@ngocsangairvds/vsaf: Suspicious npm security report (Warn)

Loading npm security reports…

@ngocsangairvds/vsaf: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged

package.jsonView file

Lines 11-51json

11 },

12 "./core": {

13 "types": "./packages/core/dist/index.d.ts",

14 "default": "./packages/core/dist/index.js"

15 }

16 },

17 "bin": {

18 "vsaf": "packages/cli/dist/index.js"

19 },

20 "files": [

21 "packages/core/dist",

22 "packages/cli/dist",

23 "packages/web/dist",

24 "workflows",

25 "commands",

26 "skills",

27 "telemetry.defaults.json"

28 ],

29 "scripts": {

30 "build": "npm run build --workspaces",

31 "postinstall": "node -e \"const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd(),'packages','core','dist');try{fs.rmSync(t,{recursive:true,force:true})}catch{};const type=process.platform==='win32'?'junction':'dir';try{fs.symlinkSync(src,t,type)}catch(e){if(process.platform==='win32'){fs.symlinkSync(src,t,'junction')}else{throw e}}\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "cp package.json package.json.bak && node -e \"const f='package.json',j=JSON.parse(require('fs').readFileSync(f));delete j.workspaces;require('fs').writeFileSync(f,JSON.stringify(j,null,2)+'\\n')\"",

33 "postpack": "mv package.json.bak package.json",

34 "test": "vitest run",

35 "test:watch": "vitest",

36 "lint": "tsc --noEmit",

37 "prepublishOnly": "npm run build && npm test"

38 },

39 "publishConfig": {

40 "access": "public"

41 },

42 "engines": {

43 "node": ">=20.0.0"

44 },

45 "license": "MIT",

46 "dependencies": {

47 "@fastify/cors": "^11.2.0",

48 "@fastify/static": "^9.1.3",

49 "@modelcontextprotocol/sdk": "^1.29.0",

50 "chalk": "^5.3.0",

51 "commander": "^12.1.0",

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

Lines 174-214python

174- http://192.168.1.1/admin # IP address URL

175- https://suspicious-domain.org/malware

176

177## JavaScript Patterns

178```javascript

179<script>alert('XSS attempt')</script>

180eval('malicious code')

181Function('dangerous code')()

182```

183

184## System Commands

185- rm -rf /

packages/core/dist/isolation/workspace-manager.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.WorkspaceManager = void 0;

4const fs_1

packages/core/dist/types/index.jsView file

Lines 1-20javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

skills/sdlc/install-deps.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * SDLC Skill Pack — npm dependency installer

5 *

6 * Cross-platform (Windows, Linux, macOS).

7 * Installs project-local (devDependencies), not global.

8 *

9 * Usage:

10 * node install-deps.mjs [projectPath]

11 *

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = [redacted].js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

packages/cli/dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = packages/cli/dist/mcp/server.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = packages/cli/dist/server/static.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

Lines 1-27yaml

1# AlertManager configuration for VDS PDF Orchestrator

3global:

4 smtp_smarthost: 'localhost:587'

5 smtp_from: 'alerts@vds-pdf-orchestrator.com'

6 smtp_auth_username: 'alerts@vds-pdf-orchestrator.com'

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132 matchedText = test_sec...2"}'

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136 matchedText = test_sec...4"}'

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135 matchedText = test_sec...0"}'

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194 matchedText = - AKIA12... key

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

194patternName = aws_access_key severity = critical line = 194 matchedText = - AKIA12... key

Critical

Secret Pattern

AWS access key ID in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

195patternName = github_pat severity = critical line = 195 matchedText = - ghp_12...oken

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L195

packages/core/dist/isolation/workspace-manager.jsView file

7const crypto_1 = require("crypto"); L8: const child_process_1 = require("child_process"); L9: const util_1 = require("util");

High

Child Process

Package source references child process execution.

packages/core/dist/isolation/workspace-manager.jsView on unpkg · L7

packages/core/dist/types/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./workflow.js"), exports); L18: __exportStar(require("./dag.js"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/core/dist/types/index.jsView on unpkg · L16

skills/sdlc/install-deps.mjsView file

14* 2. Checks/installs npm package: gitnexus (includes MCP server built-in) L15: * 3. Provisions .mcp.json with GitNexus MCP server entry (npx gitnexus mcp) L16: */ ... L19: import { join } from 'path'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/sdlc/install-deps.mjsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = skills/sdlc/install-deps.mjs matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/sdlc/install-deps.mjsView on unpkg

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

packages/cli/dist/mcp/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

7patternName = generic_password severity = medium line = 7 matchedText = smtp_aut...ord'

Medium

Secret Pattern

Hardcoded password in skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView on unpkg · L7

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132 matchedText = test_sec...2"}'

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136 matchedText = test_sec...4"}'

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135 matchedText = test_sec...0"}'

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Source & flagged code

21 flagged

package.jsonView file

Lines 11-51json

11 },

12 "./core": {

13 "types": "./packages/core/dist/index.d.ts",

14 "default": "./packages/core/dist/index.js"

15 }

16 },

17 "bin": {

18 "vsaf": "packages/cli/dist/index.js"

19 },

20 "files": [

21 "packages/core/dist",

22 "packages/cli/dist",

23 "packages/web/dist",

24 "workflows",

25 "commands",

26 "skills",

27 "telemetry.defaults.json"

28 ],

29 "scripts": {

30 "build": "npm run build --workspaces",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

33 "postpack": "mv package.json.bak package.json",

34 "test": "vitest run",

35 "test:watch": "vitest",

36 "lint": "tsc --noEmit",

37 "prepublishOnly": "npm run build && npm test"

38 },

39 "publishConfig": {

40 "access": "public"

41 },

42 "engines": {

43 "node": ">=20.0.0"

44 },

45 "license": "MIT",

46 "dependencies": {

47 "@fastify/cors": "^11.2.0",

48 "@fastify/static": "^9.1.3",

49 "@modelcontextprotocol/sdk": "^1.29.0",

50 "chalk": "^5.3.0",

51 "commander": "^12.1.0",

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

Lines 174-214python

174- http://192.168.1.1/admin # IP address URL

175- https://suspicious-domain.org/malware

176

177## JavaScript Patterns

178```javascript

179<script>alert('XSS attempt')</script>

180eval('malicious code')

181Function('dangerous code')()

182```

183

184## System Commands

185- rm -rf /

packages/core/dist/isolation/workspace-manager.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.WorkspaceManager = void 0;

4const fs_1

packages/core/dist/types/index.jsView file

Lines 1-20javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

skills/sdlc/install-deps.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * SDLC Skill Pack — npm dependency installer

5 *

6 * Cross-platform (Windows, Linux, macOS).

7 * Installs project-local (devDependencies), not global.

8 *

9 * Usage:

10 * node install-deps.mjs [projectPath]

11 *

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

packages/cli/dist/mcp/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

Lines 1-27yaml

1# AlertManager configuration for VDS PDF Orchestrator

3global:

4 smtp_smarthost: 'localhost:587'

5 smtp_from: 'alerts@vds-pdf-orchestrator.com'

6 smtp_auth_username: 'alerts@vds-pdf-orchestrator.com'

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132 matchedText = test_sec...2"}'

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136 matchedText = test_sec...4"}'

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135 matchedText = test_sec...0"}'

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

@ngocsangairvds/vsaf@6.8.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code