registry / Data exfiltration / @ngocsangairvds/vsaf / 6.9.0

@ngocsangairvds/vsaf@6.9.0

is it ready to use ?

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package establishes a concrete outbound telemetry path with preset vendor credentials and captures workflow arguments plus identifying metadata by default. This exceeds ordinary local workflow setup and creates an unconsented data-exfiltration channel. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs `vsaf init`, then executes a workflow or starts the configured MCP server.

Impact

Workflow arguments and identifying metadata are sent off-project; later MCP startup can fetch and execute an unpinned package.

Mechanism

default credentialed telemetry and remote MCP registration

AI rationale

Evidence

packages/cli/dist/commands/init.jstelemetry.defaults.jsonpackages/cli/dist/telemetry/config.jspackages/cli/dist/telemetry/otel-tracer.js.vsaf/config.yaml.claude/settings.json.mcp.json.vsaf/.claude-session

Network endpoints2

langfuse.viettel.digitallangfuse.viettel.digital/api/public/otel/v1/traces

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Malware with medium false-positive risk.

Evidence for warning

`vsaf init` writes telemetry configuration by default.
Packaged defaults target Langfuse with embedded credentials.
Telemetry exports workflow arguments, session ID, and user identity.
`init` registers `npx -y gitnexus@latest mcp` in project MCP config.

Evidence against

The npm postinstall hook only creates a local `@vsaf/core` symlink.
Network activity is triggered by explicit initialization and workflow execution, not package import/install.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 847 KB of source, external domains: ai-gateway.viettel.digital, angular.dev, www.w3.org

Source & flagged code

21 flagged

package.jsonView file

Lines 11-51json

11 },

12 "./core": {

13 "types": "./packages/core/dist/index.d.ts",

14 "default": "./packages/core/dist/index.js"

15 }

16 },

17 "bin": {

18 "vsaf": "packages/cli/dist/index.js"

19 },

20 "files": [

21 "packages/core/dist",

22 "packages/cli/dist",

23 "packages/web/dist",

24 "workflows",

25 "commands",

26 "skills",

27 "telemetry.defaults.json"

28 ],

29 "scripts": {

30 "build": "npm run build --workspaces",

31 "postinstall": "node -e \"const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd(),'packages','core','dist');try{fs.rmSync(t,{recursive:true,force:true})}catch{};const type=process.platform==='win32'?'junction':'dir';try{fs.symlinkSync(src,t,type)}catch(e){if(process.platform==='win32'){fs.symlinkSync(src,t,'junction')}else{throw e}}\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepack": "cp package.json package.json.bak && node -e \"const f='package.json',j=JSON.parse(require('fs').readFileSync(f));delete j.workspaces;require('fs').writeFileSync(f,JSON.stringify(j,null,2)+'\\n')\"",

33 "postpack": "mv package.json.bak package.json",

34 "test": "vitest run",

35 "test:watch": "vitest",

36 "lint": "tsc --noEmit",

37 "prepublishOnly": "npm run build && npm test"

38 },

39 "publishConfig": {

40 "access": "public"

41 },

42 "engines": {

43 "node": ">=20.0.0"

44 },

45 "license": "MIT",

46 "dependencies": {

47 "@fastify/cors": "^11.2.0",

48 "@fastify/static": "^9.1.3",

49 "@modelcontextprotocol/sdk": "^1.29.0",

50 "@opentelemetry/api": "^1.9.1",

51 "@opentelemetry/exporter-metrics-otlp-proto": "^0.220.0",

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

Lines 174-214python

174- http://192.168.1.1/admin # IP address URL

175- https://suspicious-domain.org/malware

176

177## JavaScript Patterns

178```javascript

179<script>alert('XSS attempt')</script>

180eval('malicious code')

181Function('dangerous code')()

182```

183

184## System Commands

185- rm -rf /

packages/core/dist/isolation/workspace-manager.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.WorkspaceManager = void 0;

4const fs_1

packages/core/dist/types/index.jsView file

Lines 1-20javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

skills/sdlc/install-deps.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * SDLC Skill Pack — npm dependency installer

5 *

6 * Cross-platform (Windows, Linux, macOS).

7 * Installs project-local (devDependencies), not global.

8 *

9 * Usage:

10 * node install-deps.mjs [projectPath]

11 *

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = [redacted].js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = packages/cli/dist/server/static.js matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

skills/vds-skill/vds-scripts/scripts/backup.shView file

•matchType = normalized_sha256 matchedPackage = @ngocsangairvds/vsaf@6.7.0 matchedPath = skills/vds-skill/vds-scripts/scripts/backup.sh matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/vds-skill/vds-scripts/scripts/backup.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

Lines 1-27yaml

1# AlertManager configuration for VDS PDF Orchestrator

3global:

4 smtp_smarthost: 'localhost:587'

5 smtp_from: 'alerts@vds-pdf-orchestrator.com'

6 smtp_auth_username: 'alerts@vds-pdf-orchestrator.com'

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132 matchedText = test_sec...2"}'

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136 matchedText = test_sec...4"}'

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135 matchedText = test_sec...0"}'

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194 matchedText = - AKIA12... key

Findings

5 Critical13 High8 Medium5 Low

CriticalCritical Secretskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/core/dist/isolation/workspace-manager.js

HighShell

HighRuntime Package Installskills/sdlc/install-deps.mjs

HighShips High Entropy Blobskills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf

Affected versions and remediation

This report applies to @ngocsangairvds/vsaf@6.9.0.

See all versions of @ngocsangairvds/vsaf for other recorded verdicts.

Review the evidence and your use of @ngocsangairvds/vsaf@6.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 04:41:28.772Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.