@techninja/clearstack: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 146 KB of source, external domains: data.tn42.com, json-schema.org, www.sitemaps.org

Source & flagged code

4 flagged

templates/shared/.envView file

6patternName = blocked_file severity = critical matchedText = templates/shared/.env redactedSecretContext = secretLikeLines = 1 L6: SPEC_IGNORE_DIRS=<redacted:37 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/shared/.envView on unpkg · L6

lib/spec-i18n-locales.jsView file

Lines 1-26javascript

1/**

2 * Locale file parsing helpers for i18n spec check.

3 * @module lib/spec-i18n-locales

4 */

6import { readFileSync, readdirSync, existsSync } from 'node:fs';

7import { execFile } from 'node:child_process';

8import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

lib/spec-i18n-locales.jsView on unpkg · L6

9import { resolve } from 'node:path';

11const execFileAsync = promisify(execFile);

13/**

14 * Try to run `npx hybrids extract ./src` and parse the JSON output.

15 * @param {string} root

16 * @returns {Promise<Record<string, object>|null>}

17 */

18export async function tryHybridsExtract(root) {

19 const srcDir = resolve(root, 'src');

20 if (!existsSync(srcDir)) return null;

21 try {

22 const { stdout } = await execFileAsync('npx', ['hybrids', 'extract', './src'], {

23 cwd: root,

24 encoding: 'utf-8',

25 timeout: 30000,

26 });

lib/check.jsView file

Lines 1-39javascript

1/**

2 * Spec compliance checker — check orchestration and resolution.

3 * Config lives in spec-config.js, utilities in spec-utils.js.

4 * @module lib/check

5 */

7import { existsSync } from 'node:fs';

8import { resolve } from

templates/shared/scripts/test.jsView file

Lines 26-58javascript

26 return results;

27}

29const componentDir = resolve(ROOT, 'src/components');

30const allTests =

Source & flagged code

4 flagged · loading source

templates/shared/.envView file

@techninja/clearstack: Suspicious npm security report (Warn) | LPM Firewall

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code