registry / @ngocsangairvds/vsaf / 6.14.0

@ngocsangairvds/vsaf@6.14.0

⚠ Under review

is it ready to use ?

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 37 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 103 file(s), 928 KB of source, external domains: ai-gateway.viettel.digital, angular.dev, www.w3.org

Source & flagged code

29 flagged

package.jsonView file

Lines 11-51json

11 },

12 "./core": {

13 "types": "./packages/core/dist/index.d.ts",

14 "default": "./packages/core/dist/index.js"

15 }

16 },

17 "bin": {

18 "vsaf": "packages/cli/dist/index.js"

19 },

20 "files": [

21 "packages/core/dist",

22 "packages/cli/dist",

23 "packages/web/dist",

24 "workflows",

25 "commands",

26 "skills",

27 "telemetry.defaults.json"

28 ],

29 "scripts": {

30 "build": "npm run build --workspaces",

31 "postinstall": "node -e \"const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd(),'packages','core','dist');try{fs.rmSync(t,{recursive:true,force:true})}catch{};const type=process.platform==='win32'?'junction':'dir';try{fs.symlinkSync(src,t,type)}catch(e){if(process.platform==='win32'){fs.symlinkSync(src,t,'junction')}else{throw e}}\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "cp package.json package.json.bak && node -e \"const f='package.json',j=JSON.parse(require('fs').readFileSync(f));delete j.workspaces;require('fs').writeFileSync(f,JSON.stringify(j,null,2)+'\\n')\"",

33 "postpack": "mv package.json.bak package.json",

34 "test": "vitest run",

35 "test:watch": "vitest",

36 "lint": "tsc --noEmit",

37 "prepublishOnly": "npm run build && npm test"

38 },

39 "publishConfig": {

40 "access": "public"

41 },

42 "engines": {

43 "node": ">=20.0.0"

44 },

45 "license": "MIT",

46 "dependencies": {

47 "@fastify/cors": "^11.2.0",

48 "@fastify/static": "^9.1.3",

49 "@modelcontextprotocol/sdk": "^1.29.0",

50 "@opentelemetry/api": "^1.9.1",

51 "@opentelemetry/exporter-metrics-otlp-proto": "^0.220.0",

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

194patternName = aws_access_key severity = critical line = 194

Critical

Secret Pattern

AWS access key ID in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

195patternName = github_pat severity = critical line = 195

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L195

packages/core/dist/isolation/workspace-manager.jsView file

7const crypto_1 = require("crypto"); L8: const child_process_1 = require("child_process"); L9: const util_1 = require("util");

High

Child Process

Package source references child process execution.

packages/core/dist/isolation/workspace-manager.jsView on unpkg · L7

packages/cli/dist/commands/doctor.jsView file

88* `claude`, comes back ENOENT and `doctor` reports "not found" for something the user can L89: * run in the same shell. cmd.exe does read PATHEXT, so a second attempt through it finds L90: * what the first could not. Only on Windows, and only for names written here — the args

High

Shell

Package source references shell execution.

packages/cli/dist/commands/doctor.jsView on unpkg · L88

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/doctor.jsView on unpkg

packages/core/dist/types/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./workflow.js"), exports); L18: __exportStar(require("./dag.js"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/core/dist/types/index.jsView on unpkg · L16

skills/sdlc/install-deps.mjsView file

14* 2. Checks/installs npm package: gitnexus (includes MCP server built-in) L15: * 3. Provisions .mcp.json with GitNexus MCP server entry (npx gitnexus mcp) L16: */ ... L19: import { join } from 'path'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/sdlc/install-deps.mjsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = skills/sdlc/install-deps.mjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/sdlc/install-deps.mjsView on unpkg

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/cli/dist/commands/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/cli/dist/commands/init.js#virtual:normalized:round1View on unpkg

packages/core/dist/engine/node-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.15.0 matchedPath = packages/core/dist/engine/node-runner.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/core/dist/engine/node-runner.jsView on unpkg

packages/cli/dist/commands/skill.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/skill.jsView on unpkg

packages/cli/dist/commands/install/bootstrap-repo.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-repo.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/install/bootstrap-repo.jsView on unpkg

packages/cli/dist/commands/install/credentials.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/install/credentials.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-driver-hooks.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView on unpkg

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-agy-driver.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView on unpkg

packages/cli/dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.15.0 matchedPath = packages/cli/dist/mcp/server.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = packages/cli/dist/server/static.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

7patternName = generic_password severity = medium line = 7

Medium

Secret Pattern

Hardcoded password in skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView on unpkg · L7

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Source & flagged code

29 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194

Findings

5 Critical20 High7 Medium5 Low

CriticalCritical Secretskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/core/dist/isolation/workspace-manager.js

HighShellpackages/cli/dist/commands/doctor.js

HighRuntime Package Installskills/sdlc/install-deps.mjs

HighShips High Entropy Blobskills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf

Affected versions and remediation

This report applies to @ngocsangairvds/vsaf@6.14.0.

See all versions of @ngocsangairvds/vsaf for other recorded verdicts.

Review the evidence and your use of @ngocsangairvds/vsaf@6.14.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 17:25:14.981Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.