registry / @vyuhlabs/dxkit / 2.32.0

@vyuhlabs/dxkit@2.32.0

A deterministic stop condition and code-graph context layer for AI coding agents: gives agents a code graph to make changes, then blocks only net-new detector-backed regressions at the stop boundary, with no model in the gate.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 262 file(s), 3.11 MB of source, external domains: api.first.org, api.osv.dev, api.snyk.io, cli.github.com, github.com, json.schemastore.org, osv.dev, registry.npmjs.org, rustsec.org, snyk.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

13 flagged

CHANGELOG.mdView file

Lines 145-185markdown

145## [2.29.0] - 2026-07-05

146

147### Flow — catch-all routes and base-URL-helper calls now resolve

148

149A client call to a route served by a **catch-all** (`app/api/[...slug]/route.ts`,

150Express `/api/*`, Spring `/api/**`, Rails `*path`, FastAPI `{p:path}`) used to

151show as unresolved, because the join matched only exact paths. Catch-all routes

152now normalize to a distinct `/{prefix}/{*}` marker and the join **prefix-matches**

153concrete calls against them — so a `POST /api/form-submissions` binds the

154Payload catch-all it actually hits. An exact literal route still wins over a

155covering catch-all, and the longest matching prefix wins among catch-alls. A new

156cross-framework matching corpus (`test/flow-matching-corpus.test.ts`) pins the

157behavior so future language packs inherit it.

158

159### Fixed — fewer security false positives on template repos

160

161- **`.env.example` / `.env.template` / `.env.sample` are no longer counted as

162 committed secrets** — those are intentional conventions; a real `.env` /

163 `.env.production` still counts.

164- **Obvious placeholder secret values are dropped**, not flagged:

165 `password: 'password'`, `apiKey = 'your-api-key'`, `<your-key>`, `${VAR}`,

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L165

166 repeated-character runs. The heuristics are deliberately narrow to never

167 suppress a real credential. Both live in one benign-conventions module every

168 secret / env detector consults.

169- **Install hints and the tool descriptor now match your package manager.** A

170 `loop doctor` fix hint and the `tools list` install command render as `pnpm

171 add -D` / `yarn add -D` / `bun add -d` on those repos instead of always `npm

172 install --save-dev` (the executed install was already PM-aware).

173

174### Docs

175

176- README quickstart notes the pnpm `minimumReleaseAge` step for a fresh release.

177

178## [2.28.0] - 2026-07-05

179

180### Added — file-convention route detection (Next.js App Router & friends)

181

182The flow feature's served side now understands routes served by a handler

183file's **location** on disk, not just in-source decorators (`@get`) and router

184calls (`app.get`). A Next.js App Router repo previously reported "0 routes" —

185every client call showed as unresolved — because `app/**/route.ts` handlers are

Lines 3967-4007markdown

3967 D005 C# vulnerabilities defect: parser written against synthetic

3968 output, never validated against real tool output. Fixed by

3969 matching the canonical `\): error \w+:` regex. Caught by adding

3970 the C# row to the new lint matrix; the row failed because the

3971 parser returned 0 despite exit code != 0 and visible violations

3972 in the output. (`src/languages/csharp.ts`, **D016**)

3973

3974### Added

3975

3976- **Cross-ecosystem matrix layer** (`test/integration/cross-ecosystem.test.ts`).

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' : 's'} from git`,

214 rationale: 'Private keys in git are compromised. Rotate + remove + add to .gitignore.'

dist/constants.jsView file

Lines 18-58javascript

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/tools-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@2.31.0 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:2.31.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 115-166javascript

115 // in a test still surfaces (a real fixture is allowlisted as

116 // `test-fixture`, not silently ignored).

117 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

118 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

119 // assembled in the aggregator — value- and salt-free, so the same secret

120 // fingerprints identically whether gitleaks or this grep fallback found

dist/analyzers/tools/gitleaks.jsView file

Lines 141-181javascript

141 schemaVersion: 1,

142 tool: 'gitleaks',

143 findings: [],

144 suppressedCount: 0,

145 };

146 return { kind: 'success', envelope, suppressedCount: 0, rawSecrets: [] };

dist/analyzers/security/benign.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.js

dist/analyzers/security/benign.jsView on unpkg · L10

dist/analyzers/security/benign.d.tsView file

9patternName = generic_password severity = medium line = 9 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.d.ts

dist/analyzers/security/benign.d.tsView on unpkg · L9

Source & flagged code

13 flagged · loading source

CHANGELOG.mdView file

3987patternName = aws_access_key severity = critical line = 3987 matchedText = access k...ters

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L3987

3987patternName = aws_access_key severity = critical line = 3987 matchedText = access k...ters

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L3987

165patternName = generic_password severity = medium line = 165 matchedText = `passwor...R}`,

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L165

dist/analyzers/health/actions.jsView file

232id: 'health.security.remove-eval', L233: title: `Remove ${m.evalCount} eval() call${m.evalCount === 1 ? '' : 's'}`, L234: rationale: 'eval() enables arbitrary code execution. Replace with explicit parsing.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/analyzers/health/actions.jsView on unpkg · L232

dist/constants.jsView file

38exports.buildConditions = buildConditions; L39: const fs = __importStar(require("fs")); L40: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L38

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/tools-cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools-cli.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

135patternName = generic_password severity = medium line = 135 matchedText = // (`pas...o an

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L135

146patternName = generic_password severity = medium line = 146 matchedText = // Drop ...d'`,

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/grep-secrets.js

dist/analyzers/tools/grep-secrets.jsView on unpkg · L146

dist/analyzers/tools/gitleaks.jsView file

161patternName = generic_password severity = medium line = 161 matchedText = // Drop ...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/tools/gitleaks.js

dist/analyzers/tools/gitleaks.jsView on unpkg · L161

dist/analyzers/security/benign.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.js

dist/analyzers/security/benign.jsView on unpkg · L10

dist/analyzers/security/benign.d.tsView file

9patternName = generic_password severity = medium line = 9 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.d.ts

dist/analyzers/security/benign.d.tsView on unpkg · L9

Findings

2 Critical2 High11 Medium6 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPayload In Excluded Dirtemplates/.devcontainer/post-create.sh

HighPrevious Version Dangerous Deltadist/tools-cli.js

MediumDynamic Requiredist/constants.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.devcontainer/post-create.sh

MediumStructural Risk Force Deep Review

MediumSecret PatternCHANGELOG.md

MediumSecret Patterndist/analyzers/tools/grep-secrets.js

MediumSecret Patterndist/analyzers/tools/gitleaks.js

MediumSecret Patterndist/analyzers/security/benign.js

MediumSecret Patterndist/analyzers/security/benign.d.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/analyzers/health/actions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings