sajicode@2.0.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sajicode@2.0.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/tools/validation-tools.jsView file

119patternName = generic_password severity = medium line = 119 matchedText = // passw... env

Medium

Secret Pattern

Hardcoded password in dist/tools/validation-tools.js

dist/tools/validation-tools.jsView on unpkg · L119

130patterns.push({ L131: label: "Use of eval() — potential code injection", L132: regex: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/validation-tools.jsView on unpkg · L130

dist/tools/process-state.jsView file

93const raw = await fs.readFile(this.stateFile, "utf-8"); L94: const parsed = JSON.parse(raw); L95: // Strip any records whose commands now match NEVER_CACHE_PATTERNS — ... L136: reason: `"${command}" is already running (PID: ${record.pid})`, L137: output: record.stdout, L138: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/process-state.jsView on unpkg · L93

dist/daemon/service-install.jsView file

11const resolved = path.resolve(projectPath); L12: const platform = process.platform; L13: if (platform === "linux") { ... L38: " sudo systemctl daemon-reload", L39: " sudo systemctl enable sajicode-daemon", L40: " sudo systemctl start sajicode-daemon",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/daemon/service-install.jsView on unpkg · L11

skills/testing/SKILL.mdView file

124patternName = generic_password severity = medium line = 124 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in skills/testing/SKILL.md

skills/testing/SKILL.mdView on unpkg · L124

141patternName = generic_password severity = medium line = 141 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in skills/testing/SKILL.md

skills/testing/SKILL.mdView on unpkg · L141

143patternName = generic_password severity = medium line = 143 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in skills/testing/SKILL.md

skills/testing/SKILL.mdView on unpkg · L143

Source & flagged code

7 flagged

dist/tools/validation-tools.jsView file

Lines 99-150javascript

99 label: "Hardcoded Anthropic/OpenAI API key (sk-...)",

100 regex: /sk-[a-zA-Z0-9]{48}/,

101 },

102 {

103 label: "Hardcoded AWS access key (AKIA...)",

104 regex: /AKIA[0-9A-Z]{16}/,

105 },

106 {

107 label: "Hardcoded GitHub personal access token (ghp_...)",

108 regex: /ghp_[a-zA-Z0-9]{36}/,

109 },

110 {

111 label: "RSA private key header",

112 regex: RSA_PRIVATE_KEY_HEADER_REGEX,

113 },

114 {

115 label: "Private key header",

116 regex: GENERIC_PRIVATE_KEY_HEADER_REGEX,

117 },

118 {

119 // password = "literal value of 8+ chars" that is NOT reading from env

Medium

Secret Pattern

Hardcoded password in dist/tools/validation-tools.js

dist/tools/validation-tools.jsView on unpkg · L119

120 // Excludes: process.env, os.environ, getenv, ${...}

121 label: 'Hardcoded password literal (password = "...")',

122 regex: /password\s*=\s*"(?!\s*\$\{)[^"]{8,}"/i,

123 },

124];

125// Patterns that produce WARNINGS (non-blocking)

126function buildWarningPatterns(filePath) {

127 const ext = nodePath.extname(filePath).toLowerCase();

128 const patterns = [];

129 if (ext === ".js" || ext === ".ts" || ext === ".jsx" || ext === ".tsx") {

130 patterns.push({

131 label: "Use of eval() — potential code injection",

132 regex: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/validation-tools.jsView on unpkg · L130

133 });

134 }

135 if (ext === ".py") {

136 // exec( in Python but not subprocess.exec or os.execv etc.

137 patterns.push({

138 label: "Use of exec() — potential code injection (non-subprocess)",

139 regex: /(?<!subprocess\.)(?<!os\.)\bexec\s*\(/,

140 });

141 }

142 // SQL injection: raw string concatenation into SELECT

143 // e.g. "SELECT" + userInput or f"SELECT {var}"

144 patterns.push({

145 label: 'Raw string concatenation into SQL query ("SELECT" + var or f"SELECT {var}")',

146 regex: /["']SELECT\b[^"']*["']\s*\+|f["']SELECT\b[^"']*\{/i,

147 });

148 // fetch/requests calls to http:// URLs (missing HTTPS)

149 patterns.push({

150 label: "HTTP (non-HTTPS) URL in fetch/request call — potential MITM risk",

dist/tools/process-state.jsView file

Lines 73-113javascript

73 }

74 catch {

75 return false;

76 }

77}

78function truncateOutput(output) {

79 if (

dist/daemon/service-install.jsView file

Lines 1-31javascript

1import fs from "node:fs/promises";

2import os from "node:os";

3import path from "node:path";

4function nodePath() {

5

skills/testing/SKILL.mdView file

Lines 104-163markdown

104 return Promise.resolve({ ok: false, status: 404 });

105});

106

107// Spy on method

108const logSpy = vi.spyOn(logger, "error");

109await processOrder(invalidOrder);

110expect(logSpy).toHaveBeenCalledWith("Order processing failed", expect.any(Object));

111```

112

113## API Integration Testing

114

115```ts