registry / @planu/cli / 4.11.0

@planu/cli@4.11.0

Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 2,743 file(s), 10.1 MB of source, external domains: agentskill.sh, api.anthropic.com, api.cloudflare.com, api.example.com, api.figma.com, api.github.com, api.linear.app, api.machines.dev, api.mistral.ai, api.netlify.com, api.notion.com, api.npmjs.org, api.nuget.org, api.openai.com, api.osv.dev, api.supabase.com, api.trello.com, api.vercel.com, app.mem0.ai, argocd-applicationset.readthedocs.io, azure.microsoft.com, backboard.railway.app, backstage.io, bentoml.com, bit.dev, canusqigtzldstnjddio.supabase.co, cdn.jsdelivr.net, chaos.cncf.io, checkstyle.sourceforge.io, clang.llvm.org, claude.ai, cloud.google.com, code.claude.com, commitlint.js.org, conftest.dev, containers.dev, cortex.io, cppcheck.sourceforge.io, crates.io, crossplane.io, cs.symfony.com, cursor.com, cyclonedx.org, daggerverse.dev, dart.dev, detekt.dev, developer.android.com, dl.dagger.io, doc.rust-lang.org, doc.traefik.io

Source & flagged code

14 flagged

dist/engine/product-intelligence/index.jsView file

Lines 1-27javascript

1// engine/product-intelligence/index.ts — SPEC-328: Product Intelligence Layer engine.

2// Queries Supabase telemetry_events to generate product insights reports.

3// Uses the same auth pattern as telemetry-client.ts (fire-and-forget-friendly).

4import { PLANU_VERSION } from '../../config/version.js';

5const SUPABASE_URL = process.env.PLANU_SUPABASE_URL ?? 'https://canusqigtzldstnjddio.supabase.co';

6const SUPABASE_KEY = process.env.PLANU_SUPABASE_KEY ??

7 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNhbnVzcWlndHpsZHN0bmpkZGlvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI3NTk2MjgsImV4cCI6MjA4ODMzNTYyOH0.Thw1Xgf9_iabOD75J00u35d2k5NsIpUBU9PrqOShxMU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

8const TELEMETRY_TABLE = `${SUPABASE_URL}/rest/v1/telemetry_events`;

9/** Core tools expected to be active — used for dead-tool detection. */

10const KNOWN_CORE_TOOLS = [

11 'create_spec',

12 'list_specs',

13 'update_status',

14 'validate',

15 'estimate',

16 'init_project',

17 'suggest_stack',

18 'generate_tests',

19 'generate_docs',

20 'challenge_spec',

21 'check_readiness',

22 'decompose_spec',

23 'scan_project',

24 'manage_git',

25 'product_insights',

26];

27function strProp(props, key) {

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

Lines 1-21javascript

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170)

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

4import { specStore } from '../storage/index.js';

5import { autoUpdateSpecFromCode } from

dist/engine/verifier/code-scanner.jsView file

Lines 1-25javascript

1// engine/verifier/code-scanner.ts — Spec evidence scanner (SPEC-406)

2import { readFile } from 'node:fs/promises';

3import { exec } from 'node:child_process';

4import { promisify } from 'node:util';

5import { glob } from 'glob';

6const execAsync

dist/engine/auditor-security/electron-checks.jsView file

Lines 54-83javascript

54 category: 'security',

55 severity: 'error',

56 rule: 'electron-sandbox-disabled',

57 message: 'sandbox: false removes the Chromium sandbox from the renderer process.',

58 suggestion: 'Keep sandbox: true (default). Combine with contextBridge for safe IPC.',

dist/tools/import-spec-handler.jsView file

Lines 128-168javascript

128 return compactError('❌ CSV row is empty');

129 }

130 imported = first;

131 break;

132 }

133 default:

134 return compactError(`❌ Unknown source: ${String

dist/engine/delete-first/duplication-finder.jsView file

Lines 1-21javascript

1// Planu — Duplication finder (SPEC-482)

2// Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

3import { readFileSync } from 'node:fs';

4import { createHash } from 'node:crypto';

5/** Minimum number of lines for a block to be considered a duplication candidate. */

6const

dist/tools/rollback-release.jsView file

Lines 29-69javascript

29 if (dateStr) {

30 resolve(new Date(dateStr));

31 return;

32 }

33 }

34 catch {

35 // ignore

36 }

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

Lines 68-108yaml

68 uses: actions/cache@v4

69 with:

70 path: |

71 ~/.gradle/caches

72 ~/.gradle/wrapper

73 key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

74 restore-keys: ${{ runner.os }}-gradle-

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5

Source & flagged code

14 flagged · loading source

dist/engine/product-intelligence/index.jsView file

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170) L2: import { execFile } from 'node:child_process'; L3: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

dist/engine/verifier/code-scanner.jsView file

5import { glob } from 'glob'; L6: const execAsync = promisify(exec); L7: const SOURCE_GLOBS = ['**/*.ts', '**/*.js', '**/*.py', '**/*.go', '**/*.java', '**/*.rs'];

High

Shell

Package source references shell execution.

dist/engine/verifier/code-scanner.jsView on unpkg · L5

dist/engine/auditor-security/electron-checks.jsView file

74rule: 'electron-eval-in-renderer', L75: message: 'eval() in Electron renderer enables remote code execution if XSS is present.', L76: suggestion: 'Remove all eval() calls. Use JSON.parse() or safer alternatives.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/engine/auditor-security/electron-checks.jsView on unpkg · L74

dist/tools/import-spec-handler.jsView file

148*/ L149: export async function handleBulkImport(params) { L150: const { source, filePath, content, projectPath, overwrite = false } = params;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/import-spec-handler.jsView on unpkg · L148

dist/engine/delete-first/duplication-finder.jsView file

1// Planu — Duplication finder (SPEC-482) L2: // Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

dist/tools/rollback-release.jsView file

49return new Promise((resolve) => { L50: const child = spawn('npx', ['--yes', '@planu/cli@latest', '--version'], { L51: stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tools/rollback-release.jsView on unpkg · L49

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

88patternName = generic_password severity = medium line = 88 matchedText = -Pandroi...D" \

Medium

Secret Pattern

Hardcoded password in dist/config/mobile-ci-templates/android-github-actions.yml

dist/config/mobile-ci-templates/android-github-actions.ymlView on unpkg · L88

90patternName = generic_password severity = medium line = 90 matchedText = -Pandroi...ORD"

Medium

Secret Pattern

Hardcoded password in dist/config/mobile-ci-templates/android-github-actions.yml

dist/config/mobile-ci-templates/android-github-actions.ymlView on unpkg · L90

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5

Findings

3 Critical3 High9 Medium9 Low

CriticalCritical Secretdist/engine/product-intelligence/index.js

CriticalSecret Patterndist/engine/product-intelligence/index.js

CriticalSecret Patterndist/engine/telemetry/telemetry-client.js

HighChild Processdist/tools/auto-update-spec.js

HighShelldist/engine/verifier/code-scanner.js

HighRuntime Package Installdist/tools/rollback-release.js

MediumDynamic Requiredist/tools/import-spec-handler.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/config/hook-templates/planu-session-safeguard.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/config/mobile-ci-templates/android-github-actions.yml

MediumSecret Patterndist/engine/ci-generator/android-jobs.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/engine/auditor-security/electron-checks.js

LowWeak Cryptodist/engine/delete-first/duplication-finder.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

14 flagged

dist/engine/product-intelligence/index.jsView file

Lines 1-27javascript

1// engine/product-intelligence/index.ts — SPEC-328: Product Intelligence Layer engine.

2// Queries Supabase telemetry_events to generate product insights reports.

3// Uses the same auth pattern as telemetry-client.ts (fire-and-forget-friendly).

4import { PLANU_VERSION } from '../../config/version.js';

5const SUPABASE_URL = process.env.PLANU_SUPABASE_URL ?? 'https://canusqigtzldstnjddio.supabase.co';

6const SUPABASE_KEY = process.env.PLANU_SUPABASE_KEY ??

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/engine/product-intelligence/index.jsView on unpkg · L7

8const TELEMETRY_TABLE = `${SUPABASE_URL}/rest/v1/telemetry_events`;

9/** Core tools expected to be active — used for dead-tool detection. */

10const KNOWN_CORE_TOOLS = [

11 'create_spec',

12 'list_specs',

13 'update_status',

14 'validate',

15 'estimate',

16 'init_project',

17 'suggest_stack',

18 'generate_tests',

19 'generate_docs',

20 'challenge_spec',

21 'check_readiness',

22 'decompose_spec',

23 'scan_project',

24 'manage_git',

25 'product_insights',

26];

27function strProp(props, key) {

7patternName = supabase_service_key severity = critical line = 7 matchedText = 'eyJhbGc...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/product-intelligence/index.js

dist/engine/product-intelligence/index.jsView on unpkg · L7

dist/tools/auto-update-spec.jsView file

Lines 1-21javascript

1// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170)

2import { execFile } from 'node:child_process';

3import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tools/auto-update-spec.jsView on unpkg · L1

4import { specStore } from '../storage/index.js';

5import { autoUpdateSpecFromCode } from

dist/engine/verifier/code-scanner.jsView file

Lines 1-25javascript

1// engine/verifier/code-scanner.ts — Spec evidence scanner (SPEC-406)

2import { readFile } from 'node:fs/promises';

3import { exec } from 'node:child_process';

4import { promisify } from 'node:util';

5import { glob } from 'glob';

6const execAsync

dist/engine/auditor-security/electron-checks.jsView file

Lines 54-83javascript

54 category: 'security',

55 severity: 'error',

56 rule: 'electron-sandbox-disabled',

57 message: 'sandbox: false removes the Chromium sandbox from the renderer process.',

58 suggestion: 'Keep sandbox: true (default). Combine with contextBridge for safe IPC.',

dist/tools/import-spec-handler.jsView file

Lines 128-168javascript

128 return compactError('❌ CSV row is empty');

129 }

130 imported = first;

131 break;

132 }

133 default:

134 return compactError(`❌ Unknown source: ${String

dist/engine/delete-first/duplication-finder.jsView file

Lines 1-21javascript

1// Planu — Duplication finder (SPEC-482)

2// Hash-compares normalized code blocks with a sliding window to detect copy-paste.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine/delete-first/duplication-finder.jsView on unpkg · L1

3import { readFileSync } from 'node:fs';

4import { createHash } from 'node:crypto';

5/** Minimum number of lines for a block to be considered a duplication candidate. */

6const

dist/tools/rollback-release.jsView file

Lines 29-69javascript

29 if (dateStr) {

30 resolve(new Date(dateStr));

31 return;

32 }

33 }

34 catch {

35 // ignore

36 }

dist/config/hook-templates/planu-session-safeguard.shView file

•path = dist/config/hook-templates/planu-session-safeguard.sh kind = build_helper sizeBytes = 535 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/config/hook-templates/planu-session-safeguard.shView on unpkg

dist/config/mobile-ci-templates/android-github-actions.ymlView file

Lines 68-108yaml

68 uses: actions/cache@v4

69 with:

70 path: |

71 ~/.gradle/caches

72 ~/.gradle/wrapper

73 key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

74 restore-keys: ${{ runner.os }}-gradle-

dist/engine/ci-generator/android-jobs.jsView file

95patternName = generic_password severity = medium line = 95 matchedText = ` -Pand...\\`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L95

97patternName = generic_password severity = medium line = 97 matchedText = ` -Pand...D"`,

Medium

Secret Pattern

Hardcoded password in dist/engine/ci-generator/android-jobs.js

dist/engine/ci-generator/android-jobs.jsView on unpkg · L97

dist/engine/telemetry/telemetry-client.jsView file

5patternName = supabase_service_key severity = critical line = 5 matchedText = const SU...MU';

Critical

Secret Pattern

Supabase service role key (JWT) in dist/engine/telemetry/telemetry-client.js

dist/engine/telemetry/telemetry-client.jsView on unpkg · L5