 tmpDir = path.join(os.tmpdir(), `totem-retired-${crypto.randomUUID()}`);

11 fs.mkdirSync(tmpDir, { recursive: true });

12});

13afterEach(() => {

14 fs.rmSync(tmpDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });

15});

16function makeLedgerFile(entries) {

17 fs.writeFileSync(path.join(tmpDir, 'retired-lessons.json'), JSON.stringify(entries, null, 2), 'utf-8');

18}

19// ─── readRetiredLessons ─────────────────────────────────

20describe('readRetiredLessons', () => {

21 it('returns empty array when file does not exist', () => {

22 const result = readRetiredLessons(tmpDir);

23 expect(result).toEqual([]);

24 });

25 it('parses valid JSON correctly', () => {

26 const entries = [

27 { heading: 'Avoid eval()', reason: 'Too broad', retiredAt: '2026-04-01T00:00:00.000Z' },

28 {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/retired-lessons.test.jsView on unpkg · L26

29 heading: 'Use strict mode',

30 reason: 'Duplicates compiler flag',

31 retiredAt: '2026-04-02T00:00:00.000Z',

32 },

33 ];

34 makeLedgerFile(entries);

35 const result = readRetiredLessons(tmpDir);

36 expect(result).toHaveLength(2);

37 expect(result[0].heading).toBe('Avoid eval()');

38 expect(result[1].reason).toBe('Duplicates compiler flag');

39 });

40 it('returns empty array on malformed JSON', () => {

41 fs.writeFileSync(path.join(tmpDir, 'retired-lessons.json'), '{{{not json', 'utf-8');

42 const result = readRetiredLessons(tmpDir);

43 expect(result).toEqual([]);

44 });

45});

46// ─── retireLesson ───────────────────────────────────────

dist/ast-grep-wasm-shim.test.jsView file

Lines 1-38javascript

1/**

2 * Unit tests for the ast-grep WASM shim.

3 *

4 * The WASM runtime itself cannot be tested in Vitest because Node's ESM

5 * loader doesn't support `.wasm` imports. Full end-to-end verification

6 * is done via the esbuild bundle: `node dist/lite/totem-lite.mjs lint`

7 * exercises ensureInit → parse → findAll through the real WASM engine.

8 *

9 * These tests cover the synchronous, non-WASM parts of the shim.

10 */

11import { describe, expect, it } from 'vitest';

12// Import only the synchronous exports — avoid triggering WASM import

13const shimPath = './ast-grep-wasm-shim.js';

14describe('ast-grep-wasm-shim (non-WASM parts)', () => {

15 it('exports a Lang object with the expected language keys', async () => {

16 // Dynamic import to isolate from WASM loading issues

17 let Lang;

18 try {

19 const mod = await import(shimPath);

20 Lang = mod.Lang;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ast-grep-wasm-shim.test.jsView on unpkg · L18

21 }

22 catch (err) {

23 // Only swallow the known WASM loader limitation — re-throw real errors

24 const msg = err instanceof Error ? err.message : String(err);

25 if (!/\.wasm|ERR_UNKNOWN_FILE_EXTENSION|Unknown file extension/i.test(msg)) {

26 throw err;

27 }

28 // WASM import fails in Node — that's expected

29 // Verify the source directly instead

30 const { readFileSync } = await import('node:fs');

31 const { resolve } = await import('node:path');

32 const src = readFileSync(resolve(import.meta.dirname, 'ast-grep-wasm-shim.ts'), 'utf-8');

33 expect(src).toContain("TypeScript: 'typescript'");

34 expect(src).toContain("Tsx: 'tsx'");

35 expect(src).toContain("JavaScript: 'javascript'");

36 return;

37 }

38 expect(Lang.TypeScript).toBe('typescript');