registry / omniguard-enterprise-cli / 1.4.0

omniguard-enterprise-cli@1.4.0

OmniGuard - AI-Powered Application Security Platform CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 245 KB of source, external domains: krnpfunshzycavskrtod.supabase.co, omniguard.io

Source & flagged code

11 flagged

src/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict'

4const fs = require('fs')

5const os = require('os')

6const path

Source & flagged code

11 flagged · loading source

src/index.jsView file

308patternName = supabase_service_key severity = critical line = 308 matchedText = const an...BVE'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.jsView on unpkg · L308

308patternName = supabase_service_key severity = critical line = 308 matchedText = const an...BVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L308

423patternName = supabase_service_key severity = critical line = 423 matchedText = anonKey ...BVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L423

430patternName = supabase_service_key severity = critical line = 430 matchedText = anonKey ...BVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L430

739patternName = aws_access_key severity = critical line = 739 matchedText = const aw...LE';

Critical

Secret Pattern

AWS access key ID in src/index.js

src/index.jsView on unpkg · L739

1172patternName = supabase_service_key severity = critical line = 1172 matchedText = const an...BVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L1172

9const readline = require('readline') L10: const { execSync, execFileSync, spawn } = require('child_process') L11:

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L9

84{ id: 'SAST-CRYPTO-001', name: 'Weak Hash MD5', re: /createHash\s*\(\s*["']md5["']/gi, sev: 'high' }, L85: { id: 'SAST-EVAL-001', name: 'eval() Usage', re: /\beval\s*\(/g, sev: 'high' }, L86: { id: 'SAST-PATH-001', name: 'Path Traversal', re: /\.\.\/|path\.join\([^)]*req\.|path\.join\([^)]*params\./gi, sev: 'high' }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L84

6const path = require('path') L7: const http = require('http') L8: const https = require('https') L9: const readline = require('readline') L10: const { execSync, execFileSync, spawn } = require('child_process') L11: ... L16: const VERSION = '1.4.0' L17: const LOG_FILE = path.join(os.homedir(), '.omniguard', 'daemon.log') L18: ... L30: return new Promise(resolve => { L31: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }) L32: if (!hidden) return rl.question(question, answer => { rl.close(); resolve(answer) })

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/index.jsView on unpkg · L6

src/daemon.jsView file

17patternName = supabase_service_key severity = critical line = 17 matchedText = const SU...VE';

Critical

Secret Pattern

Supabase service role key (JWT) in src/daemon.js

src/daemon.jsView on unpkg · L17

2L3: const http = require('http'); L4: const fs = require('fs'); L5: const path = require('path'); L6: const { execSync } = require('child_process'); L7: const crypto = require('crypto'); ... L9: // Configuration L10: const PORT = process.env.OMNIGUARD_DAEMON_PORT || 5175; L11: const HOME = require('os').homedir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/daemon.jsView on unpkg · L2

Findings

7 Critical3 High2 Medium6 Low

CriticalCritical Secretsrc/index.js

CriticalSecret Patternsrc/index.js

CriticalSecret Patternsrc/daemon.js

HighChild Processsrc/index.js

HighShell

HighSame File Env Network Executionsrc/daemon.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/index.js

LowWeak Cryptosrc/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 64-104javascript

65const IAC_RULES = [

66 { id: 'IAC-TF-001', name: 'Open SSH Access (22)', re: /ingress\s*\{[^}]*from_port\s*=\s*22[^}]*to_port\s*=\s*22[^}]*cidr_blocks\s*=\s*\[\s*["']0\.0\.0\.0\/0["']\s*\]/gi, sev: 'critical' },

67 { id: 'IAC-TF-002', name: 'S3 Public Read Allowed', re: /acl\s*=\s*["']public-read["']/gi, sev: 'high' },

68 { id: 'IAC-K8S-001', name: 'Privileged Container Escalation', re: /privileged:\s*true/gi, sev: 'high' },

69 { id: 'IAC-K8S-002', name: 'Running as Root User', re: /runAsNonRoot:\s*false/gi, sev: 'medium' }

70]

72const CONTAINER_RULES = [

73 { id: 'DOCKER-LINT-001', name: 'Missing USER specification (Running as Root)', re: /FROM\s+\S+(?:[\s\S](?!USER))*$/gi, sev: 'high' },

74 { id: 'DOCKER-LINT-002', name: 'Using latest tag', re: /FROM\s+\S+:latest/gi, sev: 'medium' },

75 { id: 'DOCKER-LINT-003', name: 'Secrets Leaked in ENV', re: /ENV\s+(?:AWS_|API_KEY|PASSWORD|TOKEN|SECRET)\S*\s*=/gi, sev: 'critical' }

76]

78const SAST_RULES = [

79 { id: 'SAST-SQL-001', name: 'SQL Injection', re: /(?:execute|query)\s*\([^)]*(?:SELECT|INSERT|UPDATE|DELETE)[^)]*\+/gi, sev: 'critical' },

80 { id: 'SAST-XSS-001', name: 'XSS via innerHTML', re: /\.innerHTML\s*[+]?=\s*[^"';\n]{1,80}(?:req\.|request\.|params\.|\$\{)/gm, sev: 'high' },

81 { id: 'SAST-CMD-001', name: 'Command Injection', re: /(?:child_process\.exec|execSync|os\.system)\s*\([^)]*(?:req\.|request\.|query\.)/gi, sev: 'critical' },

82 { id: 'SAST-DESER-001', name: 'Unsafe Deserialization', re: /pickle\.loads?\s*\(/g, sev: 'critical' },

83 { id: 'SAST-JWT-001', name: 'JWT Algorithm None', re: /algorithm[s]?\s*[:=]\s*["']none["']/gi, sev: 'critical' },

84 { id: 'SAST-CRYPTO-001', name: 'Weak Hash MD5', re: /createHash\s*\(\s*["']md5["']/gi, sev: 'high' },

85 { id: 'SAST-EVAL-001', name: 'eval() Usage', re: /\beval\s*\(/g, sev: 'high' },

86 { id: 'SAST-PATH-001', name: 'Path Traversal', re: /\.\.\/|path\.join\([^)]*req\.|path\.join\([^)]*params\./gi, sev: 'high' }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L84

87]

89const VULN_DEPENDENCIES = [

90 { name: 'lodash', maxVersion: '4.17.20', vuln: 'Prototype Pollution (CVE-2020-8203)', sev: 'high' },

91 { name: 'axios', maxVersion: '1.5.1', vuln: 'Server-Side Request Forgery (CVE-2023-45857)', sev: 'high' },

92 { name: 'semver', maxVersion: '7.5.1', vuln: 'Regular Expression Denial of Service (CVE-2023-37263)', sev: 'medium' },

93 { name: 'log4j', maxVersion: '2.14.1', vuln: 'Log4Shell Remote Code Execution (CVE-2021-44228)', sev: 'critical' }

94]

96const SKIP_FP = /(?:test|example|sample|placeholder|changeme|your[-_]?api|xxx|<|>|\$\{|\$\(|foobar|00000000)/i

97const SKIP_COMMENT = /^\s*(\/\/|#|\*|<!--)/

98const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '__pycache__', '.venv', 'vendor', 'coverage'])

99const SCAN_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.py', '.java', '.go', '.rb', '.php', '.cs', '.rs', '.swift', '.kt', '.scala', '.c', '.cpp', '.h', '.env', '.yaml', '.yml', '.json'

100const SEVERITY_ORDER = { critical: 4, high: 3, medium: 2, low: 1, info: 0 }

101

102function localScan(filePath, content) {

103 const findings = []

104 const lines = content.split('\n')

Lines 288-328javascript

288 console.log(` ${c.dim('ID:')} ${f.id || 'N/A'}`)

289 console.log(` ${c.dim('File:')} ${f.file_path}:${f.line_start} ${c.dim('Rule:')} ${f.rule_id}${f.fingerprint ? ` ${c.dim('Fingerprint:')} ${f.fingerprint.slice(0, 12)}` : ''}`)

290 if (f.evidence) console.log(` ${c.dim('Evidence:')} ${f.evidence}`)

291 if (f.ai_explanation) console.log(` ${c.dim('AI:')} ${f.ai_explanation}`)

292}

293

294function shouldFail(findings) {

295 const threshold = SEVERITY_ORDER[api.cfg().failOn] ?? 4

296 return findings.some(f => (SEVERITY_ORDER[f.severity] ?? 0) >= threshold)

297}

298

299// ─── Command Handlers ──────────────────────────────────────────────────────────

300

301async function cmdSignup(args) {

302 console.log(c.bold('\n🛡️ OmniGuard Secure CLI Signup\n'))

303 sec.checkRateLimit('signup')

304

305 const current = api.cfg()

306 const backendUrl = 'https://krnpfunshzycavskrtod.supabase.co'

307 const normalizedUrl = api.normalizeBackendUrl(backendUrl)

308 const anonKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtybnBmdW5zaHp5Y2F2c2tydG9kIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODMyNTU3NjcsImV4cCI6MjA5ODgzMTc2N30.gKqfOLzszLeP3rzlQ1MNjVqSWcNAtbP5kdeR43sHBVE'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.jsView on unpkg · L308

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L308

309

310 const email = sec.sanitizeInput((await prompt('Enter Email: ')).trim(), 'email')

311 const password = (await prompt('Enter Password: ', true)).trim()

312

313 if (!email || !password) throw new Error('Email and password are required.')

314

315 // Enterprise password strength validation

316 sec.validatePassword(password)

317

318 const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/

319 if (!emailPattern.test(email)) {

320 throw new Error('Please enter a valid company email or standard provider email (e.g. @gmail.com / @outlook.com).')

321 }

322 sec.auditLog({ action: 'signup_attempt', email })

323

324 console.log(c.dim('Creating user account...'))

325 try {

326 await api.signupUser(email, password, normalizedUrl, anonKey)

327 console.log(c.green('✓ Verification email sent.'))

328 } catch (err) {

Lines 403-450javascript

403 backendUrl: normalizedUrl,

404 apiKey,

405 orgId,

406 supabaseAnonKey: anonKey

407 })

408 console.log(c.green('\n✓ CLI fully configured and authenticated.\n'))

409}

410

411async function cmdLogin(args) {

412 sec.checkRateLimit('login')

413 const apiKeyOpt = args.indexOf('--api-key')

414 let apiKey = ''

415 let backendUrl = ''

416 let anonKey = ''

417 const current = api.cfg()

418

419 // 1. Direct API-Key mode

420 if (apiKeyOpt !== -1 && args[apiKeyOpt + 1]) {

421 apiKey = args[apiKeyOpt + 1]

422 backendUrl = current.backendUrl || 'https://krnpfunshzycavskrtod.supabase.co'

423 anonKey = current.active.supabaseAnonKey || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtybnBmdW5zaHp5Y2F2c2tydG9kIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODMyNTU3NjcsImV4cCI6MjA5ODgzMTc2N30.gKqfOLzszLeP3rzlQ1MNjVqSWcNAtbP5kdeR43sHBVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L423

424 } else {

425 // Interactive credentials mode

426 console.log(c.bold('\n🛡️ OmniGuard Secure CLI Login\n'))

427

428 backendUrl = 'https://krnpfunshzycavskrtod.supabase.co'

429 backendUrl = api.normalizeBackendUrl(backendUrl)

430 anonKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtybnBmdW5zaHp5Y2F2c2tydG9kIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODMyNTU3NjcsImV4cCI6MjA5ODgzMTc2N30.gKqfOLzszLeP3rzlQ1MNjVqSWcNAtbP5kdeR43sHBVE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L430

431

432 const emailOpt = args.indexOf('--email')

433 const rawEmail = emailOpt !== -1 ? args[emailOpt + 1] : (await prompt('Email: ')).trim()

434 const email = sec.sanitizeInput(rawEmail, 'email')

435

436 const passOpt = args.indexOf('--password')

437 const password = passOpt !== -1 ? args[passOpt + 1] : (await prompt('Password: ', true)).trim()

438

439 if (!email || !password) throw new Error('Email and password are required.')

440

441 const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/

442 if (!emailPattern.test(email)) {

443 throw new Error('Please enter a valid company email or standard provider email (e.g. @gmail.com / @outlook.com).')

444 }

445 sec.auditLog({ action: 'login_attempt', email })

446

447 console.log(c.dim('Authenticating directly with Supabase Auth...'))

448 const authData = await api.loginUser(email, password, backendUrl, anonKey)

449 const token = authData.access_token

450 const userId = authData.user?.id

src/daemon.jsView file

Lines 1-22javascript

1'use strict';

3const http = require('http');

4const fs = require('fs');

5const path = require('path');

6const { execSync } = require('child_process');

7const crypto = require('crypto');

9// Configuration

10const PORT = process.env.OMNIGUARD_DAEMON_PORT || 5175;

11const HOME = require('os').homedir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/daemon.jsView on unpkg · L2

12const DB_DIR = path.join(HOME, '.omniguard');

13const CONFIG_FILE = path.join(DB_DIR, 'config.json');

15// Supabase details (directly query from daemon)

16const SUPABASE_URL = process.env.VITE_SUPABASE_URL || 'https://krnpfunshzycavskrtod.supabase.co';

17const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_ANON_KEY || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtybnBmdW5zaHp5Y2F2c2tydG9kIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODMyNTU3NjcsImV4cCI6MjA5ODgzMTc2N30.gKqfOLzszLeP3rzlQ1MNjVqSWcNAtbP5kdeR43sHBVE';

19function log(msg) {

20 const line = `[${new Date().toISOString()}] ${msg}\n`;

21 console.log(line.trim());

22 try {

17patternName = supabase_service_key severity = critical line = 17 matchedText = const SU...VE';

Critical

Secret Pattern

Supabase service role key (JWT) in src/daemon.js

src/daemon.jsView on unpkg · L17