@shepai/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

8 flagged

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView file

Lines 6-79javascript

6 * to dedupe/redact/persist. The scanner itself is pure — no fs/I/O — so it

7 * is trivially testable and deterministic across machines.

8 *

9 * Determinism: rules and files are iterated in fixed order, and the output

10 * order is `(file, line, rule)` so re-running on the same input produces

11 * identical findings → identical dedup keys (NFR-24).

12 */

13import { FindingDomain } from '../../generated/output.js';

14import { GENERIC_SECRET_ENTROPY_THRESHOLD, shannonEntropy } from './entropy.js';

15import { SECRET_RULES } from './secret-rule-pack.js';

16const PLACEHOLDER_FRAGMENTS = [

17 'example',

18 'placeholder',

19 'sample',

20 'xxxxxxxxxxxxxxxx',

21 '000000000000000',

22 'replace-me',

23 'changeme',

24 'your-key',

25 'your_key',

26 'AKIAIOSFODNN7EXAMPLE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

27];

28function looksLikePlaceholder(token) {

29 const lowered = token.toLowerCase();

30 return PLACEHOLDER_FRAGMENTS.some((frag) => lowered.includes(frag.toLowerCase()));

31}

32function extractCandidateValue(match) {

33 // For rules with a capture group, prefer the captured assignment value;

34 // otherwise the whole match is the secret.

35 return match[1] ?? match[0];

36}

37function applyGenericValidation(rule, value) {

38 if (rule.id !== 'secret.generic.high-entropy-assignment')

39 return true;

40 if (looksLikePlaceholder(value))

41 return false;

42 return shannonEntropy(value) >= GENERIC_SECRET_ENTROPY_THRESHOLD;

43}

44function applyValidator(rule, match, line) {

45 return rule.validate ? rule.validate(match, line) : true;

46}

47export function scanForSecrets(files) {

48 const drafts = [];

49 for (const file of files) {

50 if (file.content.length === 0)

51 continue;

52 const lines = file.content.split(/\r\n|\r|\n/);

53 for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {

54 const line = lines[lineIndex];

55 if (line.length === 0)

56 continue;

57 if (looksLikePlaceholder(line)) {

58 // Cheap early-out: lines that obviously document an example token

59 // (e.g. AKIAIOSFODNN7EXAMPLE) never produce drafts.

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L59

60 continue;

61 }

62 for (const rule of SECRET_RULES) {

63 rule.pattern.lastIndex = 0;

64 let match;

65 while ((match = rule.pattern.exec(line)) !== null) {

66 const candidate = extractCandidateValue(match);

67 if (!applyValidator(rule, match[0], line))

68 continue;

69 if (!applyGenericValidation(rule, candidate))

70 continue;

71 drafts.push({

72 ruleId: rule.id,

73 title: rule.title,

74 description: rule.description,

75 findingDomain: FindingDomain.Secret,

76 locationPath: file.path,

77 locationLine: lineIndex + 1,

78 rawSeverity: rule.severity,

79 canonicalSeverity: rule.severity,

dist/packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.jsView file

Lines 5-45javascript

5 * Mirrors the CLI upgrade command logic but designed for use from the web layer.

6 *

7 * Flow:

8 * 1. Check latest version from npm registry (fail-open)

dist/packages/core/src/infrastructure/persistence/sqlite/migrations.jsView file

Lines 44-84javascript

44 const allFiles = readdirSync(migrationsDir);

45 // Accept .js (compiled) and .ts (dev via tsx) but exclude .d.ts declaration files

46 const candidates = allFiles.filter((f) =>

dist/packages/core/src/infrastructure/services/scaffolding/bun-shadcn-scaffolder.service.jsView file

Lines 240-280javascript

240 emit('Info', 'Installing app dependencies', APP_EXTRA_DEPS.join(', '));

241 await this.runSpawn({

242 command: 'bun'

web/public/sounds/transition_down.wavView file

•path = web/public/sounds/transition_down.wav kind = high_entropy_blob sizeBytes = 8880 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/public/sounds/transition_down.wavView on unpkg

Source & flagged code

8 flagged · loading source

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView file

26patternName = aws_access_key severity = critical line = 26 matchedText = 'AKIAIOS...LE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

26patternName = aws_access_key severity = critical line = 26 matchedText = 'AKIAIOS...LE',

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

59patternName = aws_access_key severity = critical line = 59 matchedText = // (e.g....fts.

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L59

@shepai/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView file

Lines 6-79javascript

6 * to dedupe/redact/persist. The scanner itself is pure — no fs/I/O — so it

7 * is trivially testable and deterministic across machines.

8 *

9 * Determinism: rules and files are iterated in fixed order, and the output

10 * order is `(file, line, rule)` so re-running on the same input produces

11 * identical findings → identical dedup keys (NFR-24).

12 */

13import { FindingDomain } from '../../generated/output.js';

14import { GENERIC_SECRET_ENTROPY_THRESHOLD, shannonEntropy } from './entropy.js';

15import { SECRET_RULES } from './secret-rule-pack.js';

16const PLACEHOLDER_FRAGMENTS = [

17 'example',

18 'placeholder',

19 'sample',

20 'xxxxxxxxxxxxxxxx',

21 '000000000000000',

22 'replace-me',

23 'changeme',

24 'your-key',

25 'your_key',

26 'AKIAIOSFODNN7EXAMPLE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L26

27];

28function looksLikePlaceholder(token) {

29 const lowered = token.toLowerCase();

30 return PLACEHOLDER_FRAGMENTS.some((frag) => lowered.includes(frag.toLowerCase()));

31}

32function extractCandidateValue(match) {

33 // For rules with a capture group, prefer the captured assignment value;

34 // otherwise the whole match is the secret.

35 return match[1] ?? match[0];

36}

37function applyGenericValidation(rule, value) {

38 if (rule.id !== 'secret.generic.high-entropy-assignment')

39 return true;

40 if (looksLikePlaceholder(value))

41 return false;

42 return shannonEntropy(value) >= GENERIC_SECRET_ENTROPY_THRESHOLD;

43}

44function applyValidator(rule, match, line) {

45 return rule.validate ? rule.validate(match, line) : true;

46}

47export function scanForSecrets(files) {

48 const drafts = [];

49 for (const file of files) {

50 if (file.content.length === 0)

51 continue;

52 const lines = file.content.split(/\r\n|\r|\n/);

53 for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {

54 const line = lines[lineIndex];

55 if (line.length === 0)

56 continue;

57 if (looksLikePlaceholder(line)) {

58 // Cheap early-out: lines that obviously document an example token

59 // (e.g. AKIAIOSFODNN7EXAMPLE) never produce drafts.

Critical

Secret Pattern

AWS access key ID in dist/packages/core/src/domain/aspm/scan/secret-scanner.js

dist/packages/core/src/domain/aspm/scan/secret-scanner.jsView on unpkg · L59

60 continue;

61 }

62 for (const rule of SECRET_RULES) {

63 rule.pattern.lastIndex = 0;

64 let match;

65 while ((match = rule.pattern.exec(line)) !== null) {

66 const candidate = extractCandidateValue(match);

67 if (!applyValidator(rule, match[0], line))

68 continue;

69 if (!applyGenericValidation(rule, candidate))

70 continue;

71 drafts.push({

72 ruleId: rule.id,

73 title: rule.title,

74 description: rule.description,

75 findingDomain: FindingDomain.Secret,

76 locationPath: file.path,

77 locationLine: lineIndex + 1,

78 rawSeverity: rule.severity,

79 canonicalSeverity: rule.severity,

dist/packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.jsView file

Lines 5-45javascript

5 * Mirrors the CLI upgrade command logic but designed for use from the web layer.

6 *

7 * Flow:

8 * 1. Check latest version from npm registry (fail-open)

dist/packages/core/src/infrastructure/persistence/sqlite/migrations.jsView file

Lines 44-84javascript

44 const allFiles = readdirSync(migrationsDir);

45 // Accept .js (compiled) and .ts (dev via tsx) but exclude .d.ts declaration files

46 const candidates = allFiles.filter((f) =>

dist/packages/core/src/infrastructure/services/scaffolding/bun-shadcn-scaffolder.service.jsView file

Lines 240-280javascript

240 emit('Info', 'Installing app dependencies', APP_EXTRA_DEPS.join(', '));

241 await this.runSpawn({

242 command: 'bun'

web/public/sounds/transition_down.wavView file

•path = web/public/sounds/transition_down.wav kind = high_entropy_blob sizeBytes = 8880 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/public/sounds/transition_down.wavView on unpkg

@shepai/cli@1.219.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code