registry / kodelyth-ecc / 3.0.2

kodelyth-ecc@3.0.2

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 25 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 197 file(s), 1.20 MB of source, external domains: 127.0.0.1, github.com, mcp.exa.ai, registry.npmjs.org

Source & flagged code

16 flagged

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/token/counter.jsView file

1/** L2: * Token Counter - Accurate token counting for multiple models

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/token/counter.jsView on unpkg · L1

actions/ecc-review/run-review.jsView file

21const path = require('path'); L22: const { execSync } = require('child_process'); L23: const https = require('https'); L24: ... L36: L37: const bundle = (process.env.ECC_BUNDLE || 'red-team').trim(); L38: const agentsOverride = (process.env.ECC_AGENTS || '').split(',').map(s => s.trim()).filter(Boolean);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

actions/ecc-review/run-review.jsView on unpkg · L21

install.shView file

•path = install.sh kind = build_helper sizeBytes = 33692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

agents/load-tester.mdView file

157patternName = generic_password severity = medium line = 157 matchedText = password...ass"

Medium

Secret Pattern

Hardcoded password in agents/load-tester.md

agents/load-tester.mdView on unpkg · L157

commands/kotlin-test.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L81

93patternName = generic_password severity = medium line = 93 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L93

106patternName = generic_password severity = medium line = 106 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L106

commands/rust-test.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L76

86patternName = generic_password severity = medium line = 86 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L86

101patternName = generic_password severity = medium line = 101 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L101

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

skills/security-review/SKILL.mdView file

57patternName = generic_password severity = medium line = 57 matchedText = - No sec... "`.

Medium

Secret Pattern

Hardcoded password in skills/security-review/SKILL.md

skills/security-review/SKILL.mdView on unpkg · L57

Source & flagged code

16 flagged · loading source

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/token/counter.jsView file

1/** L2: * Token Counter - Accurate token counting for multiple models

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/token/counter.jsView on unpkg · L1

Findings

3 High16 Medium6 Low

HighChild Processbin/kodelyth-ecc.js

HighShell

HighSame File Env Network Executionactions/ecc-review/run-review.js

MediumDynamic Requirebin/kodelyth-ecc.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternagents/load-tester.md

MediumSecret Patterncommands/kotlin-test.md

MediumSecret Patterncommands/rust-test.md

MediumSecret Pattern