registry / @windagency/valora / 3.0.7

@windagency/valora@3.0.7

VALORA - AI-assisted development workflow orchestration with agnostic multi-LLM support, session-based state, and Cursor MCP integration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 434 file(s), 2.81 MB of source, external domains: api.moonshot.ai, api.x.ai, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 112-152json

112 "eslint-plugin-perfectionist": "^4.15.1",

113 "eslint-plugin-prettier": "^5.5.4",

114 "eslint-plugin-sort": "^4.0.0",

115 "eslint-plugin-sort-destructure-keys": "^2.0.0",

116 "eslint-plugin-unused-imports": "^4.3.0",

117 "execa": "^9.6.1",

118 "husky": "^9.1.7",

119 "lint-staged": "^16.2.7",

120 "playwright": "^1.40.0",

121 "prettier": "^3.2.0",

122 "secretlint": "^13.0.2",

123 "ts-node": "^10.9.0",

124 "tsc-alias": "^1.8.16",

125 "tsx": "^4.21.0",

126 "typescript": "^5.3.3",

127 "vitest": "^1.0.0",

128 "@windagency/valora-plugin-api": "1.0.1",

129 "@windagency/valora-plugin-memory-vault": "1.0.1"

130 },

131 "scripts": {

132 "postinstall": "node scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L132

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L132

133 "clean": "pnpm \"/clean:/\"",

134 "clean:build": "rm -rf ./dist/* && rm -f tsconfig.tsbuildinfo && find src -name '*.js' -delete 2>/dev/null; true",

135 "clean:coverage": "rm -rf ./coverage",

136 "clear": "pnpm \"/clean:/\" && rm -rf ./node_modules",

137 "lint": "eslint --color",

138 "lint:fix": "eslint --color --fix",

139 "docs:validate": "tsx scripts/validate-docs.ts",

140 "maintenance:grade": "tsx scripts/maintenance-grade.ts",

141 "maintenance:gc": "tsx scripts/maintenance-gc.ts",

142 "maintenance:garden": "tsx scripts/maintenance-garden.ts",

143 "regression": "tsx scripts/run-regression-suite.ts",

144 "regression:capture": "tsx scripts/capture-regression-transcript.ts",

145 "beautify": "prettier --check \"**/*.+(js|jsx|ts|tsx|json|md|yml|yaml)\"",

146 "beautify:fix": "prettier --write \"**/*.+(js|jsx|ts|tsx|json|md|yml|yaml)\"",

147 "preformat": "pnpm packages:format",

148 "format": "pnpm beautify:fix && pnpm lint:fix",

149 "build:registry": "pnpm exec tsx scripts/generate-plugin-registry.ts",

150 "mcp:validate-types": "pnpm exec tsx scripts/generate-mcp-types.ts",

151 "mcp:fix-types": "pnpm exec tsx scripts/generate-mcp-types.ts --fix",

152 "mcp:test": "pnpm exec tsx scripts/test-mcp-integration.ts",

bin/mcp.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

3import { dirname, join } from 'path';

4import { fileURLToPath } from 'url';

6const __filename = fileURLToPath(import

dist/plugins/npm-registry-client.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2const DEFAULT_REGISTRY_BASE = 'https://registry.npmjs.org';

3const TIMEOUT_MS = 15000;

4const

dist/cli/autocomplete.jsView file

Lines 1-40javascript

1/**

2 * Shell Autocomplete Generator

3 *

4 * Generates completion scripts for bash, zsh, and fish shells

5 */

6import * as fs from 'fs/promises';

7import *

scripts/install-cli-tools.shView file

•path = scripts/install-cli-tools.sh kind = build_helper sizeBytes = 11255 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-cli-tools.shView on unpkg

data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.shView file

•path = data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.sh kind = payload_in_excluded_dir sizeBytes = 3980 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.shView on unpkg

data/prompts/04_code/implement-tests.mdView file

Lines 357-397markdown

357 await sendVerificationEmail(email);

358

359 // Assert

360 const token = await VerificationToken.findByEmail(email);

361 expect(token).toBeDefined();

362 expect(token.expiresAt).toBeGreaterThan(new Date());

363 });

364});

365```

366

367### Step 4: Write E2E Tests (When Applicable)

data/templates/plans/PATTERN_REACT_COMPONENT.mdView file

Lines 327-367markdown

327import userEvent from '@testing-library/user-event';

328import { axe } from 'vitest-axe';

329import { LoginForm } from './LoginForm';

330

331describe('LoginForm', () => {

332 it('should not have accessibility violations', async () => {

333 const { container } = render(<LoginForm onSubmit={jest.fn()} />);

334 expect(await axe(container)).toHaveNoViolations();

335 });

336

337 it('should submit form with valid credentials', async () => {

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code