registry / @wrongstack/core / 0.286.0

@wrongstack/core@0.286.0

WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 5.05 MB of source, external domains: 127.0.0.1, api.github.com, api.minimax.io, json-schema.org, mcp.context7.com, mcp.sentinel.ai, models.dev, skills.sh, wrongstack.dev

Source & flagged code

3 flagged

dist/coordination/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wrongstack/core@0.285.0 matchedIdentity = npm:QHdyb25nc3RhY2svY29yZQ:0.285.0 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coordination/index.jsView on unpkg

skills/security-scanner/SKILL.mdView file

Lines 28-68markdown

28### Do

30```typescript

31// ✅ SAFE — parameterized query

32db.query("SELECT * FROM users WHERE id = $1", [userId]);

34// ✅ SAFE — escape user input

35element.textContent = userInput;

37// ✅ SAFE — execFile with args array

38execFile('find', ['.', '-name', userInput], { signal: AbortSignal.timeout(5000) });

39```

41### Don't

43```typescript

44// ❌ CRITICAL — hardcoded AWS credentials

45const awsKey = "[REDACTED:aws_access_key]";

47// ❌ CRITICAL — private key committed

48const pem = "-----BEGIN RSA PRIVATE KEY-----\nMIIE...";

Critical

Secret Pattern

RSA private key in skills/security-scanner/SKILL.md

skills/security-scanner/SKILL.mdView on unpkg · L48

50// ❌ HIGH — XSS via innerHTML

51element.innerHTML = userInput;

53// ❌ HIGH — shell injection

54exec(`find . -name ${userInput}`);

56// ❌ HIGH — SQL injection

57const query = "SELECT * FROM users WHERE id = " + userId;

58```

60## Workflow

62```

631. Scope: Accept paths or use sensible defaults

642. Secrets: Regex scan for credential patterns

653. Injection: Pattern match dangerous constructs

664. Config: Check TLS, crypto, auth configurations

675. Audit: Run package audit

686. Report: Prioritized markdown with remediation

Lines 81-121markdown

82```

83| Pattern | Example | Level |

84|---------|---------|-------|

85| GitHub token | `ghp_[a-zA-Z0-9]{36}` | CRITICAL |

86| AWS Access Key | `[A-Z0-9]{20}` | CRITICAL |

87| AWS Secret | base64 40-char | CRITICAL |

88| Private Key PEM | `-----BEGIN.*PRIVATE KEY-----` | CRITICAL |

89| JWT | `eyJ[a-zA-Z0-9_-]+` | HIGH |

90| Generic API Key | 32+ random chars | MEDIUM |

91| Bearer token | `Authorization: Bearer xxx` | HIGH |

92```

Source & flagged code

3 flagged · loading source

dist/coordination/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code