registry / @vyuhlabs/dxkit / 2.26.0

@vyuhlabs/dxkit@2.26.0

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 257 file(s), 3.05 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

8 flagged

CHANGELOG.mdView file

Lines 3734-3774markdown

3734 D005 C# vulnerabilities defect: parser written against synthetic

3735 output, never validated against real tool output. Fixed by

3736 matching the canonical `\): error \w+:` regex. Caught by adding

3737 the C# row to the new lint matrix; the row failed because the

3738 parser returned 0 despite exit code != 0 and visible violations

3739 in the output. (`src/languages/csharp.ts`, **D016**)

3740

3741### Added

3742

3743- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

3744 New `BENCHMARK_LANGUAGES` table at the top of the file is the

3745 single source of truth for which languages participate and where

3746 each fixture's deliberate findings live. Each `describe('matrix —

3747 <report>')` block iterates the table to produce one uniform

3748 assertion per language — adding a new feature is one new

3749 optional field per row + one new `matrix —` describe; adding a

3750 6th language is one row append + one fixture dir + one CI install.

3751 No search-and-replace across describe blocks.

3752

3753- **`matrix — secrets` (Phase 10i.0.1)** — 5 hardcoded fake AWS

3754 access keys (`AKIA1234567890ABCDEF` — patterned digits/letters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3754

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3754

3755 that pass gitleaks' `aws-access-token` regex but fail real AWS

3756 validation and GitHub push protection). One per benchmark

3757 ecosystem. Asserts `dxkit vulnerabilities` surfaces a

3758 `SecretFinding` (category=secret, tool=gitleaks,

3759 rule=aws-access-token) for each.

3760

3761- **`matrix — lint` (Phase 10i.0.2)** — 5 deliberate idiomatic

3762 linter violations (Python ruff F401 unused-import, Go gosimple

3763 S1002 bool-comparison, Rust clippy unused_variables, C#

3764 dotnet-format whitespace × 2). Asserts `dxkit quality` reports

3765 the expected linter and ≥1 lint finding. CI workflow now

3766 installs `ruff` (pipx), `golangci-lint` (curl install script),

3767 and `clippy` (rustup component) alongside the existing depVulns

3768 toolchains; `dotnet format` ships in the .NET 8 SDK.

3769

3770- **`matrix — duplications` (Phase 10i.0.3)** — two near-identical

3771 helpers per fixture, sized comfortably above jscpd's

3772 `--min-lines 5 --min-tokens 50` defaults (initial pass had

3773 ~30-token bodies that fell below the threshold; widened on the

3774 way in). Asserts `metrics.duplication.cloneCount > 0`.

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/tools-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@2.25.0 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:2.25.0 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 113-153javascript

113 // exclusion set already applied. includeTests so a password hardcoded

114 // in a test still surfaces (a real fixture is allowlisted as

115 // `test-fixture`, not silently ignored).

116 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

117 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

118 // assembled in the aggregator — value- and salt-free, so the same secret

Source & flagged code

8 flagged · loading source

CHANGELOG.mdView file

3754patternName = aws_access_key severity = critical line = 3754 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3754

3754patternName = aws_access_key severity = critical line = 3754 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3754

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/tools-cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

133patternName = generic_password severity = medium line = 133 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L133

Findings

2 Critical2 High6 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

HighPrevious Version Dangerous Deltadist/tools-cli.js

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings