kodelyth-ecc@2.4.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kodelyth-ecc@2.4.7: Suspicious npm security report (Warn) | LPM Firewall

actions/ecc-review/run-review.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// Kodelyth ECC — GitHub Action review runner

3// Reads a PR diff + selected agents and produces a JSON findings report.

4//

5// Env contract:

6// ANTHROPIC_API_KEY Anthropic API key (required for live model call; if absent, runs in dry-mode)

7// ECC_BUNDLE indie-hacker | red-team | enterprise

8// ECC_AGENTS comma-separated agent names (overrides bundle if set)

9// ECC_MODEL Anthropic model id

10// ECC_MAX_FILES max changed files per run

11// ECC_BASE_SHA PR base

12// ECC_HEAD_SHA PR head

13//

14// Outputs (set via $GITHUB_OUTPUT):

15// critical-count, high-count, medium-count, report-path

16

17'use strict';

18

19const fs = require('fs');

20const os = require('os');

21const path = require('path');

22const { execSync } = require('child_process');

23const https = require('https');

24

25const HOME = os.homedir();

26const ECC_HOME = path.join(HOME, '.claude');

27const AGENTS_DIR = path.join(ECC_HOME, 'agents');

28const REPORT_PATH = path.join(os.tmpdir(), `ecc-review-${Date.now()}.json`);

29

30// ── Bundle → agent mapping ──────────────────────────────────────────────────

31const BUNDLE_AGENTS = {

32 'indie-hacker': ['security-reviewer', 'code-reviewer', 'ux-reviewer', 'dependency-doctor'],

33 'red-team': ['prompt-injection-hunter', 'supply-chain-auditor', 'secret-hunter', 'backdoor-hunter'],

34 'enterprise': ['code-reviewer', 'security-reviewer', 'license-violation-finder', 'supply-chain-auditor', 'api-guardian'],

35};

36

37const bundle = (process.env.ECC_BUNDLE || 'red-team').trim();

38const agentsOverride = (process.env.ECC_AGENTS || '').split(',').map(s => s.trim()).filter(Boolean);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

actions/ecc-review/run-review.jsView on unpkg · L21

39const selectedAgents = agentsOverride.length > 0

40 ? agentsOverride

41 : (BUNDLE_AGENTS[bundle] || BUNDLE_AGENTS['red-team']);

commands/kotlin-test.mdView file

Lines 61-113markdown

61fun validateRegistration(request: RegistrationRequest): ValidationResult {

62 TODO("not implemented")

63}

64```

65

66## Step 2: Write Kotest Tests (RED)

67

68```kotlin

69// validator/RegistrationValidatorTest.kt

70package com.example.validator

71

72import io.kotest.core.spec.style.FunSpec

73import io.kotest.matchers.shouldBe

74import io.kotest.matchers.types.shouldBeInstanceOf

75

76class RegistrationValidatorTest : FunSpec({

77 test("valid registration returns Valid") {

78 val request = RegistrationRequest(

79 name = "Alice",

80 email = "alice@example.com",

81 password = "SecureP@ss1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L81

82 )

83

84 val result = validateRegistration(request)

85

86 result.shouldBeInstanceOf<ValidationResult.Valid>()

87 }

88

89 test("blank name returns Invalid") {

90 val request = RegistrationRequest(

91 name = "",

92 email = "alice@example.com",

93 password = "SecureP@ss1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L93

94 )

95

96 val result = validateRegistration(request)

97

98 val invalid = result.shouldBeInstanceOf<ValidationResult.Invalid>()

99 invalid.errors shouldBe listOf("Name is required")

100 }

101

102 test("invalid email returns Invalid") {

103 val request = RegistrationRequest(

104 name = "Alice",

105 email = "not-an-email",

106 password = "SecureP@ss1",

107 )

108

109 val result = validateRegistration(request)

110

111 val invalid = result.shouldBeInstanceOf<ValidationResult.Invalid>()

112 invalid.errors shouldBe listOf("Invalid email format")

113 }

106patternName = generic_password severity = medium line = 106 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L106