registry / orstrum / 0.1.0

orstrum@0.1.0

Build a queryable architectural intelligence graph from TypeScript repos for AI coding agents

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 49 file(s), 296 KB of source, external domains: claude.com, dvjgftxnnppvieivoaig.supabase.co, orstrum.com, www.orstrum.com

Source & flagged code

4 flagged

dist/lib/cloud.jsView file

Lines 1-26javascript

1import crypto from "node:crypto";

2// Public Supabase project values — safe to ship (anon key is intentionally public; RLS protects data).

3// Override with env vars to point at a local / staging Supabase instance.

4export const SUPABASE_URL = process.env.ORSTRUM_SUPABASE_URL ?? "https://dvjgftxnnppvieivoaig.supabase.co";

5export const SUPABASE_ANON_KEY = process.env.ORSTRUM_SUPABASE_ANON_KEY ??

6 "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImR2amdmdHhubnBwdmllaXZvYWlnIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzk3NDMzMDMsImV4cCI6MjA5NTMxOTMwM30.bh-kUtwDxTwEZ_JJVkgSM6Mq1sVlUmbh_D58RR5aBLo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/cloud.jsView on unpkg · L6

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lib/cloud.js

dist/lib/cloud.jsView on unpkg · L6

7// The deployed web app. Auth flows redirect here (never to localhost) so the

8// browser-visible login pages are branded and the Supabase redirect-URL

9// allow-list only ever needs our own domain. Override for local/staging web.

10export const ORSTRUM_WEB_URL = process.env.ORSTRUM_WEB_URL ?? "https://www.orstrum.com";

11// Hosted page that OAuth redirects to after GitHub auth. It reads the `?code`

12// Supabase appends and displays it for the user to paste back into `orstrum

13// login`. The PKCE verifier never leaves the CLI, so a displayed code alone

14// cannot be exchanged by anyone else.

15export const CLI_AUTH_REDIRECT = `${ORSTRUM_WEB_URL}/cli-auth`;

16export function generatePkce() {

17 const verifier = crypto.randomBytes(32).toString("base64url");

18 const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");

19 return { verifier, challenge };

20}

21export function buildOAuthUrl(redirectTo, codeChallenge) {

22 const params = new URLSearchParams({

23 provider: "github",

24 redirect_to: redirectTo,

25 code_challenge: codeChallenge,

26 code_challenge_method: "S256",

dist/config.jsView file

Lines 9-49javascript

9 return p;

10}

11const CONFIG_FILENAMES = ["orstrum.config.ts", "orstrum.config.js", "orstrum.config.json"];

12export function findConfig(cwd) {

dist/parsers/tree-sitter-python.wasmView file

•path = dist/parsers/tree-sitter-python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parsers/tree-sitter-python.wasmView on unpkg

Source & flagged code

4 flagged · loading source

dist/lib/cloud.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code