registry / kodelyth-ecc / 2.0.3

kodelyth-ecc@2.0.3

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 24 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 180 file(s), 1.13 MB of source, external domains: github.com, mcp.exa.ai, registry.npmjs.org

Source & flagged code

15 flagged

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/hooks/stop-format-typecheck.jsView file

19const crypto = require('crypto'); L20: const { execFileSync, spawnSync } = require('child_process'); L21: const fs = require('fs'); ... L30: L31: // Characters cmd.exe treats as separators/operators when shell: true is used. L32: // Includes spaces and parentheses to guard paths like "C:\Users\John Doe\...". ... L41: const raw = L42: process.env.CLAUDE_SESSION_ID || L43: crypto.createHash('sha1').update(process.cwd()).digest('hex').slice(0, 12); L44: const sessionId = raw.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64); ... L63: try { L64: if (process.platform === 'win32' && resolved.bin.endsWith('.cmd')) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hooks/stop-format-typecheck.jsView on unpkg · L19

actions/ecc-review/run-review.jsView file

21const path = require('path'); L22: const { execSync } = require('child_process'); L23: const https = require('https'); L24: ... L36: L37: const bundle = (process.env.ECC_BUNDLE || 'red-team').trim(); L38: const agentsOverride = (process.env.ECC_AGENTS || '').split(',').map(s => s.trim()).filter(Boolean);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

actions/ecc-review/run-review.jsView on unpkg · L21

install.shView file

•path = install.sh kind = build_helper sizeBytes = 33692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

agents/load-tester.mdView file

157patternName = generic_password severity = medium line = 157 matchedText = password...ass"

Medium

Secret Pattern

Hardcoded password in agents/load-tester.md

agents/load-tester.mdView on unpkg · L157

commands/kotlin-test.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L81

93patternName = generic_password severity = medium line = 93 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L93

106patternName = generic_password severity = medium line = 106 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L106

commands/rust-test.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L76

86patternName = generic_password severity = medium line = 86 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L86

101patternName = generic_password severity = medium line = 101 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L101

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

Source & flagged code

15 flagged · loading source

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/hooks/stop-format-typecheck.jsView file

Findings

3 High15 Medium6 Low

HighChild Processbin/kodelyth-ecc.js

HighShell

HighSame File Env Network Executionactions/ecc-review/run-review.js

MediumDynamic Requirebin/kodelyth-ecc.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternagents/load-tester.md

MediumSecret Patterncommands/kotlin-test.md

MediumSecret Patterncommands/rust-test.md

MediumSecret Pattern