registry / fixmind / 1.0.28

fixmind@1.0.28

Local-first learning lessons for developers working with AI coding agents.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 706 KB of source, external domains: 127.0.0.1, developer.mozilla.org, github.com, jpczzgekindvuivnwjuw.supabase.co, nodejs.org, react.dev, reactrouter.com, www.fixmind.dev, www.w3.org

Source & flagged code

7 flagged

dist/src/cli-sync.jsView file

Lines 1-31javascript

1import { spawn } from "node:child_process";

2import { fileURLToPath } from "node:url";

3import { stdin, stdout } from "node:process";

4import { isCancel, log, password } from "@clack/prompts";

5import { readConfig, writeConfig } from "./config.js";

6import { createLessonStore, initializeDataDirectory } from "./storage.js";

7import { createSyncEngine, PRICING_URL } from "./sync.js";

8import { common, isAddressInUseError, intro, multiselect, note, optionalPort, optionString, parseList, select, startSpinner, supportedClientOptions, terminalLink, unwrap, validateClients, validateScope, greenText, text, } from "./cli-utils.js";

9import { configureClients, configureInstructions, configurePermissions, detectClients, genericMcpConfiguration } from "./setup.js";

10const DEFAULT_SUPABASE_URL = "https://jpczzgekindvuivnwjuw.supabase.co";

11const DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpwY3p6Z2VraW5kdnVpdm53anV3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODIwNzEyMjEsImV4cCI6MjA5NzY0NzIyMX0.qG-9H5BZi3sKHVQrzL3iI9ALmJgoTizLCU4Bxzpw0Bo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli-sync.jsView on unpkg · L11

Critical

Secret Pattern

Supabase service role key (JWT) in dist/src/cli-sync.js

dist/src/cli-sync.jsView on unpkg · L11

12export async function setup(options) {

13 const paths = initializeDataDirectory();

14 const config = readConfig();

15 const detected = detectClients();

16 const supplied = parseList(optionString(options.client));

17 let clients = supplied.length ? validateClients(supplied) : detected;

18 const suppliedScope = optionString(options.scope);

19 let scope = suppliedScope ? validateScope(suppliedScope) : "user";

20 const projectDirectory = process.cwd();

21 const captureModeInput = optionString(options["capture-mode"]);

22 const interactive = stdin.isTTY && stdout.isTTY;

23 if (interactive) {

24 intro("Configure Learning Lessons", common);

25 }

26 const captureMode = captureModeInput

27 ? validateCaptureMode(captureModeInput)

28 : await chooseCaptureMode(config.captureMode, interactive);

29 if (!options["dry-run"] && captureMode !== config.captureMode) {

30 writeConfig({ ...config, captureMode });

31 }

dist/dashboard/assets/LessonRoutePage-CKeRfj7o.jsView file

Lines 1-6javascript

1import{n as e,r as t,t as n}from"./proactive-memory-DWD9tMH6.js";import{_ as r,a as i,b as a,c as o,d as s,f as c,g as l,h as

dist/src/setup.jsView file

Lines 248-278javascript

248 }

249 catch {

250 return false;

251 }

252}

253function runCommand(command, args) {

254

dist/dashboard/assets/index-BUtLxN6A.jsView file

Lines 1-12javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/LessonRoutePage-CKeRfj7o.js","assets/proactive-memory-DWD9tMH6.js","assets/PracticePage-BbyhlL89.js"])))=>i.map(i

dist/src/sync-backend.jsView file

Lines 1-21javascript

1import { exec } from "node:child_process";

2import dns from "node:dns";

3import http from "node:http";

4import { createClient } from "@supabase/supabase-js";

Source & flagged code

7 flagged · loading source

dist/src/cli-sync.jsView file

11patternName = supabase_service_key severity = critical line = 11 matchedText = const DE...Bo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli-sync.jsView on unpkg · L11

11patternName = supabase_service_key severity = critical line = 11 matchedText = const DE...Bo";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/src/cli-sync.js

dist/src/cli-sync.jsView on unpkg · L11

dist/dashboard/assets/LessonRoutePage-CKeRfj7o.jsView file

1import{n as e,r as t,t as n}from"./proactive-memory-DWD9tMH6.js";import{_ as r,a as i,b as a,c as o,d as s,f as c,g as l,h as u,i as d,m as f,n as p,o as m,r as h,t as g,u as _,v}f... L2: https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};z(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code,...

Findings

2 Critical4 High4 Medium4 Low

CriticalCritical Secretdist/src/cli-sync.js

CriticalSecret Patterndist/src/cli-sync.js

HighChild Processdist/dashboard/assets/LessonRoutePage-CKeRfj7o.js

HighShelldist/src/setup.js

HighSame File Env Network Executiondist/src/sync-backend.js

HighSandbox Evasion Gated Capabilitydist/src/sync-backend.js

MediumDynamic Requiredist/dashboard/assets/index-BUtLxN6A.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings