registry / @vyuhlabs/dxkit / 2.19.0

@vyuhlabs/dxkit@2.19.0

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 234 file(s), 2.81 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

7 flagged

CHANGELOG.mdView file

Lines 3421-3461markdown

3421 D005 C# vulnerabilities defect: parser written against synthetic

3422 output, never validated against real tool output. Fixed by

3423 matching the canonical `\): error \w+:` regex. Caught by adding

3424 the C# row to the new lint matrix; the row failed because the

3425 parser returned 0 despite exit code != 0 and visible violations

3426 in the output. (`src/languages/csharp.ts`, **D016**)

3427

3428### Added

3429

3430- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

3431 New `BENCHMARK_LANGUAGES` table at the top of the file is the

3432 single source of truth for which languages participate and where

3433 each fixture's deliberate findings live. Each `describe('matrix —

3434 <report>')` block iterates the table to produce one uniform

3435 assertion per language — adding a new feature is one new

3436 optional field per row + one new `matrix —` describe; adding a

3437 6th language is one row append + one fixture dir + one CI install.

3438 No search-and-replace across describe blocks.

3439

3440- **`matrix — secrets` (Phase 10i.0.1)** — 5 hardcoded fake AWS

3441 access keys (`AKIA1234567890ABCDEF` — patterned digits/letters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3441

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3441

3442 that pass gitleaks' `aws-access-token` regex but fail real AWS

3443 validation and GitHub push protection). One per benchmark

3444 ecosystem. Asserts `dxkit vulnerabilities` surfaces a

3445 `SecretFinding` (category=secret, tool=gitleaks,

3446 rule=aws-access-token) for each.

3447

3448- **`matrix — lint` (Phase 10i.0.2)** — 5 deliberate idiomatic

3449 linter violations (Python ruff F401 unused-import, Go gosimple

3450 S1002 bool-comparison, Rust clippy unused_variables, C#

3451 dotnet-format whitespace × 2). Asserts `dxkit quality` reports

3452 the expected linter and ≥1 lint finding. CI workflow now

3453 installs `ruff` (pipx), `golangci-lint` (curl install script),

3454 and `clippy` (rustup component) alongside the existing depVulns

3455 toolchains; `dotnet format` ships in the .NET 8 SDK.

3456

3457- **`matrix — duplications` (Phase 10i.0.3)** — two near-identical

3458 helpers per fixture, sized comfortably above jscpd's

3459 `--min-lines 5 --min-tokens 50` defaults (initial pass had

3460 ~30-token bodies that fell below the threshold; widened on the

3461 way in). Asserts `metrics.duplication.cloneCount > 0`.

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 113-153javascript

113 // exclusion set already applied. includeTests so a password hardcoded

114 // in a test still surfaces (a real fixture is allowlisted as

115 // `test-fixture`, not silently ignored).

116 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

117 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

118 // assembled in the aggregator — value- and salt-free, so the same secret

Source & flagged code

7 flagged · loading source

CHANGELOG.mdView file

3441patternName = aws_access_key severity = critical line = 3441 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3441

3441patternName = aws_access_key severity = critical line = 3441 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3441

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

133patternName = generic_password severity = medium line = 133 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L133

Findings

2 Critical1 High6 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings