registry / circle-ir-ai / 2.28.2

circle-ir-ai@2.28.2

LLM-enhanced SAST analysis built on circle-ir

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 164 file(s), 1.60 MB of source, external domains: apache.org, api.internal.com, api.npmjs.org, api.osv.dev, cwe.mitre.org, github.com, openvex.dev, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

7 flagged

dist/secret-scan/patterns.jsView file

Lines 209-267javascript

209 },

210 {

211 id: 'database-password',

212 name: 'Database Password',

213 description: 'Database password in configuration',

214 pattern: /(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)['":\s=]+['"]?([^\s'"]{8,})['"]?/gi,

215 severity: 'critical',

216 category: 'database',

217 keywords: ['password', 'db', 'database', 'mysql', 'postgres'],

218 falsePositivePatterns: [/\$\{/, /%\(/, /example/i, /changeme/i],

219 },

220];

221/**

222 * Private Key Patterns

223 */

224const privateKeyPatterns = [

225 {

226 id: 'rsa-private-key',

227 name: 'RSA Private Key',

228 description: 'RSA private key',

229 pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

230 severity: 'critical',

231 category: 'private-key',

232 keywords: ['BEGIN RSA PRIVATE KEY'],

233 },

234 {

235 id: 'openssh-private-key',

236 name: 'OpenSSH Private Key',

237 description: 'OpenSSH private key',

238 pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

239 severity: 'critical',

240 category: 'private-key',

241 keywords: ['BEGIN OPENSSH PRIVATE KEY'],

242 },

243 {

244 id: 'ec-private-key',

245 name: 'EC Private Key',

246 description: 'Elliptic curve private key',

247 pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

248 severity: 'critical',

249 category: 'private-key',

250 keywords: ['BEGIN EC PRIVATE KEY'],

251 },

252 {

253 id: 'dsa-private-key',

254 name: 'DSA Private Key',

255 description: 'DSA private key',

256 pattern: /-----BEGIN DSA PRIVATE KEY-----[\s\S]*?-----END DSA PRIVATE KEY-----/g,

257 severity: 'critical',

258 category: 'private-key',

259 keywords: ['BEGIN DSA PRIVATE KEY'],

260 },

261 {

262 id: 'pgp-private-key',

263 name: 'PGP Private Key',

264 description: 'PGP private key block',

265 pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----/g,

266 severity: 'critical',

267 category: 'private-key',

dist/llm/language-context.jsView file

Lines 446-486javascript

446 - Process spawning, shell execution

447 - Script evaluation, macro execution

448 - ANY operation that interprets data as system commands

449 - KEY QUESTION: Can external data influence what command runs?

450 - SAFE: Fixed commands

dist/cache/tree-cache.jsView file

Lines 36-76javascript

36 * **Env toggles:**

37 * LLM_TREE_CACHE=0 → disable persistent tree cache.

38 */

39import * as crypto from 'crypto';

40import * as fs

dist/llm/discovery.jsView file

Lines 191-231javascript

191 results.push({

192 methodId: `${method.className}.${method.methodName}`,

193 vulnerabilityFound: false,

194 reasoning: `Discovery failed: ${error}`,

195 confidence: 0,

196 discoveryTimeMs: Date.now

Source & flagged code

7 flagged · loading source

dist/secret-scan/patterns.jsView file

229patternName = private_key_rsa severity = critical line = 229 matchedText = pattern:...-/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

229patternName = private_key_rsa severity = critical line = 229 matchedText = pattern:...-/g,

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

238patternName = private_key_openssh severity = critical line = 238 matchedText = pattern:...-/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

247patternName = private_key_ec severity = critical line = 247 matchedText = pattern:...-/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

dist/llm/language-context.jsView file

466**5. Code Evaluation** (CWE-94) - Operations that interpret data as code: L467: - Dynamic code execution, eval(), script engines L468: - Reflection with external class names

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/llm/language-context.jsView on unpkg · L466

dist/cache/tree-cache.jsView file

56try { L57: const require = createRequire(baseUrl); L58: return require(spec).version || 'unknown';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cache/tree-cache.jsView on unpkg · L56

dist/llm/discovery.jsView file

211// 2026-06-27 sweep (LLM-COST-SHARE-KEYCLOAK) becomes a free skip. L212: const persistentCacheEnabled = process.env.LLM_DISCOVERY_CACHE !== '0'; L213: let dCache = null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/llm/discovery.jsView on unpkg · L211

Findings

4 Critical4 Medium8 Low

CriticalCritical Secretdist/secret-scan/patterns.js

CriticalSecret Patterndist/secret-scan/patterns.js

MediumDynamic Requiredist/cache/tree-cache.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/llm/language-context.js

LowWeak Cryptodist/llm/discovery.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/secret-scan/patterns.jsView file

Lines 209-267javascript

209 },

210 {

211 id: 'database-password',

212 name: 'Database Password',

213 description: 'Database password in configuration',

214 pattern: /(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)['":\s=]+['"]?([^\s'"]{8,})['"]?/gi,

215 severity: 'critical',

216 category: 'database',

217 keywords: ['password', 'db', 'database', 'mysql', 'postgres'],

218 falsePositivePatterns: [/\$\{/, /%\(/, /example/i, /changeme/i],

219 },

220];

221/**

222 * Private Key Patterns

223 */

224const privateKeyPatterns = [

225 {

226 id: 'rsa-private-key',

227 name: 'RSA Private Key',

228 description: 'RSA private key',

229 pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

230 severity: 'critical',

231 category: 'private-key',

232 keywords: ['BEGIN RSA PRIVATE KEY'],

233 },

234 {

235 id: 'openssh-private-key',

236 name: 'OpenSSH Private Key',

237 description: 'OpenSSH private key',

238 pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

239 severity: 'critical',

240 category: 'private-key',

241 keywords: ['BEGIN OPENSSH PRIVATE KEY'],

242 },

243 {

244 id: 'ec-private-key',

245 name: 'EC Private Key',

246 description: 'Elliptic curve private key',

247 pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

248 severity: 'critical',

249 category: 'private-key',

250 keywords: ['BEGIN EC PRIVATE KEY'],

251 },

252 {

253 id: 'dsa-private-key',

254 name: 'DSA Private Key',

255 description: 'DSA private key',

256 pattern: /-----BEGIN DSA PRIVATE KEY-----[\s\S]*?-----END DSA PRIVATE KEY-----/g,

257 severity: 'critical',

258 category: 'private-key',

259 keywords: ['BEGIN DSA PRIVATE KEY'],

260 },

261 {

262 id: 'pgp-private-key',

263 name: 'PGP Private Key',

264 description: 'PGP private key block',

265 pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----/g,

266 severity: 'critical',

267 category: 'private-key',

dist/llm/language-context.jsView file

Lines 446-486javascript

446 - Process spawning, shell execution

447 - Script evaluation, macro execution

448 - ANY operation that interprets data as system commands

449 - KEY QUESTION: Can external data influence what command runs?

450 - SAFE: Fixed commands

dist/cache/tree-cache.jsView file

Lines 36-76javascript

36 * **Env toggles:**

37 * LLM_TREE_CACHE=0 → disable persistent tree cache.

38 */

39import * as crypto from 'crypto';

40import * as fs

dist/llm/discovery.jsView file

Lines 191-231javascript

191 results.push({

192 methodId: `${method.className}.${method.methodName}`,

193 vulnerabilityFound: false,

194 reasoning: `Discovery failed: ${error}`,

195 confidence: 0,

196 discoveryTimeMs: Date.now