registry / paqad-ai / 1.37.0

paqad-ai@1.37.0

Spec-driven development framework — AI agents that think before they type

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 4.23 MB of source, external domains: 127.0.0.1, api.cohere.com, api.osv.dev, in-toto.io, paqad.ai, react.dev, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

Lines 84-124json

84 "voyageai": "^0.4.0",

85 "yaml": "^2.9.0"

86 },

87 "devDependencies": {

88 "@changesets/changelog-git": "^0.2.1",

89 "@changesets/changelog-github": "^0.7.0",

90 "@changesets/cli": "^2.31.0",

91 "@eslint/js": "^10.0.1",

92 "@types/node": "^26.0.0",

93 "@vitest/coverage-v8": "^3.2.4",

94 "eslint": "^10.5.0",

95 "globals": "^17.6.0",

96 "markdownlint-cli2": "^0.22.1",

97 "prettier": "^3.8.4",

98 "tsup": "^8.5.0",

99 "typescript": "^6.0.3",

100 "typescript-eslint": "^8.61.1",

101 "vitest": "^3.2.4"

102 },

103 "scripts": {

104 "postinstall": "node runtime/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L104

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L104

105 "build": "tsup && pnpm run graph-ui:build",

106 "build:server": "tsup",

107 "dev": "tsup --watch",

108 "graph-ui:install": "cd graph-ui && pnpm install",

109 "graph-ui:dev": "cd graph-ui && pnpm dev",

110 "graph-ui:build": "cd graph-ui && pnpm build",

111 "test": "vitest run",

112 "test:watch": "vitest",

113 "test:coverage": "vitest run --coverage",

114 "lint": "eslint .",

115 "format": "prettier --write .",

116 "format:check": "prettier --check .",

117 "typecheck": "tsc --noEmit",

118 "check:surface-orphans": "node scripts/check-surface-orphans.mjs",

119 "check:surface-drift": "node scripts/check-surface-drift.mjs",

120 "ci": "pnpm run typecheck && pnpm run lint && pnpm run format:check && pnpm run test:coverage && pnpm run build",

121 "changeset": "changeset",

122 "version-packages": "changeset version",

123 "release": "pnpm run build && changeset publish"

124 }

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView file

Lines 1-33markdown

1# Cryptographic Weakness Patterns

3Concrete code patterns indicating cryptographic failures. Reference these when scanning source code.

5## Hardcoded Secrets

7Patterns to flag (by language):

9```

10# Generic indicators

11-----BEGIN RSA PRIVATE KEY-----

12-----BEGIN PRIVATE KEY-----

dist/rule-scripts/index.jsView file

Lines 486-526javascript

486 capabilities: {

487 ...existing?.capabilities ?? {},

488 [capabilityId]: { ...existing?.capabilities?.[capabilityId] ?? {}, digest, ...versions }

489 }

490 };

491 const path = capabilityLockPath(projectRoot);

492

runtime/graph-ui/assets/index-B7e9pFJw.jsView file

218`;v(ke),Q(pt=>pt+1),le.file.exists&&!le.placeholder&&m(!0)}).catch(le=>n(le instanceof Error?le.message:String(le))),Pi().then(le=>{s(le.projectName),c(le.frameworkVersion)}).catch... L219: `),Q(Fe=>Fe+1),te()},se=_.useCallback(le=>{P||!p||(R(!0),W(null),G(null),ee(null),oR({content:O,baseHash:le!==void 0?le:x}).then(ke=>{if(ke.status==="ok"){S(ke.result.hash),e(Fe=>F... L220: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Wl(i,e){return DB(i)||zB(i,e)||ZA(i,e)||XB()}var uO={black:"#000000",silver:"#C0C0C0",...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/graph-ui/assets/index-B7e9pFJw.jsView on unpkg · L218

dist/index.jsView file

523} L524: function layeredConfigMap(projectRoot, env = process.env) { L525: const merged = /* @__PURE__ */ new Map(); ... L1944: try { L1945: const parsed = JSON.parse(trimmed); L1946: if (typeof parsed === "object" && parsed !== null && (parsed.type === "sk[redacted]" || parsed.type === "sk[redacted]")) { ... L2910: }, L2911: frozenMetadata: { L2912: type: "object", ... L4038: default_command: { type: "string" }, L4039: output_source: { type: "string", enum: ["stdout", "file"] }, L4040: output_path_pattern: { type: "string" }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L523

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L523

runtime/hooks/silent-update.mjsView file

347const out = openSync(logPath, 'a'); L348: const child = spawn('npm install -g paqad-ai@latest && paqad-ai update --silent', { L349: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

runtime/hooks/silent-update.mjsView on unpkg · L347

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView file

•path = [redacted]-mechanism-review/scripts/scan-auth-smells.sh kind = build_helper sizeBytes = 1583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node runtime/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node runtime/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView file

13patternName = private_key_ec severity = critical line = 13 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView on unpkg · L13

11patternName = private_key_rsa severity = critical line = 11 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.md

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView on unpkg · L11

12patternName = private_key_rsa severity = critical line = 12 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.md

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView on unpkg · L12

13patternName = private_key_ec severity = critical line = 13 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.md

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView on unpkg · L13

dist/rule-scripts/index.jsView file

506// src/rule-scripts/execute.ts L507: import { spawnSync } from "child_process"; L508: import { accessSync, constants, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/rule-scripts/index.jsView on unpkg · L506

1369import { join as join9 } from "path"; L1370: import { execa } from "execa"; L1371: async function loadChangeEvidence(projectRoot) {

High

Shell

Package source references shell execution.

dist/rule-scripts/index.jsView on unpkg · L1369

runtime/graph-ui/assets/index-B7e9pFJw.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/graph-ui/assets/index-B7e9pFJw.jsView on unpkg · L218

dist/index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L523

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L523

runtime/hooks/silent-update.mjsView file

347const out = openSync(logPath, 'a'); L348: const child = spawn('npm install -g paqad-ai@latest && paqad-ai update --silent', { L349: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

runtime/hooks/silent-update.mjsView on unpkg · L347

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView file

•path = [redacted]-mechanism-review/scripts/scan-auth-smells.sh kind = build_helper sizeBytes = 1583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView on unpkg

Findings

4 Critical5 High6 Medium6 Low

CriticalCritical Secretruntime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.md

CriticalSecret Patternruntime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/rule-scripts/index.js

HighShelldist/rule-scripts/index.js

HighCloud Metadata Accessdist/index.js

HighRuntime Package Installruntime/hooks/silent-update.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireruntime/graph-ui/assets/index-B7e9pFJw.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

package.jsonView file

Lines 84-124json

84 "voyageai": "^0.4.0",

85 "yaml": "^2.9.0"

86 },

87 "devDependencies": {

88 "@changesets/changelog-git": "^0.2.1",

89 "@changesets/changelog-github": "^0.7.0",

90 "@changesets/cli": "^2.31.0",

91 "@eslint/js": "^10.0.1",

92 "@types/node": "^26.0.0",

93 "@vitest/coverage-v8": "^3.2.4",

94 "eslint": "^10.5.0",

95 "globals": "^17.6.0",

96 "markdownlint-cli2": "^0.22.1",

97 "prettier": "^3.8.4",

98 "tsup": "^8.5.0",

99 "typescript": "^6.0.3",

100 "typescript-eslint": "^8.61.1",

101 "vitest": "^3.2.4"

102 },

103 "scripts": {

104 "postinstall": "node runtime/scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L104

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L104

105 "build": "tsup && pnpm run graph-ui:build",

106 "build:server": "tsup",

107 "dev": "tsup --watch",

108 "graph-ui:install": "cd graph-ui && pnpm install",

109 "graph-ui:dev": "cd graph-ui && pnpm dev",

110 "graph-ui:build": "cd graph-ui && pnpm build",

111 "test": "vitest run",

112 "test:watch": "vitest",

113 "test:coverage": "vitest run --coverage",

114 "lint": "eslint .",

115 "format": "prettier --write .",

116 "format:check": "prettier --check .",

117 "typecheck": "tsc --noEmit",

118 "check:surface-orphans": "node scripts/check-surface-orphans.mjs",

119 "check:surface-drift": "node scripts/check-surface-drift.mjs",

120 "ci": "pnpm run typecheck && pnpm run lint && pnpm run format:check && pnpm run test:coverage && pnpm run build",

121 "changeset": "changeset",

122 "version-packages": "changeset version",

123 "release": "pnpm run build && changeset publish"

124 }

runtime/capabilities/security/skills/cryptographic-review/references/crypto-weakness-patterns.mdView file

Lines 1-33markdown

1# Cryptographic Weakness Patterns

3Concrete code patterns indicating cryptographic failures. Reference these when scanning source code.

5## Hardcoded Secrets

7Patterns to flag (by language):

9```

10# Generic indicators

11-----BEGIN RSA PRIVATE KEY-----

12-----BEGIN PRIVATE KEY-----

dist/rule-scripts/index.jsView file

Lines 486-526javascript

486 capabilities: {

487 ...existing?.capabilities ?? {},

488 [capabilityId]: { ...existing?.capabilities?.[capabilityId] ?? {}, digest, ...versions }

489 }

490 };

491 const path = capabilityLockPath(projectRoot);

492

runtime/graph-ui/assets/index-B7e9pFJw.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/graph-ui/assets/index-B7e9pFJw.jsView on unpkg · L218

dist/index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L523

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L523

runtime/hooks/silent-update.mjsView file

347const out = openSync(logPath, 'a'); L348: const child = spawn('npm install -g paqad-ai@latest && paqad-ai update --silent', { L349: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

runtime/hooks/silent-update.mjsView on unpkg · L347

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView file

•path = [redacted]-mechanism-review/scripts/scan-auth-smells.sh kind = build_helper sizeBytes = 1583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/capabilities/security/skills/auth-mechanism-review/scripts/scan-auth-smells.shView on unpkg