registry / atlasbound / 0.17.0

atlasbound@0.17.0

AtlasBound , AI agents, bound to your codebase. Local-first closed-world code intelligence for AI coding agents (extract -> gate -> serve). Zero runtime dependencies.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 100 file(s), 484 KB of source, external domains: registry.npmjs.org, zftcplzrrajxuhdqyhlb.supabase.co

Source & flagged code

5 flagged

engine/lib/cloud.cjsView file

Lines 1-2javascript

1"use strict";const CLOUD_URL="https://zftcplzrrajxuhdqyhlb.supabase.co",CLOUD_ANON="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InpmdGNwbHpycmFqeHVoZHF5aGxiIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODM4MTIwNzcsImV4cCI6MjA5OTM4ODA3N30.97C2giQhQTeBuTnxGHvpMNTW1ntuPzjKAm2WuCBZZig";function cloudUrl(env){const v=(env||process.env).ATLASBOUND_CLOUD_URL;return v&&String(v).trim()||CLOUD_URL}function cloudAnon(env){const v=(env||process.env).ATLASBOUND_CLOUD_ANON;return v&&String(v).trim()||CLOUD_ANON}module.exports={cloudUrl,cloudAnon};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

engine/lib/cloud.cjsView on unpkg · L1

Critical

Secret Pattern

Supabase service role key (JWT) in engine/lib/cloud.cjs

engine/lib/cloud.cjsView on unpkg · L1

packs/ts-supabase/lib/ts.cjsView file

Lines 1-2javascript

1"use strict";const fs=require("fs"),path=require("path"),_cache={product:void 0,byTarget:new Map};function tsFor(

intake/resume/active.cjsView file

Lines 1-3javascript

1#!/usr/bin/env node

2"use strict";const fs=require("fs"),path=require("path"),crypto=require("crypto"),{execSync,execFileSync}

engine/lib/update-check.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = atlasbound@0.14.0 matchedIdentity = npm:YXRsYXNib3VuZA:0.14.0 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

engine/lib/update-check.cjsView on unpkg

Source & flagged code

5 flagged · loading source

engine/lib/cloud.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code