registry / circle-ir-ai / 2.34.0

circle-ir-ai@2.34.0

LLM-enhanced SAST analysis built on circle-ir

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 168 file(s), 1.69 MB of source, external domains: apache.org, api.internal.com, api.npmjs.org, api.osv.dev, cwe.mitre.org, github.com, openvex.dev, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

8 flagged

dist/secret-scan/patterns.jsView file

Lines 209-267javascript

209 },

210 {

211 id: 'database-password',

212 name: 'Database Password',

213 description: 'Database password in configuration',

214 pattern: /(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)['":\s=]+['"]?([^\s'"]{8,})['"]?/gi,

215 severity: 'critical',

216 category: 'database',

217 keywords: ['password', 'db', 'database', 'mysql', 'postgres'],

218 falsePositivePatterns: [/\$\{/, /%\(/, /example/i, /changeme/i],

219 },

220];

221/**

222 * Private Key Patterns

223 */

224const privateKeyPatterns = [

225 {

226 id: 'rsa-private-key',

227 name: 'RSA Private Key',

228 description: 'RSA private key',

229 pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

230 severity: 'critical',

231 category: 'private-key',

232 keywords: ['BEGIN RSA PRIVATE KEY'],

233 },

234 {

235 id: 'openssh-private-key',

236 name: 'OpenSSH Private Key',

237 description: 'OpenSSH private key',

238 pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

239 severity: 'critical',

240 category: 'private-key',

241 keywords: ['BEGIN OPENSSH PRIVATE KEY'],

242 },

243 {

244 id: 'ec-private-key',

245 name: 'EC Private Key',

246 description: 'Elliptic curve private key',

247 pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

248 severity: 'critical',

249 category: 'private-key',

250 keywords: ['BEGIN EC PRIVATE KEY'],

251 },

252 {

253 id: 'dsa-private-key',

254 name: 'DSA Private Key',

255 description: 'DSA private key',

256 pattern: /-----BEGIN DSA PRIVATE KEY-----[\s\S]*?-----END DSA PRIVATE KEY-----/g,

257 severity: 'critical',

258 category: 'private-key',

259 keywords: ['BEGIN DSA PRIVATE KEY'],

260 },

261 {

262 id: 'pgp-private-key',

263 name: 'PGP Private Key',

264 description: 'PGP private key block',

265 pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----/g,

266 severity: 'critical',

267 category: 'private-key',

dist/llm/language-context.jsView file

Lines 446-486javascript

446 - Process spawning, shell execution

447 - Script evaluation, macro execution

448 - ANY operation that interprets data as system commands

449 - KEY QUESTION: Can external data influence what command runs?

450 - SAFE: Fixed commands

dist/cache/tree-cache.jsView file

Lines 36-76javascript

36 * **Env toggles:**

37 * LLM_TREE_CACHE=0 → disable persistent tree cache.

38 */

39import * as crypto from 'crypto';

40import * as fs

dist/llm/discovery.jsView file

Lines 222-262javascript

222 }

223 return results;

224 }

225 /**

226 * Analyze a single method for vulnerabilities

227 */

228 async analyzeMethod(method, targetCWEs, options, irSinks = [], language = 'java') {

229 const methodId =

dist/agents/mastra/workflow.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = circle-ir-ai@2.33.5 matchedIdentity = npm:Y2lyY2xlLWlyLWFp:2.33.5 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/mastra/workflow.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/secret-scan/patterns.jsView file

229patternName = private_key_rsa severity = critical line = 229 matchedText = pattern:...-/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

229patternName = private_key_rsa severity = critical line = 229 matchedText = pattern:...-/g,

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

238patternName = private_key_openssh severity = critical line = 238 matchedText = pattern:...-/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

247patternName = private_key_ec severity = critical line = 247 matchedText = pattern:...-/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

dist/llm/language-context.jsView file

466**5. Code Evaluation** (CWE-94) - Operations that interpret data as code: L467: - Dynamic code execution, eval(), script engines L468: - Reflection with external class names

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/llm/language-context.jsView on unpkg · L466

dist/cache/tree-cache.jsView file

56try { L57: const require = createRequire(baseUrl); L58: return require(spec).version || 'unknown';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cache/tree-cache.jsView on unpkg · L56

dist/llm/discovery.jsView file

242// free skip. L243: const persistentCacheEnabled = process.env.LLM_DISCOVERY_CACHE !== '0'; L244: let dCache = null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/llm/discovery.jsView on unpkg · L242

dist/agents/mastra/workflow.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/mastra/workflow.jsView on unpkg

Findings

4 Critical1 High4 Medium8 Low

CriticalCritical Secretdist/secret-scan/patterns.js

CriticalSecret Patterndist/secret-scan/patterns.js

HighPrevious Version Dangerous Deltadist/agents/mastra/workflow.js

MediumDynamic Requiredist/cache/tree-cache.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/llm/language-context.js

LowWeak Cryptodist/llm/discovery.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/secret-scan/patterns.jsView file

Lines 209-267javascript

209 },

210 {

211 id: 'database-password',

212 name: 'Database Password',

213 description: 'Database password in configuration',

214 pattern: /(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)['":\s=]+['"]?([^\s'"]{8,})['"]?/gi,

215 severity: 'critical',

216 category: 'database',

217 keywords: ['password', 'db', 'database', 'mysql', 'postgres'],

218 falsePositivePatterns: [/\$\{/, /%\(/, /example/i, /changeme/i],

219 },

220];

221/**

222 * Private Key Patterns

223 */

224const privateKeyPatterns = [

225 {

226 id: 'rsa-private-key',

227 name: 'RSA Private Key',

228 description: 'RSA private key',

229 pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/secret-scan/patterns.jsView on unpkg · L229

Critical

Secret Pattern

RSA private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L229

230 severity: 'critical',

231 category: 'private-key',

232 keywords: ['BEGIN RSA PRIVATE KEY'],

233 },

234 {

235 id: 'openssh-private-key',

236 name: 'OpenSSH Private Key',

237 description: 'OpenSSH private key',

238 pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,

Critical

Secret Pattern

OpenSSH private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L238

239 severity: 'critical',

240 category: 'private-key',

241 keywords: ['BEGIN OPENSSH PRIVATE KEY'],

242 },

243 {

244 id: 'ec-private-key',

245 name: 'EC Private Key',

246 description: 'Elliptic curve private key',

247 pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,

Critical

Secret Pattern

EC private key in dist/secret-scan/patterns.js

dist/secret-scan/patterns.jsView on unpkg · L247

248 severity: 'critical',

249 category: 'private-key',

250 keywords: ['BEGIN EC PRIVATE KEY'],

251 },

252 {

253 id: 'dsa-private-key',

254 name: 'DSA Private Key',

255 description: 'DSA private key',

256 pattern: /-----BEGIN DSA PRIVATE KEY-----[\s\S]*?-----END DSA PRIVATE KEY-----/g,

257 severity: 'critical',

258 category: 'private-key',

259 keywords: ['BEGIN DSA PRIVATE KEY'],

260 },

261 {

262 id: 'pgp-private-key',

263 name: 'PGP Private Key',

264 description: 'PGP private key block',

265 pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----/g,

266 severity: 'critical',

267 category: 'private-key',

dist/llm/language-context.jsView file

Lines 446-486javascript

446 - Process spawning, shell execution

447 - Script evaluation, macro execution

448 - ANY operation that interprets data as system commands

449 - KEY QUESTION: Can external data influence what command runs?

450 - SAFE: Fixed commands

dist/cache/tree-cache.jsView file

Lines 36-76javascript

36 * **Env toggles:**

37 * LLM_TREE_CACHE=0 → disable persistent tree cache.

38 */

39import * as crypto from 'crypto';

40import * as fs

dist/llm/discovery.jsView file

Lines 222-262javascript

222 }

223 return results;

224 }

225 /**

226 * Analyze a single method for vulnerabilities

227 */

228 async analyzeMethod(method, targetCWEs, options, irSinks = [], language = 'java') {

229 const methodId =

dist/agents/mastra/workflow.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/mastra/workflow.jsView on unpkg