registry / aidevops / 3.31.42

aidevops@3.31.42

AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 47 file(s), 440 KB of source, external domains: 127.0.0.1, about.gitea.com, aidevops.sh, alternativeto.net, apps.apple.com, bitwarden.com, brave.com, brew.sh, bun.sh, cursor.com, element.io, f-droid.org, fontba.se, forgejo.org, ghost.org, github.com, gitlab.com, itunes.apple.com, localwp.com, matomo.org, mobileapp.bitwarden.com, nextcloud.com, nodejs.org, obsproject.com, ollama.com, opencode.ai, openpanel.dev, orbstack.dev, osaurus.ai, play.google.com, posthog.com, postiz.com, privatebin.info, qlty.sh, raw.githubusercontent.com, rybbit.com, schildi.chat, seoutils.app, shottr.cc, signal.org, simplex.chat, telegram.org, usefathom.com, wordpress.org, www.affinity.studio, www.apple.com, www.blackmagicdesign.com, www.cloudron.io, www.collaboraonline.com, www.cometly.com

Source & flagged code

6 flagged

package.jsonView file

Lines 21-61json

21 "dspy:build": "dspyground build",

22 "install:python": "python3 -m venv python-env/dspy-env && source python-env/dspy-env/bin/activate && pip install -r requirements.txt",

23 "setup": "bun install && npm run install:python",

24 "setup:bun": "bun install",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "gui:api:dev": "bun run packages/gui-api/src/server.ts",

28 "gui:web:dev": "bun ./node_modules/vite/bin/vite.js --config packages/gui-web/vite.config.ts --host 127.0.0.1 --port 5173",

29 "gui:test:schema": "bun test packages/gui-shared/tests",

30 "gui:test:adapters": "bun test packages/gui-api/tests/*adapter.test.ts",

31 "gui:test:api": "bun test packages/gui-api/tests/status-route.test.ts",

32 "gui:test:components": "bun test packages/gui-web/tests",

33 "gui:test:security": "bun test packages/gui-shared/tests/security.test.ts packages/gui-api/tests/security.test.ts packages/gui-web/tests/security.test.ts",

34 "gui:test:smoke": "bun test packages/gui-api/tests/smoke.test.ts",

35 "gui:lint": "bun test packages/gui-web/tests/security.test.ts packages/gui-shared/tests/security.test.ts packages/gui-api/tests/security.test.ts",

36 "gui:typecheck": "tsc --noEmit",

37 "gui:build": "bun ./node_modules/vite/bin/vite.js build --config packages/gui-web/vite.config.ts",

38 "gui:ci": "npm run gui:lint && npm run gui:typecheck && npm run gui:test:schema && npm run gui:test:adapters && npm run gui:test:api && npm run gui:test:components && npm run gui:test:security && npm run gui:test:smoke && npm run gui:build",

39 "gui:desktop:check": "bash packages/gui-desktop/scripts/install-macos-app.sh --check",

40 "gui:desktop:install:macos": "bash packages/gui-desktop/scripts/install-macos-app.sh",

41 "postinstall": "node scripts/npm-postinstall.cjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "keywords": [

44 "ai",

45 "devops",

46 "cli",

47 "automation",

48 "code-quality",

49 "git-workflow",

50 "mcp",

51 "llm",

52 "dspy",

53 "prompt-optimization",

54 "ai-agents"

55 ],

56 "author": "Marcus Quinn <marcus@aidevops.sh>",

57 "license": "MIT",

58 "dependencies": {

59 "@vitejs/plugin-react": "^5.0.0",

60 "elysia": "^1.1.0",

61 "hono": "^4.6.0",

packages/gui-shared/src/fixtures.tsView file

Lines 459-484typescript

459 path_ref: "~/.aidevops/agents/AGENTS.md",

460 relative_path: "AGENTS.md",

461 extension: ".md",

462 preview_allowed: true,

463 },

464 ],

465 selected_preview: {

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 72383 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

packages/gui-shared/src/contracts.tsView file

Lines 752-792typescript

752 },

753 {

754 id: "git",

755 label: "Git",

756 path_ref: "~/Git",

757 description: "Local git workspace roots and worktrees.",

758 preview_policy: "metadata_only"

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm[redacted] || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/npm[redacted] || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/gui-shared/src/fixtures.tsView file

479patternName = private_key_rsa severity = critical line = 479 matchedText = private_...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

packages/gui-shared/src/fixtures.tsView on unpkg · L479

479patternName = private_key_rsa severity = critical line = 479 matchedText = private_...--",

Critical

Secret Pattern

RSA private key in packages/gui-shared/src/fixtures.ts

packages/gui-shared/src/fixtures.tsView on unpkg · L479

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 72383 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

packages/gui-shared/src/contracts.tsView file

772patternName = private_key_rsa severity = critical line = 772 matchedText = "-----BE...--",

Critical

Secret Pattern

RSA private key in packages/gui-shared/src/contracts.ts

packages/gui-shared/src/contracts.tsView on unpkg · L772

Findings

3 Critical1 High6 Medium4 Low

CriticalCritical Secretpackages/gui-shared/src/fixtures.ts

CriticalSecret Patternpackages/gui-shared/src/fixtures.ts

CriticalSecret Patternpackages/gui-shared/src/contracts.ts

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersetup.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 21-61json

21 "dspy:build": "dspyground build",

22 "install:python": "python3 -m venv python-env/dspy-env && source python-env/dspy-env/bin/activate && pip install -r requirements.txt",

23 "setup": "bun install && npm run install:python",

24 "setup:bun": "bun install",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "gui:api:dev": "bun run packages/gui-api/src/server.ts",

28 "gui:web:dev": "bun ./node_modules/vite/bin/vite.js --config packages/gui-web/vite.config.ts --host 127.0.0.1 --port 5173",

29 "gui:test:schema": "bun test packages/gui-shared/tests",

30 "gui:test:adapters": "bun test packages/gui-api/tests/*adapter.test.ts",

31 "gui:test:api": "bun test packages/gui-api/tests/status-route.test.ts",

32 "gui:test:components": "bun test packages/gui-web/tests",

33 "gui:test:security": "bun test packages/gui-shared/tests/security.test.ts packages/gui-api/tests/security.test.ts packages/gui-web/tests/security.test.ts",

34 "gui:test:smoke": "bun test packages/gui-api/tests/smoke.test.ts",

35 "gui:lint": "bun test packages/gui-web/tests/security.test.ts packages/gui-shared/tests/security.test.ts packages/gui-api/tests/security.test.ts",

36 "gui:typecheck": "tsc --noEmit",

37 "gui:build": "bun ./node_modules/vite/bin/vite.js build --config packages/gui-web/vite.config.ts",

39 "gui:desktop:check": "bash packages/gui-desktop/scripts/install-macos-app.sh --check",

40 "gui:desktop:install:macos": "bash packages/gui-desktop/scripts/install-macos-app.sh",

41 "postinstall": "node scripts/npm-postinstall.cjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "keywords": [

44 "ai",

45 "devops",

46 "cli",

47 "automation",

48 "code-quality",

49 "git-workflow",

50 "mcp",

51 "llm",

52 "dspy",

53 "prompt-optimization",

54 "ai-agents"

55 ],

56 "author": "Marcus Quinn <marcus@aidevops.sh>",

57 "license": "MIT",

58 "dependencies": {

59 "@vitejs/plugin-react": "^5.0.0",

60 "elysia": "^1.1.0",

61 "hono": "^4.6.0",

packages/gui-shared/src/fixtures.tsView file

Lines 459-484typescript

459 path_ref: "~/.aidevops/agents/AGENTS.md",

460 relative_path: "AGENTS.md",

461 extension: ".md",

462 preview_allowed: true,

463 },

464 ],

465 selected_preview: {

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 72383 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

packages/gui-shared/src/contracts.tsView file

Lines 752-792typescript

752 },

753 {

754 id: "git",

755 label: "Git",

756 path_ref: "~/Git",

757 description: "Local git workspace roots and worktrees.",

758 preview_policy: "metadata_only"