registry / @vyuhlabs/dxkit / 2.23.0

@vyuhlabs/dxkit@2.23.0

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 251 file(s), 2.98 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

8 flagged

CHANGELOG.mdView file

Lines 3620-3660markdown

3620 D005 C# vulnerabilities defect: parser written against synthetic

3621 output, never validated against real tool output. Fixed by

3622 matching the canonical `\): error \w+:` regex. Caught by adding

3623 the C# row to the new lint matrix; the row failed because the

3624 parser returned 0 despite exit code != 0 and visible violations

3625 in the output. (`src/languages/csharp.ts`, **D016**)

3626

3627### Added

3628

3629- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

3630 New `BENCHMARK_LANGUAGES` table at the top of the file is the

3631 single source of truth for which languages participate and where

3632 each fixture's deliberate findings live. Each `describe('matrix —

3633 <report>')` block iterates the table to produce one uniform

3634 assertion per language — adding a new feature is one new

3635 optional field per row + one new `matrix —` describe; adding a

3636 6th language is one row append + one fixture dir + one CI install.

3637 No search-and-replace across describe blocks.

3638

3639- **`matrix — secrets` (Phase 10i.0.1)** — 5 hardcoded fake AWS

3640 access keys (`AKIA1234567890ABCDEF` — patterned digits/letters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3640

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3640

3641 that pass gitleaks' `aws-access-token` regex but fail real AWS

3642 validation and GitHub push protection). One per benchmark

3643 ecosystem. Asserts `dxkit vulnerabilities` surfaces a

3644 `SecretFinding` (category=secret, tool=gitleaks,

3645 rule=aws-access-token) for each.

3646

3647- **`matrix — lint` (Phase 10i.0.2)** — 5 deliberate idiomatic

3648 linter violations (Python ruff F401 unused-import, Go gosimple

3649 S1002 bool-comparison, Rust clippy unused_variables, C#

3650 dotnet-format whitespace × 2). Asserts `dxkit quality` reports

3651 the expected linter and ≥1 lint finding. CI workflow now

3652 installs `ruff` (pipx), `golangci-lint` (curl install script),

3653 and `clippy` (rustup component) alongside the existing depVulns

3654 toolchains; `dotnet format` ships in the .NET 8 SDK.

3655

3656- **`matrix — duplications` (Phase 10i.0.3)** — two near-identical

3657 helpers per fixture, sized comfortably above jscpd's

3658 `--min-lines 5 --min-tokens 50` defaults (initial pass had

3659 ~30-token bodies that fell below the threshold; widened on the

3660 way in). Asserts `metrics.duplication.cloneCount > 0`.

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/loop/stop-gate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@2.22.0 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:2.22.0 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/loop/stop-gate.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 113-153javascript

113 // exclusion set already applied. includeTests so a password hardcoded

114 // in a test still surfaces (a real fixture is allowlisted as

115 // `test-fixture`, not silently ignored).

116 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

117 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

118 // assembled in the aggregator — value- and salt-free, so the same secret

Source & flagged code

8 flagged · loading source

CHANGELOG.mdView file

3640patternName = aws_access_key severity = critical line = 3640 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3640

3640patternName = aws_access_key severity = critical line = 3640 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3640

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/loop/stop-gate.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/loop/stop-gate.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

133patternName = generic_password severity = medium line = 133 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L133

Findings

2 Critical2 High6 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

HighPrevious Version Dangerous Deltadist/loop/stop-gate.js

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings