contextdevkit@3.6.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

contextdevkit@3.6.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

tools/selfcheck-tc-scaffold.mjsView file

176patternName = aws_access_key severity = critical line = 176 matchedText = vars: { ...' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tools/selfcheck-tc-scaffold.mjsView on unpkg · L176

176patternName = aws_access_key severity = critical line = 176 matchedText = vars: { ...' },

Critical

Secret Pattern

AWS access key ID in tools/selfcheck-tc-scaffold.mjs

tools/selfcheck-tc-scaffold.mjsView on unpkg · L176

188patternName = aws_access_key severity = critical line = 188 matchedText = vars: { ...' },

Critical

Secret Pattern

AWS access key ID in tools/selfcheck-tc-scaffold.mjs

tools/selfcheck-tc-scaffold.mjsView on unpkg · L188

tools/integration-test-workflow-migrate.mjsView file

107const rep = reporter(); L108: const migrate = await import(pathToFileURL(MIGRATE).href); L109: const rootDir = mkdtempSync(join(tmpdir(), 'cdk-migrate-it-'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/integration-test-workflow-migrate.mjsView on unpkg · L107

templates/contextkit/tools/scripts/mcp-audit.mjsView file

49contains invisible/control Unicode U+FEFF (zero width no-break space) const BOM = /^<U+FEFF>/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

templates/contextkit/tools/scripts/mcp-audit.mjsView on unpkg · L49

templates/contextkit/squads/agent-forge/templates/agent-package/adapters/python/agent.pyView file

•path = [redacted]-forge/templates/agent-package/adapters/python/agent.py kind = build_helper sizeBytes = 813 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/contextkit/squads/agent-forge/templates/agent-package/adapters/python/agent.pyView on unpkg

tools/selfcheck-tc-cache.mjsView file

233patternName = aws_access_key severity = critical line = 233 matchedText = key: 'AK...LE',

Critical

Secret Pattern

AWS access key ID in tools/selfcheck-tc-cache.mjs

tools/selfcheck-tc-cache.mjsView on unpkg · L233

templates/contextkit/tools/scripts/economy/redact.mjsView file

117patternName = aws_access_key severity = critical line = 117 matchedText = { cls: "..." },

Critical

Secret Pattern

AWS access key ID in templates/contextkit/tools/scripts/economy/redact.mjs

templates/contextkit/tools/scripts/economy/redact.mjsView on unpkg · L117

118patternName = aws_secret_key severity = critical line = 118 matchedText = { cls: "..." },

Critical

Secret Pattern

AWS secret access key in templates/contextkit/tools/scripts/economy/redact.mjs

templates/contextkit/tools/scripts/economy/redact.mjsView on unpkg · L118

119patternName = private_key_rsa severity = critical line = 119 matchedText = { cls: "..." },

Critical

Secret Pattern

RSA private key in templates/contextkit/tools/scripts/economy/redact.mjs

templates/contextkit/tools/scripts/economy/redact.mjsView on unpkg · L119

122patternName = github_pat severity = critical line = 122 matchedText = { cls: "..." },

templates/contextkit/tools/scripts/economics/privacy-field-policy.mjsView file

72patternName = generic_password severity = medium line = 72 matchedText = password...en',

Medium

Secret Pattern

Hardcoded password in templates/contextkit/tools/scripts/economics/privacy-field-policy.mjs

templates/contextkit/tools/scripts/economics/privacy-field-policy.mjsView on unpkg · L72

Source & flagged code

15 flagged

tools/selfcheck-tc-scaffold.mjsView file

Lines 156-208javascript

156 ? ok('write mode: receipts.length>=1, afterSha256 present')

157 : bad(`write mode unexpected: dryRun=${r.dryRun} receipts=${r.receipts.length}`);

158

159 // ── 12. Written file content contains the rendered module name ────

160 const writtenPath = resolve(tmpDir, 'contextkit/pipeline/scratch/my-module.mjs');

161 const content = existsSync(writtenPath)

162 ? await readFile(writtenPath, 'utf-8')

163 : null;

164 (content && content.includes('my-module'))

165 ? ok('written file content contains rendered MODULE_NAME')

166 : bad(`written file missing MODULE_NAME: ${content === null ? 'file not found' : 'content wrong'}`); }

167

168 } finally {

169 await rm(tmpDir, { recursive: true, force: true });

170 }

171

172 // ── 13. Secret in vars → refused in dry-run ───────────────────────────────

173 // Inject a value that matches the AWS key pattern to trigger a refusal.

174 { const r = runScaffold({

175 patternId: 'seed-inert-module',

176 vars: { MODULE_NAME: 'AKIAIOSFODNN7EXAMPLE', DESCRIPTION: 'test' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tools/selfcheck-tc-scaffold.mjsView on unpkg · L176

Critical

Secret Pattern

AWS access key ID in tools/selfcheck-tc-scaffold.mjs

tools/selfcheck-tc-scaffold.mjsView on unpkg · L176

177 write: false,

178 });

179 r.refused.length > 0

180 ? ok('secret in vars → refused list non-empty in dry-run')

181 : bad('secret in vars → expected at least one refused path'); }

182

183 // ── 14. Secret in vars + write:true → ScaffoldSecretError ────────────────

184 { let threw = false;

185 try {

186 runScaffold({

187 patternId: 'seed-inert-module',

188 vars: { MODULE_NAME: 'AKIAIOSFODNN7EXAMPLE', DESCRIPTION: 'test' },

Critical

Secret Pattern

AWS access key ID in tools/selfcheck-tc-scaffold.mjs

tools/selfcheck-tc-scaffold.mjsView on unpkg · L188

189 write: true,

190 });

191 } catch (e) { threw = e instanceof ScaffoldSecretError; }

192 threw ? ok('secret + write:true → ScaffoldSecretError (no write)')

193 : bad('secret + write:true should throw ScaffoldSecretError'); }

194

195 // ── 15. presentScaffold dry-run result contains 'DRY-RUN' ────────────────

196 { const r = runScaffold({

197 patternId: 'seed-inert-module',

198 vars: { MODULE_NAME: 'test-mod', DESCRIPTION: 'test' },

199 write: false,

200 });

201 const s = presentScaffold(r);

202 (typeof s === 'string' && s.includes('DRY-RUN'))

203 ? ok('presentScaffold: dry-run result contains "DRY-RUN"')

204 : bad(`presentScaffold dry-run: "${s}"`); }

205

206 // ── 16. presentScaffold(null) → safe non-empty string ────────────────────

207 { let threw = false; let s = '';

208 try { s = presentScaffold(null); } catch { threw = true; }

tools/integration-test-workflow-migrate.mjsView file

Lines 87-127javascript

87 '### W0 — Governance · _done_',

88 '',

89 '| Task | Pri | Purpose |',

90 '| --- | --- | --- |',

91 '| **W0-T1** | P0 | Record the anchor decision. |',

92 '',

93

templates/contextkit/tools/scripts/mcp-audit.mjsView file

Lines 29-69javascript

29// Types (JSDoc only)

30// ---------------------------------------------------------------------------

31

32/**

33 * @typedef {{ name: string, transport: string, version?: string, envKeys?: string[], tools?: string[] }} McpServerInfo

34 * @typedef {{

35 * configFound: boolean, substrateStatus: string,

36 * servers: McpServerInfo[], receipts: number,

templates/contextkit/squads/agent-forge/templates/agent-package/adapters/python/agent.pyView file

•path = [redacted]-forge/templates/agent-package/adapters/python/agent.py kind = build_helper sizeBytes = 813 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/contextkit/squads/agent-forge/templates/agent-package/adapters/python/agent.pyView on unpkg

tools/selfcheck-tc-cache.mjsView file

Lines 213-253javascript

213 ? ok('readFromCache returns the stored value faithfully')

214 : bad(`readFromCache returned unexpected: ${JSON.stringify(read)}`);

215

216 // 17. isCached false after tampering

templates/contextkit/tools/scripts/economy/redact.mjsView file

Lines 97-138javascript

97

98/**

99 * Advisory self-check: one fixture per secret class. For each class it asserts

100 * the typed mask appears AND the raw secret no longer does; plus a clean string

101 * passes through untouched and non-string input yields empty string.

102 *

103 * Shape mirrors the other economy cards — (root) => { name, pass, detail }[].

104 * Pure (ignores root); advisory + fail-open.

105 *

106 * @returns

templates/contextkit/tools/scripts/economics/privacy-field-policy.mjsView file

72patternName = generic_password severity = medium line = 72 matchedText = password...en',

Medium

Secret Pattern

Hardcoded password in templates/contextkit/tools/scripts/economics/privacy-field-policy.mjs

templates/contextkit/tools/scripts/economics/privacy-field-policy.mjsView on unpkg · L72