registry / @ngocsangairvds/vsaf / 6.16.0

@ngocsangairvds/vsaf@6.16.0

is it ready to use ?

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a Viettel VSAF workflow CLI. npm install only symlinks local core code; vsaf init and vsaf install write Claude/Cursor skills, hooks, and MCP config, including gitnexus. That is first-party agent-extension setup on an explicit user command, so warn rather than block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs vsaf init or vsaf install, not npm install.

Impact

Later Claude or Cursor sessions in that project load vsaf and gitnexus tools plus pack hooks.

Mechanism

User-command agent config and MCP registration

AI rationale

Evidence

packages/cli/dist/commands/init.jspackages/cli/dist/commands/install/session-hook.jspackages/cli/dist/commands/install/hooks.jspackages/cli/dist/commands/install.jsskills/sdlc/install-deps.mjspackages/cli/dist/commands/install/ide-mirror.js.mcp.json.claude/settings.json.claude/hooks.claude/skills.cursor/skills

Network endpoints2

ai-gateway.viettel.digitalgitnexus@latest

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User command vsaf init writes project .mcp.json with vsaf and gitnexus MCP servers.
vsaf init adds a Claude SessionStart hook into .claude/settings.json.
vsaf install copies pack hooks into .claude/hooks and merges them into .claude/settings.json.
vsaf install runs graphify install --platform claude, which deploys a skill under the user Claude skills directory.
The sdlc pack installer also writes a gitnexus MCP entry into .mcp.json.
Pack skill install mirrors files into .claude/skills and .cursor/skills.

Evidence against

npm postinstall only creates a local node_modules/@vsaf/core symlink to this package's core dist.
The library entry only re-exports engine APIs and does not mutate agent config on import.
Bitbucket tokens are used for git and API calls to the requested host, not an unrelated sink.
package.json has no runtime self-dependency on another vsaf release.
eval('malicious code') appears only in a PDF-orchestrator test fixture, not in install-time JavaScript.
Scanner similarity to a previously blocked vsaf tree matches this same workflow-engine layout, not a hidden dropper.

Source & flagged code

29 flagged

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

194patternName = aws_access_key severity = critical line = 194

Critical

Secret Pattern

AWS access key ID in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

195patternName = github_pat severity = critical line = 195

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L195

packages/core/dist/isolation/workspace-manager.jsView file

7const crypto_1 = require("crypto"); L8: const child_process_1 = require("child_process"); L9: const util_1 = require("util");

High

Child Process

Package source references child process execution.

packages/core/dist/isolation/workspace-manager.jsView on unpkg · L7

packages/cli/dist/commands/doctor.jsView file

88* `claude`, comes back ENOENT and `doctor` reports "not found" for something the user can L89: * run in the same shell. cmd.exe does read PATHEXT, so a second attempt through it finds L90: * what the first could not. Only on Windows, and only for names written here — the args

High

Shell

Package source references shell execution.

packages/cli/dist/commands/doctor.jsView on unpkg · L88

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/doctor.jsView on unpkg

packages/core/dist/types/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./workflow.js"), exports); L18: __exportStar(require("./dag.js"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/core/dist/types/index.jsView on unpkg · L16

skills/sdlc/install-deps.mjsView file

14* 2. Checks/installs npm package: gitnexus (includes MCP server built-in) L15: * 3. Provisions .mcp.json with GitNexus MCP server entry (npx gitnexus mcp) L16: */ ... L19: import { join } from 'path'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/sdlc/install-deps.mjsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = skills/sdlc/install-deps.mjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/sdlc/install-deps.mjsView on unpkg

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/cli/dist/commands/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/cli/dist/commands/init.js#virtual:normalized:round1View on unpkg

packages/core/dist/engine/node-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.15.0 matchedPath = packages/core/dist/engine/node-runner.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/core/dist/engine/node-runner.jsView on unpkg

packages/cli/dist/commands/skill.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.15.0 matchedPath = [redacted].js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/skill.jsView on unpkg

packages/cli/dist/commands/install/bootstrap-repo.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-repo.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/install/bootstrap-repo.jsView on unpkg

packages/cli/dist/commands/install/credentials.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/install/credentials.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-driver-hooks.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView on unpkg

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-agy-driver.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView on unpkg

packages/cli/dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.15.0 matchedPath = packages/cli/dist/mcp/server.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = packages/cli/dist/server/static.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

7patternName = generic_password severity = medium line = 7

Medium

Secret Pattern

Hardcoded password in skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView on unpkg · L7

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Source & flagged code

29 flagged · loading source

package.jsonView file

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194

Findings

5 Critical20 High7 Medium5 Low

CriticalCritical Secretskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/core/dist/isolation/workspace-manager.js

HighShellpackages/cli/dist/commands/doctor.js

HighRuntime Package Installskills/sdlc/install-deps.mjs

HighShips High Entropy Blobskills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf

Affected versions and remediation

This report applies to @ngocsangairvds/vsaf@6.16.0.

See all versions of @ngocsangairvds/vsaf for other recorded verdicts.

Review the evidence and your use of @ngocsangairvds/vsaf@6.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 03:37:32.620Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code