registry / @vyuhlabs/dxkit / 2.21.2

@vyuhlabs/dxkit@2.21.2

⚠ Under review

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 240 file(s), 2.87 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

8 flagged

CHANGELOG.mdView file

Lines 3526-3566markdown

3526 D005 C# vulnerabilities defect: parser written against synthetic

3527 output, never validated against real tool output. Fixed by

3528 matching the canonical `\): error \w+:` regex. Caught by adding

3529 the C# row to the new lint matrix; the row failed because the

3530 parser returned 0 despite exit code != 0 and visible violations

3531 in the output. (`src/languages/csharp.ts`, **D016**)

3532

3533### Added

3534

3535- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

3536 New `BENCHMARK_LANGUAGES` table at the top of the file is the

3537 single source of truth for which languages participate and where

3538 each fixture's deliberate findings live. Each `describe('matrix —

3539 <report>')` block iterates the table to produce one uniform

3540 assertion per language — adding a new feature is one new

3541 optional field per row + one new `matrix —` describe; adding a

3542 6th language is one row append + one fixture dir + one CI install.

3543 No search-and-replace across describe blocks.

3544

3545- **`matrix — secrets` (Phase 10i.0.1)** — 5 hardcoded fake AWS

3546 access keys (`AKIA1234567890ABCDEF` — patterned digits/letters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3546

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3546

3547 that pass gitleaks' `aws-access-token` regex but fail real AWS

3548 validation and GitHub push protection). One per benchmark

3549 ecosystem. Asserts `dxkit vulnerabilities` surfaces a

3550 `SecretFinding` (category=secret, tool=gitleaks,

3551 rule=aws-access-token) for each.

3552

3553- **`matrix — lint` (Phase 10i.0.2)** — 5 deliberate idiomatic

3554 linter violations (Python ruff F401 unused-import, Go gosimple

3555 S1002 bool-comparison, Rust clippy unused_variables, C#

3556 dotnet-format whitespace × 2). Asserts `dxkit quality` reports

3557 the expected linter and ≥1 lint finding. CI workflow now

3558 installs `ruff` (pipx), `golangci-lint` (curl install script),

3559 and `clippy` (rustup component) alongside the existing depVulns

3560 toolchains; `dotnet format` ships in the .NET 8 SDK.

3561

3562- **`matrix — duplications` (Phase 10i.0.3)** — two near-identical

3563 helpers per fixture, sized comfortably above jscpd's

3564 `--min-lines 5 --min-tokens 50` defaults (initial pass had

3565 ~30-token bodies that fell below the threshold; widened on the

3566 way in). Asserts `metrics.duplication.cloneCount > 0`.

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/loop/stop-gate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@2.19.0 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:2.19.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/loop/stop-gate.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 113-153javascript

113 // exclusion set already applied. includeTests so a password hardcoded

114 // in a test still surfaces (a real fixture is allowlisted as

115 // `test-fixture`, not silently ignored).

116 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

117 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

118 // assembled in the aggregator — value- and salt-free, so the same secret

Source & flagged code

8 flagged · loading source

CHANGELOG.mdView file

3546patternName = aws_access_key severity = critical line = 3546 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3546

3546patternName = aws_access_key severity = critical line = 3546 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3546

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/loop/stop-gate.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/loop/stop-gate.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

133patternName = generic_password severity = medium line = 133 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L133

Findings

3 Critical1 High6 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalPrevious Version Dangerous Deltadist/loop/stop-gate.js

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings