Loading npm security reports…

@vyuhlabs/dxkit@4.0.1: Suspicious npm security report (Warn) | LPM Firewall

registry / @vyuhlabs/dxkit / 4.0.1

@vyuhlabs/dxkit@4.0.1

The change-safety layer for AI coding agents: structural context before the edit, and a deterministic stop-gate that blocks net-new detector-backed regressions before the loop can finish. No model in the verdict.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 394 file(s), 4.33 MB of source, external domains: adoptium.net, api.adoptium.net, api.first.org, api.osv.dev, api.snyk.io, cli.github.com, dot.net, github.com, go.dev, gradle.org, json.schemastore.org, maven.apache.org, nodejs.org, osv.dev, raw.githubusercontent.com, registry.npmjs.org, rustsec.org, rustup.rs, sh.rustup.rs, snyk.io, sonarcloud.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com, www.python.org, www.ruby-lang.org

Source & flagged code

12 flagged

CHANGELOG.mdView file

Lines 1494-1534markdown

1494## [2.29.0] - 2026-07-05

1495

1496### Flow — catch-all routes and base-URL-helper calls now resolve

1497

1498A client call to a route served by a **catch-all** (`app/api/[...slug]/route.ts`,

1499Express `/api/*`, Spring `/api/**`, Rails `*path`, FastAPI `{p:path}`) used to

1500show as unresolved, because the join matched only exact paths. Catch-all routes

1501now normalize to a distinct `/{prefix}/{*}` marker and the join **prefix-matches**

1502concrete calls against them — so a `POST /api/form-submissions` binds the

1503Payload catch-all it actually hits. An exact literal route still wins over a

1504covering catch-all, and the longest matching prefix wins among catch-alls. A new

1505cross-framework matching corpus (`test/flow-matching-corpus.test.ts`) pins the

1506behavior so future language packs inherit it.

1507

1508### Fixed — fewer security false positives on template repos

1509

1510- **`.env.example` / `.env.template` / `.env.sample` are no longer counted as

1511 committed secrets** — those are intentional conventions; a real `.env` /

1512 `.env.production` still counts.

1513- **Obvious placeholder secret values are dropped**, not flagged:

1514 `password: 'password'`, `apiKey = 'your-api-key'`, `<your-key>`, `${VAR}`,

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L1514

1515 repeated-character runs. The heuristics are deliberately narrow to never

1516 suppress a real credential. Both live in one benign-conventions module every

1517 secret / env detector consults.

1518- **Install hints and the tool descriptor now match your package manager.** A

1519 `loop doctor` fix hint and the `tools list` install command render as `pnpm

1520 add -D` / `yarn add -D` / `bun add -d` on those repos instead of always `npm

1521 install --save-dev` (the executed install was already PM-aware).

1522

1523### Docs

1524

1525- README quickstart notes the pnpm `minimumReleaseAge` step for a fresh release.

1526

1527## [2.28.0] - 2026-07-05

1528

1529### Added — file-convention route detection (Next.js App Router & friends)

1530

1531The flow feature's served side now understands routes served by a handler

1532file's **location** on disk, not just in-source decorators (`@get`) and router

1533calls (`app.get`). A Next.js App Router repo previously reported "0 routes" —

1534every client call showed as unresolved — because `app/**/route.ts` handlers are

Lines 5316-5356markdown

5316 D005 C# vulnerabilities defect: parser written against synthetic

5317 output, never validated against real tool output. Fixed by

5318 matching the canonical `\): error \w+:` regex. Caught by adding

5319 the C# row to the new lint matrix; the row failed because the

5320 parser returned 0 despite exit code != 0 and visible violations

5321 in the output. (`src/languages/csharp.ts`, **D016**)

5322

5323### Added

5324

5325-

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' :

dist/anchor-ruleset.jsView file

Lines 7-47javascript

7 * Deletion protection for dxkit's anchor side branches — the PREVENT layer of

8 * the deleted-anchor class (doctor DETECTS a missing anchor branch;

9 * `

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 115-166javascript

115 // in a test still surfaces (a real fixture is allowlisted as

116 // `test-fixture`, not silently ignored).

117 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

118 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

119

dist/analyzers/tools/gitleaks.jsView file

Lines 149-189javascript

149 schemaVersion: 1,

150 tool: 'gitleaks',

151 findings: [],

152 suppressedCount: 0,

153 };

154

dist/analyzers/security/benign.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.js

dist/analyzers/security/benign.jsView on unpkg · L10

dist/analyzers/security/benign.d.tsView file

9patternName = generic_password severity = medium line = 9 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.d.ts

dist/analyzers/security/benign.d.tsView on unpkg · L9

Source & flagged code