registry / @vortex-os/base / 0.18.29

@vortex-os/base@0.18.29

Base entry point for VortEX — a Multi-Agent Personal AI Work OS framework

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 649 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

3 flagged

dist/source-map-65HJZR7B.jsView file

Lines 244-284javascript

244 while (j >= 0) {

245 const t = lines[j].trim();

246 buf.unshift(t.replace(/^\/?\*+\/?/

Source & flagged code

3 flagged · loading source

dist/source-map-65HJZR7B.jsView file

264try { L265: ({ DatabaseSync } = await import(NODE_SQLITE_SPECIFIER)); L266: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/source-map-65HJZR7B.jsView on unpkg · L264

dist/dist-3RWY3T7B.jsView file

1864// ── secrets / credentials ── L1865: ["private-key", /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----/i], L1866: ["jwt", /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/], ... L1905: ["credential-note", /(?:\bpass(?:word|wd)\b|\bpw\b|\bpwd\b|비밀번호|비번|암호|패스워드)\s*[-:=]?\s+(?=\S*\d)\S{3,}/iu], L1906: // long opaque token: 40+ base64/hex run (catches prefix-less secrets + hashes; may L1907: // also flag a sha — acceptable, fail toward blocking). ... L2302: if (!match) { L2303: return { frontmatter: {}, body: cleaned }; L2304: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-3RWY3T7B.jsView on unpkg · L1864

dist/chunk-I4GCR5NC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vortex-os/base@0.18.28 matchedIdentity = npm:QHZvcnRleC1vcy9iYXNl:0.18.28 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-I4GCR5NC.jsView on unpkg

Findings

1 High4 Medium6 Low

HighPrevious Version Dangerous Deltadist/chunk-I4GCR5NC.js

MediumDynamic Requiredist/source-map-65HJZR7B.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/dist-3RWY3T7B.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/dist-3RWY3T7B.jsView file

Lines 1844-1884javascript

1844 let trust;

1845 let verifiedBy;

1846 if (hasDeterministic(v.relId)) {

1847 trust = "high";

1848 verifiedBy = "deterministic";

1849 } else if (raw.verifier === "cross-model") {

1850 trust = "medium";

1851 verifiedBy = "cross-model";

1852 } else {

1853 trust = "low";

1854 verifiedBy = "self";

1855 }

1856 if (sourceKind === "conversation" && trust === "high") {

1857 trust = "medium";

1858 }

1859 return { ok: true, value: { ...base, trust, trustRank: TRUST_RANK[trust], verifiedBy } };

1860}

1861

1862// ../modules/ontos/dist/enrich/sensitivity.js

1863var RULES = [

1864 // ── secrets / credentials ──

1865 ["private-key", /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----/i],

1866 ["jwt", /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-3RWY3T7B.jsView on unpkg · L1864

1867 ["openai-key", /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}\b/],

1868 ["stripe-key", /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/],

1869 ["sendgrid-key", /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/],

1870 ["gitlab-token", /\bglpat-[A-Za-z0-9_-]{16,}\b/],

1871 ["github-token", /\bgh[pousr]_[A-Za-z0-9]{20,}\b/],

1872 ["npm-token", /\bnpm_[A-Za-z0-9]{30,}\b/],

1873 ["aws-access-key", /\bAKIA[0-9A-Z]{16}\b/],

1874 ["slack-token", /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/],

1875 ["google-api-key", /\bAIza[0-9A-Za-z_-]{30,}\b/],

1876 ["bearer-token", /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{12,}=*/],

1877 ["authorization-header", /\bAuthorization\s*[:=]/i],

1878 // key:value or key=value, with optional quotes around key AND value (covers JSON

1879 // "password": "x" and camelCase apiKey/accessToken/clientSecret/privateKey/etc).

1881 // scheme://user:pass@host — credentials embedded in a URL.

1882 ["credential-url", /[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/i],

1883 // natural-language credential disclosure — a credential noun/phrase (EN/KO) joined to a

1884 // value by a copula/separator. The `secret-assignment` rule above only catches machine