registry / @tjsasakinpm/devflow / 1.1.1

@tjsasakinpm/devflow@1.1.1

Local AI coding governance CLI for Claude Code, Cursor and Copilot. Audit AI-generated changes before PR, enforce evidence, run adversarial review and generate PR risk reports.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 205 file(s), 1.24 MB of source, external domains: api.anthropic.com, api.openai.com, astral.sh, cli.github.com, devflow.io, github.com, img.shields.io, nodejs.org, www.w3.org

Source & flagged code

5 flagged

dist/core/audit-engine.jsView file

Lines 23-63javascript

23 if (/\.(js|jsx|mjs|cjs)$/.test(filePath))

24 return "JavaScript";

25 if (/\.py$/.test(filePath))

26 return "Python";

27 if (/\.go$/.test(filePath))

28 return "Go";

29 if (/\.rs$/.test(filePath))

30 return "Rust";

31 if (/\.rb$/.test(filePath))

32 return "Ruby";

33 if (/\.php$/.test(filePath))

34 return "PHP";

35 if (/\.java$/.test(filePath))

36 return "Java";

37 return undefined;

38}

39const UNIVERSAL_PATTERNS = [

40 {

41 id: "eval-usage",

42 severity: "CRITICAL",

43 category: "security",

44 description: "eval() or exec() usage detected — arbitrary code execution risk",

45 recommendation: "Replace eval()/exec() with safe alternatives (JSON.parse, structured parsing, or sandboxed evaluation)",

High

Child Process

Package source references child process execution.

dist/core/audit-engine.jsView on unpkg · L43

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/audit-engine.jsView on unpkg · L43

46 test: (c) => /\beval\s*\(/.test(c) || /\bexec\s*\(/.test(c),

47 },

48 {

49 id: "hardcoded-secret",

50 severity: "HIGH",

51 category: "security",

52 description: "Potential hardcoded secret (password, token, key, secret) found",

53 recommendation: "Use environment variables or a secrets manager. Never commit secrets to source control.",

54 test: (c) => /(?:password|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*["'][^"']{8,}["']/i.test(c),

55 },

56 {

57 id: "debug-flag",

58 severity: "LOW",

59 category: "code-quality",

60 description: "Debug flag or print statement found — may leak information in production",

61 recommendation: "Remove debug statements or guard with environment check before committing.",

63 },

dist/kernel/orchestration/parallel-spawner.jsView file

Lines 141-181javascript

141 error: err instanceof Error ? err.message : String(err),

142 };

143 }

144 }

145 }

146 // -------------------------------------------------------------------------

147 // Subprocess spawning

148

dist/adapters/stacks/typescript/index.jsView file

Lines 49-89javascript

49 break; // reached filesystem root

50 dir = parent;

51 }

52 return null;

53}

54// ── Adapter ──

55export const typescriptAdapter = {

56 language:

src/kernel/artifacts/tool-configs/verify-all.shView file

•path = src/kernel/artifacts/tool-configs/verify-all.sh kind = build_helper sizeBytes = 3778 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/kernel/artifacts/tool-configs/verify-all.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/core/audit-engine.jsView file

43category: "security", L44: description: "eval() or exec() usage detected — arbitrary code execution risk", L45: recommendation: "Replace eval()/exec() with safe alternatives (JSON.parse, structured parsing, or sandboxed evaluation)",

High

Child Process

Package source references child process execution.

dist/core/audit-engine.jsView on unpkg · L43

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/audit-engine.jsView on unpkg · L43

dist/kernel/orchestration/parallel-spawner.jsView file

161stdio: ["ignore", "pipe", "pipe"], L162: execArgv: [], // Don't pass --inspect etc. L163: });

High

Shell

Package source references shell execution.

dist/kernel/orchestration/parallel-spawner.jsView on unpkg · L161

dist/adapters/stacks/typescript/index.jsView file

69// Try vitest, jest, then npm test as fallback L70: const commands = ["npx vitest run", "npx jest", "npm test"]; L71: for (const cmd of commands) { ... L75: try { L76: execSync(`${toolName} --version 2>/dev/null`, { L77: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/adapters/stacks/typescript/index.jsView on unpkg · L69

src/kernel/artifacts/tool-configs/verify-all.shView file

•path = src/kernel/artifacts/tool-configs/verify-all.sh kind = build_helper sizeBytes = 3778 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/kernel/artifacts/tool-configs/verify-all.shView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/core/audit-engine.js

HighShelldist/kernel/orchestration/parallel-spawner.js

HighRuntime Package Installdist/adapters/stacks/typescript/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersrc/kernel/artifacts/tool-configs/verify-all.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/core/audit-engine.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/core/audit-engine.jsView file

Lines 23-63javascript

23 if (/\.(js|jsx|mjs|cjs)$/.test(filePath))

24 return "JavaScript";

25 if (/\.py$/.test(filePath))

26 return "Python";

27 if (/\.go$/.test(filePath))

28 return "Go";

29 if (/\.rs$/.test(filePath))

30 return "Rust";

31 if (/\.rb$/.test(filePath))

32 return "Ruby";

33 if (/\.php$/.test(filePath))

34 return "PHP";

35 if (/\.java$/.test(filePath))

36 return "Java";

37 return undefined;

38}

39const UNIVERSAL_PATTERNS = [

40 {

41 id: "eval-usage",

42 severity: "CRITICAL",

43 category: "security",

44 description: "eval() or exec() usage detected — arbitrary code execution risk",

45 recommendation: "Replace eval()/exec() with safe alternatives (JSON.parse, structured parsing, or sandboxed evaluation)",

High

Child Process

Package source references child process execution.

dist/core/audit-engine.jsView on unpkg · L43

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/audit-engine.jsView on unpkg · L43

46 test: (c) => /\beval\s*\(/.test(c) || /\bexec\s*\(/.test(c),

47 },

48 {

49 id: "hardcoded-secret",

50 severity: "HIGH",

51 category: "security",

52 description: "Potential hardcoded secret (password, token, key, secret) found",

53 recommendation: "Use environment variables or a secrets manager. Never commit secrets to source control.",

54 test: (c) => /(?:password|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*["'][^"']{8,}["']/i.test(c),

55 },

56 {

57 id: "debug-flag",

58 severity: "LOW",

59 category: "code-quality",

60 description: "Debug flag or print statement found — may leak information in production",

61 recommendation: "Remove debug statements or guard with environment check before committing.",

63 },

dist/kernel/orchestration/parallel-spawner.jsView file

Lines 141-181javascript

141 error: err instanceof Error ? err.message : String(err),

142 };

143 }

144 }

145 }

146 // -------------------------------------------------------------------------

147 // Subprocess spawning

148

dist/adapters/stacks/typescript/index.jsView file

Lines 49-89javascript

49 break; // reached filesystem root

50 dir = parent;

51 }

52 return null;

53}

54// ── Adapter ──

55export const typescriptAdapter = {

56 language:

src/kernel/artifacts/tool-configs/verify-all.shView file

•path = src/kernel/artifacts/tool-configs/verify-all.sh kind = build_helper sizeBytes = 3778 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/kernel/artifacts/tool-configs/verify-all.shView on unpkg