registry / caspian-security / 10.7.3

caspian-security@10.7.3

Security scanner for VS Code AND a standalone `caspian` CLI you can run anywhere (PowerShell/cmd/bash, no VS Code needed) — 295+ rules covering code and infrastructure (Dockerfile, Terraform, Kubernetes), intra-file taint tracking, SSRF/XXE/SSTI/deseriali

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 832 KB of source, external domains: aistudio.google.com, apache.org, console.anthropic.com, marketplace.visualstudio.com, osv.dev, platform.openai.com, raw.githubusercontent.com, telemetry.caspiansecurity.dev, www.w3.org, xml.org

Source & flagged code

8 flagged

out/rules/secretsRules.jsView file

Lines 22-62javascript

22 },

23 {

24 code: 'CRED002',

25 message: 'AWS access key pattern detected',

26 severity: types_1.SecuritySeverity.Error,

27 patterns: [

28 /AKIA[0-9A-Z]{16}/,

29 /aws_access_key_id\s*[:=]\s*['"][^'"]+['"]/i,

30 /aws_secret_access_key\s*[:=]\s*['"][^'"]+['"]/i,

31 ],

32 suggestion: 'Use IAM roles, AWS Secrets Manager, or environment variables instead of hardcoded AWS keys',

33 category: types_1.SecurityCategory.SecretsCredentials,

34 ruleType: types_1.RuleType.CodeDetectable,

35 },

36 {

37 code: 'CRED003',

38 message: 'Private key content detected in source code',

39 severity: types_1.SecuritySeverity.Error,

40 patterns: [

41 /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/,

42 /-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/rules/secretsRules.jsView on unpkg · L42

Critical

Secret Pattern

OpenSSH private key in out/rules/secretsRules.js

out/rules/secretsRules.jsView on unpkg · L42

43 ],

44 suggestion: 'Never embed private keys in source code; load from secure file system or secrets manager',

45 category: types_1.SecurityCategory.SecretsCredentials,

46 ruleType: types_1.RuleType.CodeDetectable,

47 },

48 {

49 code: 'CRED004',

50 message: 'GitHub/GitLab personal access token pattern',

51 severity: types_1.SecuritySeverity.Error,

52 patterns: [

53 /gh[pousr]_[A-Za-z0-9_]{36,}/,

54 /glpat-[A-Za-z0-9\-_]{20,}/,

55 ],

56 suggestion: 'Revoke leaked tokens immediately and use environment variables for access tokens',

57 category: types_1.SecurityCategory.SecretsCredentials,

58 ruleType: types_1.RuleType.CodeDetectable,

59 },

60 {

61 code: 'CRED005',

62 message: 'Generic high-entropy secret in string literal',

out/rules/frontendRules.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.frontendRules = void 0;

4const types_1 = require("../types");

5exports.frontendRules = [

out/rules/ssrfRules.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.ssrfRules = void 0;

4const types_1 = require("../types");

5/**

6 * Server-Side Request Forgery (SSRF) detection.

CHANGELOG.mdView file

Lines 748-788markdown

748- **XSS004** (dangerouslySetInnerHTML) -- now suppresses when `JSON.stringify`, `DOMPurify`, or sanitization functions are present on the same line or nearby; also suppresses near `application/ld+json` script tags

749

750### Fixed

751

752- DB011 false positive on empty password variable initialization in password generation functions

753- LOG005 false positive on instruction strings containing the word "password"

754- ENC010 false positive on PII already wrapped in masking functions like `maskEmail()`

755-

out/fixPatternMemory.jsView file

Lines 143-183javascript

143 clearAll() {

144 this.data = { version: 1, patterns: [] };

145 this.save();

146 }

147 exportData() {

148 return JSON.parse(JSON.stringify

out/__tests__/rules.test.jsView file

Lines 95-135javascript

95 }

96 }

97 });

98});

99describe('Rule Pattern Matching', () => {

100 // Test a representative sample of rules with known vulnerable and safe code

101 describe('AUTH001 - Hardcoded JWT secret', () => {

102 const rule

README.mdView file

Lines 267-307markdown

267

2681. **The complete enclosing function** via VS Code's symbol provider

2692. **Variable definitions** traced from the vulnerable line

2703. The full file content

271

272### Settings

273

274- `caspianSecurity.aiFixRequireConsent` — show the per-invocation consent dialog (default `true`).

275- `caspianSecurity.aiFixMinimalContext`

Source & flagged code

8 flagged · loading source

out/rules/secretsRules.jsView file

42patternName = private_key_openssh severity = critical line = 42 matchedText = /-----BE...--/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/rules/secretsRules.jsView on unpkg · L42

42patternName = private_key_openssh severity = critical line = 42 matchedText = /-----BE...--/,

Critical

Secret Pattern

OpenSSH private key in out/rules/secretsRules.js

out/rules/secretsRules.jsView on unpkg · L42

out/rules/frontendRules.jsView file

7code: 'FE001', L8: message: 'Unsafe eval() usage allows arbitrary code execution', L9: severity: types_1.SecuritySeverity.Error,

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/rules/frontendRules.jsView on unpkg · L7

out/rules/ssrfRules.jsView file

13* Detection strategy: L14: * - Match each language's idiomatic HTTP sinks (fetch / axios / requests / L15: * httpx / RestTemplate / HttpClient / URLConnection / curl_exec / etc.). ... L41: const suggestion = 'Validate this URL against an explicit host allow-list BEFORE the request. ' + L42: 'Reject private IPs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7), ' + L43: 'metadata endpoints (169.254.169.254, metadata.google.internal), and non-HTTPS schemes.';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/rules/ssrfRules.jsView on unpkg · L13

CHANGELOG.mdView file

768patternName = generic_password severity = medium line = 768 matchedText = - **Crit...D"`)

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L768

out/fixPatternMemory.jsView file

163patternName = generic_password severity = medium line = 163 matchedText = * Exampl...ING`

Medium

Secret Pattern

Hardcoded password in out/fixPatternMemory.js

out/fixPatternMemory.jsView on unpkg · L163

out/__tests__/rules.test.jsView file

115patternName = generic_password severity = medium line = 115 matchedText = const li...";`;

Medium

Secret Pattern

Hardcoded password in out/__tests__/rules.test.js

out/__tests__/rules.test.jsView on unpkg · L115

README.mdView file

287patternName = generic_password severity = medium line = 287 matchedText = | Critic..."` |

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L287

Findings

2 Critical1 High7 Medium5 Low

CriticalCritical Secretout/rules/secretsRules.js

CriticalSecret Patternout/rules/secretsRules.js

HighCloud Metadata Accessout/rules/ssrfRules.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternCHANGELOG.md

MediumSecret Patternout/fixPatternMemory.js

MediumSecret Patternout/__tests__/rules.test.js

MediumSecret PatternREADME.md

LowScripts Present

LowEvalout/rules/frontendRules.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

out/rules/secretsRules.jsView file

Lines 22-62javascript

22 },

23 {

24 code: 'CRED002',

25 message: 'AWS access key pattern detected',

26 severity: types_1.SecuritySeverity.Error,

27 patterns: [

28 /AKIA[0-9A-Z]{16}/,

29 /aws_access_key_id\s*[:=]\s*['"][^'"]+['"]/i,

30 /aws_secret_access_key\s*[:=]\s*['"][^'"]+['"]/i,

31 ],

32 suggestion: 'Use IAM roles, AWS Secrets Manager, or environment variables instead of hardcoded AWS keys',

33 category: types_1.SecurityCategory.SecretsCredentials,

34 ruleType: types_1.RuleType.CodeDetectable,

35 },

36 {

37 code: 'CRED003',

38 message: 'Private key content detected in source code',

39 severity: types_1.SecuritySeverity.Error,

40 patterns: [

41 /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/,

42 /-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

out/rules/secretsRules.jsView on unpkg · L42

Critical

Secret Pattern

OpenSSH private key in out/rules/secretsRules.js

out/rules/secretsRules.jsView on unpkg · L42

43 ],

44 suggestion: 'Never embed private keys in source code; load from secure file system or secrets manager',

45 category: types_1.SecurityCategory.SecretsCredentials,

46 ruleType: types_1.RuleType.CodeDetectable,

47 },

48 {

49 code: 'CRED004',

50 message: 'GitHub/GitLab personal access token pattern',

51 severity: types_1.SecuritySeverity.Error,

52 patterns: [

53 /gh[pousr]_[A-Za-z0-9_]{36,}/,

54 /glpat-[A-Za-z0-9\-_]{20,}/,

55 ],

56 suggestion: 'Revoke leaked tokens immediately and use environment variables for access tokens',

57 category: types_1.SecurityCategory.SecretsCredentials,

58 ruleType: types_1.RuleType.CodeDetectable,

59 },

60 {

61 code: 'CRED005',

62 message: 'Generic high-entropy secret in string literal',

out/rules/frontendRules.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.frontendRules = void 0;

4const types_1 = require("../types");

5exports.frontendRules = [

out/rules/ssrfRules.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.ssrfRules = void 0;

4const types_1 = require("../types");

5/**

6 * Server-Side Request Forgery (SSRF) detection.

CHANGELOG.mdView file

Lines 748-788markdown

749

750### Fixed

751

752- DB011 false positive on empty password variable initialization in password generation functions

753- LOG005 false positive on instruction strings containing the word "password"

754- ENC010 false positive on PII already wrapped in masking functions like `maskEmail()`

755-

out/fixPatternMemory.jsView file

Lines 143-183javascript

143 clearAll() {

144 this.data = { version: 1, patterns: [] };

145 this.save();

146 }

147 exportData() {

148 return JSON.parse(JSON.stringify

out/__tests__/rules.test.jsView file

Lines 95-135javascript

95 }

96 }

97 });

98});

99describe('Rule Pattern Matching', () => {

100 // Test a representative sample of rules with known vulnerable and safe code

101 describe('AUTH001 - Hardcoded JWT secret', () => {

102 const rule

README.mdView file

Lines 267-307markdown

267

2681. **The complete enclosing function** via VS Code's symbol provider

2692. **Variable definitions** traced from the vulnerable line

2703. The full file content

271

272### Settings

273

274- `caspianSecurity.aiFixRequireConsent` — show the per-invocation consent dialog (default `true`).

275- `caspianSecurity.aiFixMinimalContext`