registry / @vyuhlabs/dxkit / 4.1.0

@vyuhlabs/dxkit@4.1.0

The change-safety layer for AI coding agents: structural context before the edit, and a deterministic stop-gate that blocks net-new detector-backed regressions before the loop can finish. No model in the verdict.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 405 file(s), 4.48 MB of source, external domains: adoptium.net, api.adoptium.net, api.first.org, api.osv.dev, api.snyk.io, cli.github.com, developer.apple.com, dl.static-php.dev, dot.net, download.swift.org, github.com, go.dev, gradle.org, json.schemastore.org, maven.apache.org, nodejs.org, osv.dev, raw.githubusercontent.com, registry.npmjs.org, rustsec.org, rustup.rs, sh.rustup.rs, snyk.io, sonarcloud.io, www.cisa.gov, www.conventionalcommits.org, www.npmjs.com, www.php.net, www.python.org, www.ruby-lang.org, www.swift.org

Source & flagged code

13 flagged

CHANGELOG.mdView file

Lines 1753-1793markdown

1753## [2.29.0] - 2026-07-05

1754

1755### Flow — catch-all routes and base-URL-helper calls now resolve

1756

1757A client call to a route served by a **catch-all** (`app/api/[...slug]/route.ts`,

1758Express `/api/*`, Spring `/api/**`, Rails `*path`, FastAPI `{p:path}`) used to

1759show as unresolved, because the join matched only exact paths. Catch-all routes

1760now normalize to a distinct `/{prefix}/{*}` marker and the join **prefix-matches**

1761concrete calls against them — so a `POST /api/form-submissions` binds the

1762Payload catch-all it actually hits. An exact literal route still wins over a

1763covering catch-all, and the longest matching prefix wins among catch-alls. A new

1764cross-framework matching corpus (`test/flow-matching-corpus.test.ts`) pins the

1765behavior so future language packs inherit it.

1766

1767### Fixed — fewer security false positives on template repos

1768

1769- **`.env.example` / `.env.template` / `.env.sample` are no longer counted as

1770 committed secrets** — those are intentional conventions; a real `.env` /

1771 `.env.production` still counts.

1772- **Obvious placeholder secret values are dropped**, not flagged:

1773 `password: 'password'`, `apiKey = 'your-api-key'`, `<your-key>`, `${VAR}`,

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L1773

1774 repeated-character runs. The heuristics are deliberately narrow to never

1775 suppress a real credential. Both live in one benign-conventions module every

1776 secret / env detector consults.

1777- **Install hints and the tool descriptor now match your package manager.** A

1778 `loop doctor` fix hint and the `tools list` install command render as `pnpm

1779 add -D` / `yarn add -D` / `bun add -d` on those repos instead of always `npm

1780 install --save-dev` (the executed install was already PM-aware).

1781

1782### Docs

1783

1784- README quickstart notes the pnpm `minimumReleaseAge` step for a fresh release.

1785

1786## [2.28.0] - 2026-07-05

1787

1788### Added — file-convention route detection (Next.js App Router & friends)

1789

1790The flow feature's served side now understands routes served by a handler

1791file's **location** on disk, not just in-source decorators (`@get`) and router

1792calls (`app.get`). A Next.js App Router repo previously reported "0 routes" —

1793every client call showed as unresolved — because `app/**/route.ts` handlers are

Lines 5575-5615markdown

5575 D005 C# vulnerabilities defect: parser written against synthetic

5576 output, never validated against real tool output. Fixed by

5577 matching the canonical `\): error \w+:` regex. Caught by adding

5578 the C# row to the new lint matrix; the row failed because the

5579 parser returned 0 despite exit code != 0 and visible violations

5580 in the output. (`src/languages/csharp.ts`, **D016**)

5581

5582### Added

5583

5584-

dist/analyzers/health/actions.jsView file

Lines 212-252javascript

212 id: 'health.security.remove-private-keys',

213 title: `Remove ${m.privateKeyFiles} private key file${m.privateKeyFiles === 1 ? '' :

dist/anchor-ruleset.jsView file

Lines 7-47javascript

7 * Deletion protection for dxkit's anchor side branches — the PREVENT layer of

8 * the deleted-anchor class (doctor DETECTS a missing anchor branch;

9 * `

templates/.devcontainer/post-create.shView file

•path = templates/.devcontainer/post-create.sh kind = payload_in_excluded_dir sizeBytes = 4491 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.devcontainer/post-create.shView on unpkg

•path = templates/.devcontainer/post-create.sh kind = build_helper sizeBytes = 4491 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.devcontainer/post-create.shView on unpkg

dist/analyzers/tools/tool-registry.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vyuhlabs/dxkit@4.0.4 matchedIdentity = npm:QHZ5dWhsYWJzL2R4a2l0:4.0.4 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/analyzers/tools/tool-registry.jsView on unpkg

dist/analyzers/tools/grep-secrets.jsView file

Lines 115-166javascript

115 // in a test still surfaces (a real fixture is allowlisted as

116 // `test-fixture`, not silently ignored).

117 const files = (0, walk_source_files_1.walkSourceFiles)(cwd, { includeTests: true, includeAutogen: true });

118 // Per-occurrence secret identity is (canonicalRule, file, ordinal),

119

dist/analyzers/tools/gitleaks.jsView file

Lines 149-189javascript

149 schemaVersion: 1,

150 tool: 'gitleaks',

151 findings: [],

152 suppressedCount: 0,

153 };

154

dist/analyzers/security/benign.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.js

dist/analyzers/security/benign.jsView on unpkg · L10

dist/analyzers/security/benign.d.tsView file

9patternName = generic_password severity = medium line = 9 matchedText = * leaked...ey =

Medium

Secret Pattern

Hardcoded password in dist/analyzers/security/benign.d.ts

dist/analyzers/security/benign.d.tsView on unpkg · L9

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code