registry / @vyuhlabs/dxkit / 2.24.0

@vyuhlabs/dxkit@2.24.0

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 253 file(s), 3.01 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

8 flagged

CHANGELOG.mdView file

Lines 3654-3694markdown

3654 D005 C# vulnerabilities defect: parser written against synthetic

3655 output, never validated against real tool output. Fixed by

3656 matching the canonical `\): error \w+:` regex. Caught by adding

3657 the C# row to the new lint matrix; the row failed because the

3658 parser returned 0 despite exit code != 0 and visible violations

3659 in the output. (`src/languages/csharp.ts`, **D016**)

3660

3661### Added

3662

3663- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

3664 New `BENCHMARK_LANGUAGES` table at the top of the file is the

3665 single source of truth for which languages participate and where

3666 each fixture's deliberate findings live. Each `describe('matrix —

3667 <report>')` block iterates the table to produce one uniform

3668 assertion per language — adding a new feature is one new

3669 optional field per row + one new `matrix —` describe; adding a

3670 6th language is one row append + one fixture dir + one CI install.

3671 No search-and-replace across describe blocks.

3672

3673- **`matrix — secrets` (Phase 10i.0.1)** — 5 hardcoded fake AWS

3674 access keys (`AKIA1234567890ABCDEF` — patterned digits/letters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3674

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3674

3675 that pass gitleaks' `aws-access-token` regex but fail real AWS

3676 validation and GitHub push protection). One per benchmark

3677 ecosystem. Asserts `dxkit vulnerabilities` surfaces a

3678 `SecretFinding` (category=secret, tool=gitleaks,

3679 rule=aws-access-token) for each.

3680

3681- **`matrix — lint` (Phase 10i.0.2)** — 5 deliberate idiomatic

3682 linter violations (Python ruff F401 unused-import, Go gosimple

3683 S1002 bool-comparison, Rust clippy unused_variables, C#

3684 dotnet-format whitespace × 2). Asserts `dxkit quality` reports

3685 the expected linter and ≥1 lint finding. CI workflow now

3686 installs `ruff` (pipx), `golangci-lint` (curl install script),

3687 and `clippy` (rustup component) alongside the existing depVulns

3688 toolchains; `dotnet format` ships in the .NET 8 SDK.

3689

3690- **`matrix — duplications` (Phase 10i.0.3)** — two near-identical

3691 helpers per fixture, sized comfortably above jscpd's

3692 `--min-lines 5 --min-tokens 50` defaults (initial pass had

3693 ~30-token bodies that fell below the threshold; widened on the

3694 way in). Asserts `metrics.duplication.cloneCount > 0`.

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/issue-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@2.23.0 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:2.23.0 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/issue-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 113-153javascript

113 // exclusion set already applied. includeTests so a password hardcoded

114 // in a test still surfaces (a real fixture is allowlisted as

115 // `test-fixture`, not silently ignored).

116 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

117 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

118 // assembled in the aggregator — value- and salt-free, so the same secret

Source & flagged code

8 flagged · loading source

CHANGELOG.mdView file

3674patternName = aws_access_key severity = critical line = 3674 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3674

3674patternName = aws_access_key severity = critical line = 3674 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3674

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/issue-cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/issue-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

133patternName = generic_password severity = medium line = 133 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L133

Findings

2 Critical2 High6 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

HighPrevious Version Dangerous Deltadist/issue-cli.js

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings