registry / ghost-architect-open / 9.4.28

ghost-architect-open@9.4.28

⚠ Under review

AI-powered codebase archaeology: understand what you inherited

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 112 file(s), 1.79 MB of source, external domains: api.anthropic.com, ghostarchitect.dev, github.com, license.ghostarchitect.dev, signup.ghostarchitect.dev, timeapi.io, worldtimeapi.org

Source & flagged code

8 flagged

src/redactor.jsView file

Lines 47-92javascript

47 // Skip implausibly large blocks (>12KB is not a real key)

48 if (blockLen > 12000) {

49 offset = beginIdx + 1;

50 continue;

51 }

53 result = result.slice(0, beginIdx) + replacement + result.slice(blockEnd);

54 // Don't advance offset — replacement is shorter, recheck from same position

55 }

57 return result;

58}

60// @ghost-verified: false positive -- variants array contains only real PEM

61// begin/end markers. PRIVATE_KEY_REPLACEMENT and CERTIFICATE_REPLACEMENT are

62// named constants defined separately and are never used as search patterns.

63// Reviewed 2026-06-29.

64function parsePrivateKeyBlocks(content) {

65 // Handle all variants: RSA PRIVATE KEY, EC PRIVATE KEY, PRIVATE KEY, etc.

66 const variants = [

67 { begin: '-----BEGIN RSA PRIVATE KEY-----', end: '-----END RSA PRIVATE KEY-----' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/redactor.jsView on unpkg · L67

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L67

68 { begin: '-----BEGIN EC PRIVATE KEY-----', end: '-----END EC PRIVATE KEY-----' },

Critical

Secret Pattern

EC private key in src/redactor.js

src/redactor.jsView on unpkg · L68

69 { begin: '-----BEGIN DSA PRIVATE KEY-----', end: '-----END DSA PRIVATE KEY-----' },

70 { begin: '-----BEGIN PRIVATE KEY-----', end: '-----END PRIVATE KEY-----' },

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L70

71 { begin: '-----BEGIN ENCRYPTED PRIVATE KEY-----', end: '-----END ENCRYPTED PRIVATE KEY-----' },

72 { begin: '-----BEGIN OPENSSH PRIVATE KEY-----', end: '-----END OPENSSH PRIVATE KEY-----' },

Critical

Secret Pattern

OpenSSH private key in src/redactor.js

src/redactor.jsView on unpkg · L72

73 ];

74 let result = content;

75 for (const { begin, end } of variants) {

76 result = parseKeyBlocks(result, begin, end, PRIVATE_KEY_REPLACEMENT);

77 }

78 return result;

79}

81function parseCertificateBlocks(content) {

82 return parseKeyBlocks(content, '-----BEGIN CERTIFICATE-----', '-----END CERTIFICATE-----', CERTIFICATE_REPLACEMENT);

83}

85// ── Regex timeout wrapper (Finding 15 - ReDoS protection) ──────────────────

86function safeRegexReplace(content, regex, replacement, timeoutMs = 500) {

87 // Simple length-based guard — skip regex on extremely large inputs

88 // This prevents catastrophic backtracking on malformed files

89 if (content.length > SIZE_GUARD_BYTES) {

90 return { result: content, timedOut: true };

91 }

92 try {

src/prompt-pack/tokenizer.jsView file

Lines 59-99javascript

59 * OpenAI models are added to models.js.

60 */

61const OPENAI_ENCODING_PATHS = {

62 'gpt-5': 'gpt-tokenizer/encoding/o200k_base',

63 'gpt-4o': 'gpt-tokenizer/encoding/o200k_base',

64 'gpt-4o-mini': 'gpt-tokenizer/encoding/o200k_base',

src/modes/audit/index.jsView file

Lines 5-45javascript

5// Orchestrates the four audit-mode analyzers + the severity recast over

6// standard triage findings, then hands the synthesized output off to the

7// audit PDF template for deal-grade report generation.

8//

9// Audience: agency founders inheriting client codebases, PE/M&A diligence

10// teams, fractional CTOs walking into a new engagement, modernization

11// consultancies scoping a rebuild. NOT for ongoing developer use — that's

12// what the standard modes (POI/Blast/Conflict) are for.

13//

14// Pipeline:

15// 1. Codebase already loaded by ghost.js (codebaseContext.fileMap exists)

src/modes/watcher-commit.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ghost-architect-open@9.4.14 matchedIdentity = npm:Z2hvc3QtYXJjaGl0ZWN0LW9wZW4:9.4.14 similarity = 0.865 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/modes/watcher-commit.jsView on unpkg

Source & flagged code

8 flagged · loading source

src/redactor.jsView file

67patternName = private_key_rsa severity = critical line = 67 matchedText = { begin:...' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/redactor.jsView on unpkg · L67

67patternName = private_key_rsa severity = critical line = 67 matchedText = { begin:...' },

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L67

68patternName = private_key_ec severity = critical line = 68 matchedText = { begin:...' },

Critical

Secret Pattern

EC private key in src/redactor.js

src/redactor.jsView on unpkg · L68

70patternName = private_key_rsa severity = critical line = 70 matchedText = { begin:...' },

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L70

72patternName = private_key_openssh severity = critical line = 72 matchedText = { begin:...' },

Critical

Secret Pattern

OpenSSH private key in src/redactor.js

src/redactor.jsView on unpkg · L72

src/prompt-pack/tokenizer.jsView file

79try { L80: const mod = await import(encodingPath); L81: const encoder = { encode: mod.encode };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/prompt-pack/tokenizer.jsView on unpkg · L79

src/modes/audit/index.jsView file

25// v0.2.0 (current): stackReality + keyPersonRisk are real; the other two L26: // remain stubbed pending Day 3. Output to stdout shows real findings L27: // when available; PDF generation comes in Day 4. ... L32: import inquirer from 'inquirer'; L33: import { spawn } from 'child_process'; L34: import { runStackRealityCheck } from './stackReality.js'; ... L45: L46: const IS_WINDOWS = process.platform === 'win32'; L47: const SYM = { check: IS_WINDOWS ? '[OK]' : '✓', warn: IS_WINDOWS ? '[!]' : '⚠' }; ... L85: chalk.gray( ' audit history') + '\n\n' + L86: chalk.cyan('Upgrade at: ') + chalk.cyan.underline('https://ghostarchitect.dev/pricing'), L87: { padding: 1, borderColor: 'cyan', borderStyle: 'round' }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/modes/audit/index.jsView on unpkg · L25

src/modes/watcher-commit.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/modes/watcher-commit.jsView on unpkg

Findings

6 Critical1 High4 Medium5 Low

CriticalCritical Secretsrc/redactor.js

CriticalPrevious Version Dangerous Deltasrc/modes/watcher-commit.js

CriticalSecret Patternsrc/redactor.js

HighSandbox Evasion Gated Capabilitysrc/modes/audit/index.js

MediumDynamic Requiresrc/prompt-pack/tokenizer.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

src/redactor.jsView file

Lines 47-92javascript

47 // Skip implausibly large blocks (>12KB is not a real key)

48 if (blockLen > 12000) {

49 offset = beginIdx + 1;

50 continue;

51 }

53 result = result.slice(0, beginIdx) + replacement + result.slice(blockEnd);

54 // Don't advance offset — replacement is shorter, recheck from same position

55 }

57 return result;

58}

60// @ghost-verified: false positive -- variants array contains only real PEM

61// begin/end markers. PRIVATE_KEY_REPLACEMENT and CERTIFICATE_REPLACEMENT are

62// named constants defined separately and are never used as search patterns.

63// Reviewed 2026-06-29.

64function parsePrivateKeyBlocks(content) {

65 // Handle all variants: RSA PRIVATE KEY, EC PRIVATE KEY, PRIVATE KEY, etc.

66 const variants = [

67 { begin: '-----BEGIN RSA PRIVATE KEY-----', end: '-----END RSA PRIVATE KEY-----' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/redactor.jsView on unpkg · L67

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L67

68 { begin: '-----BEGIN EC PRIVATE KEY-----', end: '-----END EC PRIVATE KEY-----' },

Critical

Secret Pattern

EC private key in src/redactor.js

src/redactor.jsView on unpkg · L68

69 { begin: '-----BEGIN DSA PRIVATE KEY-----', end: '-----END DSA PRIVATE KEY-----' },

70 { begin: '-----BEGIN PRIVATE KEY-----', end: '-----END PRIVATE KEY-----' },

Critical

Secret Pattern

RSA private key in src/redactor.js

src/redactor.jsView on unpkg · L70

71 { begin: '-----BEGIN ENCRYPTED PRIVATE KEY-----', end: '-----END ENCRYPTED PRIVATE KEY-----' },

72 { begin: '-----BEGIN OPENSSH PRIVATE KEY-----', end: '-----END OPENSSH PRIVATE KEY-----' },

Critical

Secret Pattern

OpenSSH private key in src/redactor.js

src/redactor.jsView on unpkg · L72

73 ];

74 let result = content;

75 for (const { begin, end } of variants) {

76 result = parseKeyBlocks(result, begin, end, PRIVATE_KEY_REPLACEMENT);

77 }

78 return result;

79}

81function parseCertificateBlocks(content) {

82 return parseKeyBlocks(content, '-----BEGIN CERTIFICATE-----', '-----END CERTIFICATE-----', CERTIFICATE_REPLACEMENT);

83}

85// ── Regex timeout wrapper (Finding 15 - ReDoS protection) ──────────────────

86function safeRegexReplace(content, regex, replacement, timeoutMs = 500) {

87 // Simple length-based guard — skip regex on extremely large inputs

88 // This prevents catastrophic backtracking on malformed files

89 if (content.length > SIZE_GUARD_BYTES) {

90 return { result: content, timedOut: true };

91 }

92 try {

src/prompt-pack/tokenizer.jsView file

Lines 59-99javascript

59 * OpenAI models are added to models.js.

60 */

61const OPENAI_ENCODING_PATHS = {

62 'gpt-5': 'gpt-tokenizer/encoding/o200k_base',

63 'gpt-4o': 'gpt-tokenizer/encoding/o200k_base',

64 'gpt-4o-mini': 'gpt-tokenizer/encoding/o200k_base',

src/modes/audit/index.jsView file

Lines 5-45javascript

5// Orchestrates the four audit-mode analyzers + the severity recast over

6// standard triage findings, then hands the synthesized output off to the

7// audit PDF template for deal-grade report generation.

8//

9// Audience: agency founders inheriting client codebases, PE/M&A diligence

10// teams, fractional CTOs walking into a new engagement, modernization

11// consultancies scoping a rebuild. NOT for ongoing developer use — that's

12// what the standard modes (POI/Blast/Conflict) are for.

13//

14// Pipeline:

15// 1. Codebase already loaded by ghost.js (codebaseContext.fileMap exists)

src/modes/watcher-commit.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/modes/watcher-commit.jsView on unpkg