registry / @principles/core / 1.240.0

@principles/core@1.240.0

Universal Evolution SDK - framework-agnostic pain signal capture and principle injection

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 359 file(s), 2.45 MB of source, external domains: github.com, token-plan-cn.xiaomimimo.com

Source & flagged code

9 flagged

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView file

Lines 61-101javascript

61 it('handles empty string', () => {

62 expect(redactAbsolutePaths('')).toBe('');

63 });

64 it('handles string without paths', () => {

65 expect(redactAbsolutePaths('no paths here')).toBe('no paths here');

66 });

67});

68// ── redactTokenLikeValues ────────────────────────────────────────────────────

69describe('redactTokenLikeValues', () => {

70 it('redacts OpenAI tokens (sk-)', () => {

71 const input = 'Using sk-proj-abc123def456ghi789jkl012mno345pqr678';

72 const result = redactTokenLikeValues(input);

73 expect(result).toBe(`Using ${REDACTED_VALUE}`);

74 });

75 it('redacts OpenAI ant tokens (sk-ant-)', () => {

76 const input = 'Key: sk-ant-api03-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz';

77 const result = redactTokenLikeValues(input);

78 expect(result).toBe(`Key: ${REDACTED_VALUE}`);

79 });

80 it('redacts GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)', () => {

81 const input = 'ghp_abc123def456ghi789jkl012mno345pqr678stu';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

Critical

Secret Pattern

GitHub personal access token in dist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

82 const result = redactTokenLikeValues(input);

83 expect(result).toBe(REDACTED_VALUE);

84 });

85 it('redacts Linear tokens (lin_api_)', () => {

86 const input = 'lin_api_abc123def456ghi789jkl012mno345pqr678stu';

87 const result = redactTokenLikeValues(input);

88 expect(result).toBe(REDACTED_VALUE);

89 });

90 it('redacts Authorization header values', () => {

91 const input = 'Authorization: Bearer secret-token-12345';

92 const result = redactTokenLikeValues(input);

93 expect(result).toBe(`Authorization: Bearer ${REDACTED_VALUE}`);

94 });

95 it('redacts Authorization header with quotes', () => {

96 const input = 'Authorization: "Basic dXNlcjpwYXNz"';

97 const result = redactTokenLikeValues(input);

98 expect(result).toContain(REDACTED_VALUE);

99 });

100 it('redacts generic key assignments', () => {

101 const input = 'api_key=secret123 token=abc456 password=pass789';

Lines 239-279javascript

239 expect(result.ok).toBe(false);

240 if (!result.ok) {

241 expect(result.error).toContain('undefined');

242 }

243 });

244 it('returns error for primitive input', () => {

245 const result

Lines 296-336javascript

296 expect(result.value).toEqual({ user: 'bob', auth_token: REDACTED_VALUE });

297 }

298 });

299 it('redacts secret field', () => {

300 const obj = { config: 'value', secret: 'hidden' };

301 const result

dist/runtime-v2/story-a-demo.jsView file

Lines 65-105javascript

65 affectedTools: ['write_file'],

66 painReasonSummary: 'Demo: block writes to system directories',

67 }),

68 createdAt: new Date().toISOString(),

69 updatedAt: new Date().toISOString(),

dist/runtime-v2/activation/production-gate-deps.jsView file

Lines 122-162javascript

122 if (!isValidRuleHostResult(result)) {

123 throw new Error(`[${sourceLabel}]: evaluate returned invalid RuleHostResult (got ${typeof result === 'object' && result !== null ? safeStringifyPreview

dist/runtime-v2/__tests__/feedback/redact-sensitive.test.jsView file

Lines 21-61javascript

21 it('leaves relative paths alone', () => {

22 const text = 'Open src/index.ts and ./relative/path.ts please';

23 const result = redactAbsolutePaths(text);

24 expect(result).toBe(text);

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView file

745patternName = generic_password severity = medium line = 745 matchedText = body: { ...' },

Medium

Secret Pattern

Hardcoded password in dist/runtime-v2/store/context/sqlite-context-assembler.test.js

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView on unpkg · L745

Source & flagged code

9 flagged · loading source

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView file

81patternName = github_pat severity = critical line = 81 matchedText = const in...tu';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

81patternName = github_pat severity = critical line = 81 matchedText = const in...tu';

Critical

Secret Pattern

GitHub personal access token in dist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

316patternName = private_key_rsa severity = critical line = 316 matchedText = const ob...' };

Critical

Secret Pattern

RSA private key in dist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L316

259patternName = generic_password severity = medium line = 259 matchedText = const ob...' };

Medium

Secret Pattern

Hardcoded password in dist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L259

dist/runtime-v2/story-a-demo.jsView file

85const wrappedCode = `${implementationCode}; return evaluate(toolName, params);`; L86: const rawEvaluate = new Function('toolName', 'params', wrappedCode); L87: return (input, _helpers) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/runtime-v2/story-a-demo.jsView on unpkg · L85

dist/runtime-v2/activation/production-gate-deps.jsView file

142// and only then did evaluateInRefinerSandbox() check forbidden patterns — L143: // meaning malicious code (e.g. require('child_process')) would execute L144: // before being rejected. The check must happen on the source string

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/runtime-v2/activation/production-gate-deps.jsView on unpkg · L142

dist/runtime-v2/__tests__/feedback/redact-sensitive.test.jsView file

41patternName = github_pat severity = critical line = 41 matchedText = const te...CD';

Critical

Secret Pattern

GitHub personal access token in dist/runtime-v2/__tests__/feedback/redact-sensitive.test.js

dist/runtime-v2/__tests__/feedback/redact-sensitive.test.jsView on unpkg · L41

106patternName = generic_password severity = medium line = 106 matchedText = password...et',

Medium

Secret Pattern

Hardcoded password in dist/runtime-v2/__tests__/feedback/redact-sensitive.test.js

dist/runtime-v2/__tests__/feedback/redact-sensitive.test.jsView on unpkg · L106

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView file

745patternName = generic_password severity = medium line = 745 matchedText = body: { ...' },

Medium

Secret Pattern

Hardcoded password in dist/runtime-v2/store/context/sqlite-context-assembler.test.js

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView on unpkg · L745

Findings

4 Critical5 Medium5 Low

CriticalCritical Secretdist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

CriticalSecret Patterndist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

CriticalSecret Patterndist/runtime-v2/__tests__/feedback/redact-sensitive.test.js

MediumUnsafe Vm Contextdist/runtime-v2/activation/production-gate-deps.js

MediumEnvironment Vars

MediumSecret Patterndist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

MediumSecret Patterndist/runtime-v2/__tests__/feedback/redact-sensitive.test.js

MediumSecret Patterndist/runtime-v2/store/context/sqlite-context-assembler.test.js

LowScripts Present

LowEvaldist/runtime-v2/story-a-demo.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView file

Lines 61-101javascript

61 it('handles empty string', () => {

62 expect(redactAbsolutePaths('')).toBe('');

63 });

64 it('handles string without paths', () => {

65 expect(redactAbsolutePaths('no paths here')).toBe('no paths here');

66 });

67});

68// ── redactTokenLikeValues ────────────────────────────────────────────────────

69describe('redactTokenLikeValues', () => {

70 it('redacts OpenAI tokens (sk-)', () => {

71 const input = 'Using sk-proj-abc123def456ghi789jkl012mno345pqr678';

72 const result = redactTokenLikeValues(input);

73 expect(result).toBe(`Using ${REDACTED_VALUE}`);

74 });

75 it('redacts OpenAI ant tokens (sk-ant-)', () => {

76 const input = 'Key: sk-ant-api03-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz';

77 const result = redactTokenLikeValues(input);

78 expect(result).toBe(`Key: ${REDACTED_VALUE}`);

79 });

80 it('redacts GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)', () => {

81 const input = 'ghp_abc123def456ghi789jkl012mno345pqr678stu';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

Critical

Secret Pattern

GitHub personal access token in dist/runtime-v2/feedback/__tests__/redact-sensitive.test.js

dist/runtime-v2/feedback/__tests__/redact-sensitive.test.jsView on unpkg · L81

82 const result = redactTokenLikeValues(input);

83 expect(result).toBe(REDACTED_VALUE);

84 });

85 it('redacts Linear tokens (lin_api_)', () => {

86 const input = 'lin_api_abc123def456ghi789jkl012mno345pqr678stu';

87 const result = redactTokenLikeValues(input);

88 expect(result).toBe(REDACTED_VALUE);

89 });

90 it('redacts Authorization header values', () => {

91 const input = 'Authorization: Bearer secret-token-12345';

92 const result = redactTokenLikeValues(input);

93 expect(result).toBe(`Authorization: Bearer ${REDACTED_VALUE}`);

94 });

95 it('redacts Authorization header with quotes', () => {

96 const input = 'Authorization: "Basic dXNlcjpwYXNz"';

97 const result = redactTokenLikeValues(input);

98 expect(result).toContain(REDACTED_VALUE);

99 });

100 it('redacts generic key assignments', () => {

101 const input = 'api_key=secret123 token=abc456 password=pass789';

Lines 239-279javascript

239 expect(result.ok).toBe(false);

240 if (!result.ok) {

241 expect(result.error).toContain('undefined');

242 }

243 });

244 it('returns error for primitive input', () => {

245 const result

Lines 296-336javascript

296 expect(result.value).toEqual({ user: 'bob', auth_token: REDACTED_VALUE });

297 }

298 });

299 it('redacts secret field', () => {

300 const obj = { config: 'value', secret: 'hidden' };

301 const result

dist/runtime-v2/story-a-demo.jsView file

Lines 65-105javascript

65 affectedTools: ['write_file'],

66 painReasonSummary: 'Demo: block writes to system directories',

67 }),

68 createdAt: new Date().toISOString(),

69 updatedAt: new Date().toISOString(),

dist/runtime-v2/activation/production-gate-deps.jsView file

Lines 122-162javascript

122 if (!isValidRuleHostResult(result)) {

123 throw new Error(`[${sourceLabel}]: evaluate returned invalid RuleHostResult (got ${typeof result === 'object' && result !== null ? safeStringifyPreview

dist/runtime-v2/__tests__/feedback/redact-sensitive.test.jsView file

Lines 21-61javascript

21 it('leaves relative paths alone', () => {

22 const text = 'Open src/index.ts and ./relative/path.ts please';

23 const result = redactAbsolutePaths(text);

24 expect(result).toBe(text);

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView file

745patternName = generic_password severity = medium line = 745 matchedText = body: { ...' },

Medium

Secret Pattern

Hardcoded password in dist/runtime-v2/store/context/sqlite-context-assembler.test.js

dist/runtime-v2/store/context/sqlite-context-assembler.test.jsView on unpkg · L745