registry / jonggrang / 0.13.5

jonggrang@0.13.5

Deterministic AI orchestration platform — 16-phase workflow engine for autonomous software development

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 92 file(s), 2.53 MB of source, external domains: 127.0.0.1, api.github.com, github.com, gitlab.com, opencode.ai, socket.io, www.w3.org

Source & flagged code

13 flagged

client/dist/assets/SettingsView-Cb0DZfeW.jsView file

Lines 144-166javascript

144

145 .p-selectbutton .p-togglebutton:last-child {

146 border-start-end-radius: dt('selectbutton.border.radius');

147 border-end-end-radius: dt('selectbutton.border.radius');

148 }

149

150 .p-selectbutton.p-invalid {

151 outline: 1px solid dt('selectbutton.invalid.border.color');

152 outline-offset: 0;

153 }

154

155 .p-selectbutton-fluid {

156 width: 100%;

157 }

158

159 .p-selectbutton-fluid .p-togglebutton {

160 flex: 1 1 0;

161 }

162`,classes:{root:function(e){var t=e.props;return[`p-selectbutton p-component`,{"p-invalid":e.instance.$invalid,"p-selectbutton-fluid":t.fluid}]}}}),W={name:`BaseSelectButton`,extends:j,props:{options:Array,optionLabel:null,optionValue:null,optionDisabled:null,multiple:Boolean,allowEmpty:{type:Boolean,default:!0},dataKey:null,ariaLabelledby:{type:String,default:null},size:{type:String,default:null},fluid:{type:Boolean,default:null}},style:U,provide:function(){return{$pcSelectButton:this,$parentInstance:this}}};function G(e,t){var n=typeof Symbol<`u`&&e[Symbol.iterator]||e[`@@iterator`];if(!n){i ...

163In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,s=!1;return{s:function(){n=n.call(e)},n:function(){var e=n.next();return o=e.done,e},e:function(e){s=!0,a=e},f:function(){try{o

164In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function J(e,t){if(e){if(typeof e==`string`)return Z(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n

165...

166-----END OPENSSH PRIVATE KEY-----`},null,512),[[_,L.value]]),z.value?(o(),u(`div`,He,[n[43]||=l(`i`,{class:`pi pi-times-circle`},null,-1),v(` `+E(z.value),1)])):T(``,!0),B.value?(o(),u(`div`,Ue,[...n[44]||=[l(`i`,{class:`pi pi-check-circle`},null,-1),v(` Saved — restart sandboxes to apply`,-1)]])):T(``,!0),l(`div

Long lines were clipped for display.

164patternName = private_key_openssh severity = critical line = 164 matchedText = In order...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/SettingsView-Cb0DZfeW.js

client/dist/assets/SettingsView-Cb0DZfeW.jsView on unpkg · L164

apis/projects/orchestration-run.jsView file

Lines 1-36javascript

1'use strict';

3// Parallel orchestration manager.

4//

5// Runs every plan (group of tasks sharing one feature_id) in its own git

6// worktree + branch. Plans are started individually from each plan's Work

7// Mode in the web UI (per-group start), and still run in parallel: the run

8// is an incremental registry that groups join as they start. The parent

9// process is the SINGLE writer of tasks.json: workers emit task_status JSON

10// signals via stdout, which we translate into the main board so the kanban

11// updates live.

lib/jonggrang.jsView file

Lines 1641-1681javascript

1641 resolve(finish(code));

1642 });

1643

1644 } else {

1645 resolve(finish(1));

1646 }

1647 });

1648}

1649

1650// ============================================================

apis/secrets/index.jsView file

Lines 1-22javascript

1'use strict';

3const { Router } = require('express');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

apis/secrets/index.jsView on unpkg · L2

5function parseEnvText(text) {

6 const vars

lib/bot-reviewer/index.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/bot-reviewer/index.jsView on unpkg · L1

3const crypto = require('crypto');

4const { cmdBotReviewerSettings, loadSettings, loadState, saveState } = require('./settings'

hooks/pi/jonggrang-extension.tsView file

Lines 1-37typescript

1//

2// JONGGRANG — Pi Extension

3// Implements the same enforcement as Claude Code hooks and OpenCode plugin

4// using Pi's TypeScript extension API.

5//

6// Events used:

7// session_start → session role init (claim pending role from queue)

8// resources_discover → redirect skill/prompt discovery to .jonggrang/

9// before_agent_start → inject codemap into system prompt (first turn only)

10// tool_call → file protection + secret command block + agent-first + compaction gate + task role claim

11// tool_result → track modifications (dirty bit) + output sanitization

bin/jonggrang.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2//

3// JONGGRANG — AI Development Workflow Orchestrator (Node.js CLI)

4// Node.js CLI implementation

5//

7const fs = require('fs');

8const os = require('os');

hooks/claude/secret-final-check.shView file

•path = hooks/claude/secret-final-check.sh kind = build_helper sizeBytes = 1567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/claude/secret-final-check.shView on unpkg

client/dist/assets/primeicons-C6QP2o4f.woff2View file

•path = client/dist/assets/primeicons-C6QP2o4f.woff2 kind = high_entropy_blob sizeBytes = 35148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/primeicons-C6QP2o4f.woff2View on unpkg

skills/library/testing/unit-testing-patterns/SKILL.mdView file

17patternName = generic_password severity = medium line = 17 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in skills/library/testing/unit-testing-patterns/SKILL.md

skills/library/testing/unit-testing-patterns/SKILL.mdView on unpkg · L17

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = import{A...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/ProjectSettingsView-DT4KtWe6.js

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView on unpkg · L1

Source & flagged code

13 flagged · loading source

client/dist/assets/SettingsView-Cb0DZfeW.jsView file

164patternName = private_key_openssh severity = critical line = 164 matchedText = In order...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

client/dist/assets/SettingsView-Cb0DZfeW.jsView on unpkg · L164

164patternName = private_key_openssh severity = critical line = 164 matchedText = In order...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/SettingsView-Cb0DZfeW.js

client/dist/assets/SettingsView-Cb0DZfeW.jsView on unpkg · L164

apis/projects/orchestration-run.jsView file

16const { Router } = require('express'); L17: const { spawn, execFile, execFileSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

apis/projects/orchestration-run.jsView on unpkg · L16

lib/jonggrang.jsView file

1661const result = require('child_process').spawnSync(testCmd, { L1662: shell: true, L1663: cwd: projectRoot,

High

Shell

Package source references shell execution.

lib/jonggrang.jsView on unpkg · L1661

apis/secrets/index.jsView file

2L3: const { Router } = require('express'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

apis/secrets/index.jsView on unpkg · L2

lib/bot-reviewer/index.jsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/bot-reviewer/index.jsView on unpkg · L1

hooks/pi/jonggrang-extension.tsView file

17const fs = require("fs") as typeof import("fs"); L18: const { execSync, execFileSync } = require("child_process") as typeof import("child_process"); L19: ... L36: /\bcredentials\b/i, /\.pfx$/i, /\.p12$/i, /\.crt$/i, /\.cer$/i, L37: /\.pkcs12$/i, /\.jks$/i, /\.keystore$/i, /(^|\/)\.ssh\//i, /authorized_keys/i, L38: ]; ... L65: .filter(Boolean); L66: const READERS = "(?:cat|head|tail|less|more|xxd|od|hexdump|strings|awk|sed|cp|mv|tar|zip|base64|openssl|grep|rg|fgrep|egrep|nl|tac|view|vim|vi|nano|emacs|code|subl)"; L67: const SECRETPATH = "(credentials|\\.pem(\\s|$)|\\.key(\\s|$)|id_rsa|id_ed25519|id_ecdsa|id_ed25519_sk|id_ecdsa_sk|id_dsa|identity|ssh_host_.*_key|\\.ssh/|\\.aws/credentials|authori... ... L85: .replace(/(aws_access_key_id\s*=\s*)\S+/gi, "$1<REDACTED>") L86: .replace(/-----BEGIN [A-Z ]*(PRIVATE|CERTIFICATE|EC|OPENSSH) KEY-----/g, "-----BEGIN <REDACTED>-----") L87: .replace(/(eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]+\.)[A-Za-z0-9_-]+/g, "$1<REDACTED>")

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

hooks/pi/jonggrang-extension.tsView on unpkg · L17

bin/jonggrang.jsView file

9Detached bundled service listener: bin/jonggrang.js spawns server.js; helper exposes a broad-bound HTTP listener. L9: const path = require('path'); L10: const { spawn, spawnSync, execSync } = require('child_process'); L11: const readline = require('readline'); ... L24: function resolveJonggrangHome() { L25: if (process.env.JONGGRANG_HOME) return process.env.JONGGRANG_HOME; L26: L27: const candidates = [ L28: path.resolve(__dirname, '..'), L29: path.resolve(__dirname, '..', '..'), ... L55: L56: const JONGGRANG_VERSION = require('../package.json').version; L57:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/jonggrang.jsView on unpkg · L9

2658try { L2659: execSync('npm install --production', { cwd: WEB_DIR, stdio: 'inherit' }); L2660: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/jonggrang.jsView on unpkg · L2658

hooks/claude/secret-final-check.shView file

•path = hooks/claude/secret-final-check.sh kind = build_helper sizeBytes = 1567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/claude/secret-final-check.shView on unpkg

client/dist/assets/primeicons-C6QP2o4f.woff2View file

•path = client/dist/assets/primeicons-C6QP2o4f.woff2 kind = high_entropy_blob sizeBytes = 35148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/primeicons-C6QP2o4f.woff2View on unpkg

skills/library/testing/unit-testing-patterns/SKILL.mdView file

17patternName = generic_password severity = medium line = 17 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in skills/library/testing/unit-testing-patterns/SKILL.md

skills/library/testing/unit-testing-patterns/SKILL.mdView on unpkg · L17

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = import{A...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/ProjectSettingsView-DT4KtWe6.js

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView on unpkg · L1

Findings

3 Critical5 High7 Medium6 Low

CriticalCritical Secretclient/dist/assets/SettingsView-Cb0DZfeW.js

CriticalSecret Patternclient/dist/assets/SettingsView-Cb0DZfeW.js

CriticalSecret Patternclient/dist/assets/ProjectSettingsView-DT4KtWe6.js

HighChild Processapis/projects/orchestration-run.js

HighShelllib/jonggrang.js

HighSpawned Bundled Service Listenerbin/jonggrang.js

HighRuntime Package Installbin/jonggrang.js

HighShips High Entropy Blobclient/dist/assets/primeicons-C6QP2o4f.woff2

MediumDynamic Requireapis/secrets/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencehooks/pi/jonggrang-extension.ts

MediumShips Build Helperhooks/claude/secret-final-check.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/library/testing/unit-testing-patterns/SKILL.md

LowScripts Present

LowWeak Cryptolib/bot-reviewer/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

client/dist/assets/SettingsView-Cb0DZfeW.jsView file

Lines 144-166javascript

144

145 .p-selectbutton .p-togglebutton:last-child {

146 border-start-end-radius: dt('selectbutton.border.radius');

147 border-end-end-radius: dt('selectbutton.border.radius');

148 }

149

150 .p-selectbutton.p-invalid {

151 outline: 1px solid dt('selectbutton.invalid.border.color');

152 outline-offset: 0;

153 }

154

155 .p-selectbutton-fluid {

156 width: 100%;

157 }

158

159 .p-selectbutton-fluid .p-togglebutton {

160 flex: 1 1 0;

161 }

165...

Long lines were clipped for display.

164patternName = private_key_openssh severity = critical line = 164 matchedText = In order...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/SettingsView-Cb0DZfeW.js

client/dist/assets/SettingsView-Cb0DZfeW.jsView on unpkg · L164

apis/projects/orchestration-run.jsView file

Lines 1-36javascript

1'use strict';

3// Parallel orchestration manager.

4//

5// Runs every plan (group of tasks sharing one feature_id) in its own git

6// worktree + branch. Plans are started individually from each plan's Work

7// Mode in the web UI (per-group start), and still run in parallel: the run

8// is an incremental registry that groups join as they start. The parent

9// process is the SINGLE writer of tasks.json: workers emit task_status JSON

10// signals via stdout, which we translate into the main board so the kanban

11// updates live.

lib/jonggrang.jsView file

Lines 1641-1681javascript

1641 resolve(finish(code));

1642 });

1643

1644 } else {

1645 resolve(finish(1));

1646 }

1647 });

1648}

1649

1650// ============================================================

apis/secrets/index.jsView file

Lines 1-22javascript

1'use strict';

3const { Router } = require('express');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

apis/secrets/index.jsView on unpkg · L2

5function parseEnvText(text) {

6 const vars

lib/bot-reviewer/index.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/bot-reviewer/index.jsView on unpkg · L1

3const crypto = require('crypto');

4const { cmdBotReviewerSettings, loadSettings, loadState, saveState } = require('./settings'

hooks/pi/jonggrang-extension.tsView file

Lines 1-37typescript

1//

2// JONGGRANG — Pi Extension

3// Implements the same enforcement as Claude Code hooks and OpenCode plugin

4// using Pi's TypeScript extension API.

5//

6// Events used:

7// session_start → session role init (claim pending role from queue)

8// resources_discover → redirect skill/prompt discovery to .jonggrang/

9// before_agent_start → inject codemap into system prompt (first turn only)

10// tool_call → file protection + secret command block + agent-first + compaction gate + task role claim

11// tool_result → track modifications (dirty bit) + output sanitization

bin/jonggrang.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2//

3// JONGGRANG — AI Development Workflow Orchestrator (Node.js CLI)

4// Node.js CLI implementation

5//

7const fs = require('fs');

8const os = require('os');

hooks/claude/secret-final-check.shView file

•path = hooks/claude/secret-final-check.sh kind = build_helper sizeBytes = 1567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/claude/secret-final-check.shView on unpkg

client/dist/assets/primeicons-C6QP2o4f.woff2View file

•path = client/dist/assets/primeicons-C6QP2o4f.woff2 kind = high_entropy_blob sizeBytes = 35148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/primeicons-C6QP2o4f.woff2View on unpkg

skills/library/testing/unit-testing-patterns/SKILL.mdView file

17patternName = generic_password severity = medium line = 17 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in skills/library/testing/unit-testing-patterns/SKILL.md

skills/library/testing/unit-testing-patterns/SKILL.mdView on unpkg · L17

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = import{A...----

Critical

Secret Pattern

OpenSSH private key in client/dist/assets/ProjectSettingsView-DT4KtWe6.js

client/dist/assets/ProjectSettingsView-DT4KtWe6.jsView on unpkg · L1