registry / kodelyth-ecc / 2.4.9

kodelyth-ecc@2.4.9

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 173 file(s), 1.11 MB of source, external domains: 127.0.0.1, github.com, mcp.exa.ai, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

16 flagged

bin/kodelyth-ecc.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// Kodelyth ECC — npx entry point

3// Usage (from npm — recommended):

4// npx kodelyth-ecc # Claude Code (default)

5// npx kodelyth-ecc --target windsurf-project # Windsurf (project)

6// npx kodelyth-ecc --target windsurf-home # Windsurf (global)

7// npx kodelyth-ecc --target antigravity # Google Antigravity

8// npx kodelyth-ecc --target cursor-project # Cursor IDE

9// npx kodelyth-ecc --target codex-home # Codex CLI

10// npx kodelyth-ecc --target opencode # OpenCode

11//

12// Usage (from GitHub — latest commit):

13// npx github:sifxprime/kodelyth-ecc

15'use strict';

17const { spawnSync } = require('child_process');

18const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

19const fs = require('fs');

20const os = require('os');

22const ROOT = path.join(__dirname, '..');

24// Auto-migrate legacy ~/.kodelyth/ → ~/.kodelythecc/ on first run for existing users.

25// Idempotent; instant no-op if legacy dir is absent or migration marker exists.

26try { require(path.join(ROOT, 'scripts', 'migrate-legacy.js')).main(); } catch { /* best-effort */ }

28// zsh (unlike bash) passes inline comments as literal args — strip them

29const args = process.argv.slice(2).filter((a, i, arr) => {

30 if (a.startsWith('#')) return false; // drop # and everything after

31 const prev = arr.slice(0, i).findIndex(x => x.startsWith('#'));

32 return prev === -1;

33});

34const isWin = os.platform() === 'win32';

36// ── Interactive menu — fires when invoked with no args on a real terminal ───

scripts/hooks/stop-format-typecheck.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * Stop Hook: Batch format and typecheck all JS/TS files edited this response

4 *

5 * Cross-platform (Windows, macOS, Linux)

6 *

7 * Reads the accumulator written by post-edit-accumulator.js and processes all

8 * edited files in one pass: groups files by project root for a single formatter

9 * invocation per root, and groups .ts/.tsx files by tsconfig dir for a single

10 * tsc --noEmit per tsconfig. The accumulator is cleared on read so repeated

actions/ecc-review/run-review.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// Kodelyth ECC — GitHub Action review runner

3// Reads a PR diff + selected agents and produces a JSON findings report.

4//

5// Env contract:

6// ANTHROPIC_API_KEY Anthropic API key (required for live model call; if absent, runs in dry-mode)

7// ECC_BUNDLE indie-hacker | red-team | enterprise

8// ECC_AGENTS comma-separated agent names (overrides bundle if set)

9// ECC_MODEL Anthropic model id

10// ECC_MAX_FILES max changed files per run

scripts/cli/menu.jsView file

Lines 89-129javascript

89 hint: 'Detach dashboard as a daemon so /api routes stay reachable',

90 run: () => runBackground(),

91 });

92 opts.push({

93 label: 'Uninstall ECC completely',

94 hint: 'Remove agents/skills/commands/hooks, RTK hook, codebase-mcp, and ~/.kodelythecc/'

install.shView file

•path = install.sh kind = build_helper sizeBytes = 34028 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

agents/load-tester.mdView file

Lines 137-177markdown

137 - name: "Critical user flow"

138 weight: 70

139 flow:

140 - get:

141 url: "/items"

142 expect:

143 - statusCode: 200

144 - maxResponseTime: 200

145 - post:

commands/kotlin-test.mdView file

Lines 61-113markdown

61fun validateRegistration(request: RegistrationRequest): ValidationResult {

62 TODO("not implemented")

63}

64```

66## Step 2: Write Kotest Tests (RED)

68```kotlin

69// validator/RegistrationValidatorTest.kt

70package com.example.validator

72import io.kotest.core.spec.style.FunSpec

commands/rust-test.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L76

86patternName = generic_password severity = medium line = 86 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L86

101patternName = generic_password severity = medium line = 101 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L101

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

Source & flagged code

16 flagged · loading source

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/hooks/stop-format-typecheck.jsView file

19const crypto = require('crypto'); L20: const { execFileSync, spawnSync } = require('child_process'); L21: const fs = require('fs'); ... L30: L31: // Characters cmd.exe treats as separators/operators when shell: true is used. L32: // Includes spaces and parentheses to guard paths like "C:\Users\John Doe\...". ... L41: const raw = L42: process.env.CLAUDE_SESSION_ID || L43: crypto.createHash('sha1').update(process.cwd()).digest('hex').slice(0, 12); L44: const sessionId = raw.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64); ... L63: try { L64: if (process.platform === 'win32' && resolved.bin.endsWith('.cmd')) {

Findings

4 High15 Medium5 Low

HighChild Processbin/kodelyth-ecc.js

HighShell

HighSame File Env Network Executionactions/ecc-review/run-review.js

HighRuntime Package Installscripts/cli/menu.js

MediumDynamic Requirebin/kodelyth-ecc.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternagents/load-tester.md

MediumSecret Patterncommands/kotlin-test.md

MediumSecret Pattern