Loading npm security reports…
sdlc-agent-4-enterprise-server@1.10.0: Clean npm security report | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 47 low-signal pattern(s) reviewed.
sdlc-agent-4-enterprise-server@1.10.0 Code Intelligence MCP Server — multi-agent SDLC pipeline with semantic memory, code graph, and draw.io integration
scanned 3mo ago · by lpm-firewall-ai Static signals map to a code-intelligence server, test fixtures, optional verified native dependency retrieval, and explicit VS Code extension features. Source inspection found no concrete malicious chain or install-time control-surface mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the package CLI/server.
Impact
Creates local server/database state; no source-confirmed credential theft, stealth persistence, or foreign-agent mutation from the npm entry point.
Mechanism
MCP server startup with optional verified native SQLite binding retrieval.
AI rationale
Static signals map to a code-intelligence server, test fixtures, optional verified native dependency retrieval, and explicit VS Code extension features. Source inspection found no concrete malicious chain or install-time control-surface mutation.
Evidence
package.json dist/index.js src/engine/db/database-manager.ts src/engine/db/resolver/download.ts src/engine/db/resolver/manifest.ts extension/src/platform-swap/swap-commands.ts .code-intel/index.db
Network endpoints1
github.com /dnguyenminh/Kiro-SDLC-Agents/releases/download/better-sqlite3-v12.10.0/
public snapshot AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Runtime can download a native SQLite binding and load it with process.dlopen. Extension sources include explicit agent-config swap/injection features. Evidence against
package.json has only prepublishOnly; no install-time lifecycle hook. dist/index.js starts the declared MCP/HTTP server; no import-time harvesting or exfiltration found. Native download URLs are embedded GitHub release URLs and downloads are SHA-256 verified. Agent-config swaps require registered user commands and VS Code QuickPick selection. Credential-like strings are detector test fixtures, not secrets. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket
Supply chain HighEntropyStrings Minified Protestware
37 flagged · loading source dist/modules/memory/masking/__tests__/CredentialDetector.test.js View file 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 32 patternName = private_key_rsa
severity = critical
line = 32
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
5 Critical 6 High 29 Medium 7 Low
Critical Critical Secret dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Secret Pattern dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Secret Pattern dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Secret Pattern src/modules/memory/masking/__tests__/CredentialDetector.test.ts
Critical Secret Pattern src/modules/memory/masking/__tests__/CredentialDetector.test.ts
High Child Process extension/scripts/gen-checksums.js
High Shell tests/e2e/setup/global-setup.ts
High Same File Env Network Execution extension/webview-assets/3d-force-graph.min.js
High Sandbox Evasion Gated Capability dist/engine/tools/drawio-renderers.js
Affected versions and remediation This report applies to sdlc-agent-4-enterprise-server@1.10.0 .
See all versions of sdlc-agent-4-enterprise-server for other recorded verdicts.
Review the evidence and your use of sdlc-agent-4-enterprise-server@1.10.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-07-31 11:32:06.089Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
91% Clean
AI assessment confidence
Package metadata npm Author SA4E Team
Maintainers dnguyenminh1975
Version 1.10.0
Latest on npm 1.55.1
Published Jul 16, 2026
License MIT
Dependencies 12
Integrity verified
Package size 3.40 MB
Files 2,400
Keywords mcp code-intelligence sdlc agents memory knowledge-base draw.io
Telemetry
UrlStrings
Manifest No manifest risk signals triggered.
scanned 1,217 file(s), 8.46 MB of source, external domains: 127.0.0.1, api-inference.huggingface.co, api.302.ai, api.abacus.ai, api.abliteration.ai, api.aihubmix.com, api.ambient.ai, api.anthropic.com, api.anyapi.io, api.atomic.chat, api.auriko.com, api.bailing.ai, api.berget.ai, api.cerebras.ai, api.chutes.ai, api.clarifai.com, api.claudinio.com, api.cohere.com, api.cortecs.ai, api.crofai.com, api.d.run, api.deepinfra.com, api.deepseek.com, api.digitalocean.com, api.dinference.com, api.duckduckgo.com, api.evroc.com, api.fastrouter.ai, api.fireworks.ai, api.freemodel.ai, api.frogbot.ai, api.github.com, api.gmi.ai, api.groq.com, api.hpc-ai.com, api.hunyuan.cloud.tencent.com, api.hyperbolic.xyz, api.iflow.ai, api.inception.ai, api.inceptron.ai, api.inference.net, api.io.net, api.jiekou.ai, api.kenari.ai, api.kuae.cloud, api.lilac.ai, api.llama-api.com, api.llmtr.com, api.longcat.ai, api.lucidquery.com
dist/modules/memory/masking/__tests__/CredentialDetector.test.js
10 const crypto = require("crypto");
L11: const { execSync } = require("child_process");
L12:
High Child Process
Package source references child process execution.
extension/scripts/gen-checksums.js View on unpkg · L10 60 stdio: ['ignore', 'pipe', 'pipe'],
L61: shell: true,
L62: });
High Shell
Package source references shell execution.
tests/e2e/setup/global-setup.ts View on unpkg · L60 48 const serverEntry = path.resolve(__dirname, '../../../src/index.ts');
L49: serverProcess = spawn('npx', ['tsx', serverEntry], {
L50: cwd: path.resolve(__dirname, '../../..'),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
tests/e2e/setup/global-setup.ts View on unpkg · L48 extension/webview-assets/3d-force-graph.min.js View file 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
L4: // Analyze the 2 colors and returns the color contrast defined by (WCAG Version 2)
L5: op.readability=function(e,t){var n=op(e),i=op(t);return(Math.max(n.getLuminance(),i.getLuminance())+.05)/(Math.min(n.getLuminance(),i.getLuminance())+.05)},op.isReadable=function(e...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
Low Eval
Package source references a known benign dynamic code generation pattern.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 35 Object.defineProperty(exports, "__esModule", { value: true });
L36: const vitest_1 = require("vitest");
L37: const fs = __importStar(require("fs"));
Medium Dynamic Require
Package source references dynamic require/import behavior.
extension/tests/mcp-bridge.test.js View on unpkg · L35 dist/engine/tools/drawio-renderers.js View file 1 import * as fs from 'fs';
L2: import { execSync } from 'child_process';
L3: let _cachedDrawioCliPath = null;
...
L13: const candidates = [];
L14: if (process.platform === 'win32') {
L15: candidates.push('C:\\Program Files\\draw.io\\draw.io.exe', `${process.env.LOCALAPPDATA || ''}\\Programs\\draw.io\\draw.io.exe`, `${process.env.PROGRAMFILES || ''}\\draw.io\\draw.io...
L16: }
...
L43: const xml = fs.readFileSync(inputPath, 'utf-8');
L44: const encoded = Buffer.from(xml).toString('base64');
L45: const viewerUrl = `https://viewer.diagrams.net/?lightbox=1&nav=0#R${encoded}`;
L46: await orchestrationEngine.executeUpstreamTool('chrome-devtools-mcp', 'navigate_page', {
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/engine/tools/drawio-renderers.js View on unpkg · L1 src/engine/parsers/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
src/engine/parsers/grammars/tree-sitter-go.wasm View on unpkg extension/scripts/capture-screenshots.py View file • path = extension/scripts/capture-screenshots.py
kind = build_helper
sizeBytes = 1578
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
extension/scripts/capture-screenshots.py View on unpkg src/engine/parsers/languages/__tests__/fixtures/simple-function.py View file • path = src/engine/parsers/languages/__tests__/fixtures/simple-function.py
kind = payload_in_excluded_dir
sizeBytes = 1514
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
src/engine/parsers/languages/__tests__/fixtures/simple-function.py View on unpkg dist/admin/__tests__/admin-db.test.js View file 24 patternName = generic_password
severity = medium
line = 24
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in dist/admin/__tests__/admin-db.test.js
dist/admin/__tests__/admin-db.test.js View on unpkg · L24 dist/modules/memory/masking/detectors/CredentialDetector.js View file 4 patternName = generic_password
severity = medium
line = 4
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in dist/modules/memory/masking/detectors/CredentialDetector.js
dist/modules/memory/masking/detectors/CredentialDetector.js View on unpkg · L4 81 patternName = generic_password
severity = medium
line = 81
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L81 147 patternName = generic_password
severity = medium
line = 147
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L147 159 patternName = generic_password
severity = medium
line = 159
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L159 166 patternName = generic_password
severity = medium
line = 166
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L166 209 patternName = generic_password
severity = medium
line = 209
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L209 227 patternName = generic_password
severity = medium
line = 227
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L227 251 patternName = generic_password
severity = medium
line = 251
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L251 262 patternName = generic_password
severity = medium
line = 262
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L262 279 patternName = generic_password
severity = medium
line = 279
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L279 287 patternName = generic_password
severity = medium
line = 287
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L287 83 patternName = generic_password
severity = medium
line = 83
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L83 122 patternName = generic_password
severity = medium
line = 122
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L122 257 patternName = generic_password
severity = medium
line = 257
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L257 124 patternName = generic_password
severity = medium
line = 124
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L124 140 patternName = generic_password
severity = medium
line = 140
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L140 155 patternName = generic_password
severity = medium
line = 155
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L155 171 patternName = generic_password
severity = medium
line = 171
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L171 341 patternName = generic_password
severity = medium
line = 341
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L341 src/admin/__tests__/admin-db.test.ts View file 58 patternName = generic_password
severity = medium
line = 58
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in src/admin/__tests__/admin-db.test.ts
src/admin/__tests__/admin-db.test.ts View on unpkg · L58 src/modules/memory/masking/__tests__/CredentialDetector.test.ts View file 14 patternName = github_pat
severity = critical
line = 14
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L14 39 patternName = private_key_rsa
severity = critical
line = 39
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L39 src/modules/memory/masking/detectors/CredentialDetector.ts View file 7 patternName = generic_password
severity = medium
line = 7
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in src/modules/memory/masking/detectors/CredentialDetector.ts
src/modules/memory/masking/detectors/CredentialDetector.ts View on unpkg · L7 High
Runtime Package Install
tests/e2e/setup/global-setup.ts
High Payload In Excluded Dir src/engine/parsers/languages/__tests__/fixtures/simple-function.py
Medium Dynamic Require extension/tests/mcp-bridge.test.js
Medium Ships Wasm Module src/engine/parsers/grammars/tree-sitter-go.wasm
Medium Ships Build Helper extension/scripts/capture-screenshots.py
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/admin/__tests__/admin-db.test.js
Medium Secret Pattern dist/modules/memory/masking/detectors/CredentialDetector.js
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern src/admin/__tests__/admin-db.test.ts
Medium Secret Pattern src/modules/memory/masking/detectors/CredentialDetector.ts
Low Non Install Lifecycle Scripts
Low Eval extension/webview-assets/3d-force-graph.min.js
package.json
Entrypoints main → dist/index.js types → ./dist/index.d.ts bin → sdlc-agent-4-enterprise-server
Runtime node >=18.14.1
Artifact 17.4 MB · 2,400 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket HighEntropyStrings Minified Protestware Telemetry UrlStrings Manifest: clean
37 flagged dist/modules/memory/masking/__tests__/CredentialDetector.test.js View file 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 32 patternName = private_key_rsa
severity = critical
line = 32
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L32 10 const crypto = require("crypto");
L11: const { execSync } = require("child_process");
L12:
High Child Process
Package source references child process execution.
extension/scripts/gen-checksums.js View on unpkg · L10 60 stdio: ['ignore', 'pipe', 'pipe'],
L61: shell: true,
L62: });
High Shell
Package source references shell execution.
tests/e2e/setup/global-setup.ts View on unpkg · L60 48 const serverEntry = path.resolve(__dirname, '../../../src/index.ts');
L49: serverProcess = spawn('npx', ['tsx', serverEntry], {
L50: cwd: path.resolve(__dirname, '../../..'),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
tests/e2e/setup/global-setup.ts View on unpkg · L48 extension/webview-assets/3d-force-graph.min.js View file 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
L4: // Analyze the 2 colors and returns the color contrast defined by (WCAG Version 2)
L5: op.readability=function(e,t){var n=op(e),i=op(t);return(Math.max(n.getLuminance(),i.getLuminance())+.05)/(Math.min(n.getLuminance(),i.getLuminance())+.05)},op.isReadable=function(e...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
Low Eval
Package source references a known benign dynamic code generation pattern.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 35 Object.defineProperty(exports, "__esModule", { value: true });
L36: const vitest_1 = require("vitest");
L37: const fs = __importStar(require("fs"));
Medium Dynamic Require
Package source references dynamic require/import behavior.
extension/tests/mcp-bridge.test.js View on unpkg · L35 dist/engine/tools/drawio-renderers.js View file 1 import * as fs from 'fs';
L2: import { execSync } from 'child_process';
L3: let _cachedDrawioCliPath = null;
...
L13: const candidates = [];
L14: if (process.platform === 'win32') {
L15: candidates.push('C:\\Program Files\\draw.io\\draw.io.exe', `${process.env.LOCALAPPDATA || ''}\\Programs\\draw.io\\draw.io.exe`, `${process.env.PROGRAMFILES || ''}\\draw.io\\draw.io...
L16: }
...
L43: const xml = fs.readFileSync(inputPath, 'utf-8');
L44: const encoded = Buffer.from(xml).toString('base64');
L45: const viewerUrl = `https://viewer.diagrams.net/?lightbox=1&nav=0#R${encoded}`;
L46: await orchestrationEngine.executeUpstreamTool('chrome-devtools-mcp', 'navigate_page', {
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/engine/tools/drawio-renderers.js View on unpkg · L1 src/engine/parsers/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
src/engine/parsers/grammars/tree-sitter-go.wasm View on unpkg extension/scripts/capture-screenshots.py View file • path = extension/scripts/capture-screenshots.py
kind = build_helper
sizeBytes = 1578
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
extension/scripts/capture-screenshots.py View on unpkg src/engine/parsers/languages/__tests__/fixtures/simple-function.py View file • path = src/engine/parsers/languages/__tests__/fixtures/simple-function.py
kind = payload_in_excluded_dir
sizeBytes = 1514
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
src/engine/parsers/languages/__tests__/fixtures/simple-function.py View on unpkg dist/admin/__tests__/admin-db.test.js View file 24 patternName = generic_password
severity = medium
line = 24
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in dist/admin/__tests__/admin-db.test.js
dist/admin/__tests__/admin-db.test.js View on unpkg · L24 dist/modules/memory/masking/detectors/CredentialDetector.js View file 4 patternName = generic_password
severity = medium
line = 4
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in dist/modules/memory/masking/detectors/CredentialDetector.js
dist/modules/memory/masking/detectors/CredentialDetector.js View on unpkg · L4 81 patternName = generic_password
severity = medium
line = 81
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L81 147 patternName = generic_password
severity = medium
line = 147
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L147 159 patternName = generic_password
severity = medium
line = 159
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L159 166 patternName = generic_password
severity = medium
line = 166
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts 83 patternName = generic_password
severity = medium
line = 83
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L83 122 patternName = generic_password
severity = medium
line = 122
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L122 257 patternName = generic_password
severity = medium
line = 257
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L257 124 patternName = generic_password
severity = medium
line = 124
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L124 140 patternName = generic_password
severity = medium
line = 140
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L140 155 patternName = generic_password
severity = medium
line = 155
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L155 171 patternName = generic_password
severity = medium
line = 171
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
src/admin/__tests__/admin-db.test.ts View file 58 patternName = generic_password
severity = medium
line = 58
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in src/admin/__tests__/admin-db.test.ts
src/admin/__tests__/admin-db.test.ts View on unpkg · L58 src/modules/memory/masking/__tests__/CredentialDetector.test.ts View file 14 patternName = github_pat
severity = critical
line = 14
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L14 39 patternName = private_key_rsa
severity = critical
line = 39
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L39 src/modules/memory/masking/detectors/CredentialDetector.ts View file 7 patternName = generic_password
severity = medium
line = 7
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in src/modules/memory/masking/detectors/CredentialDetector.ts
src/modules/memory/masking/detectors/CredentialDetector.ts View on unpkg · L7 209 patternName = generic_password
severity = medium
line = 209
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L209 227 patternName = generic_password
severity = medium
line = 227
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L227 251 patternName = generic_password
severity = medium
line = 251
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L251 262 patternName = generic_password
severity = medium
line = 262
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L262 279 patternName = generic_password
severity = medium
line = 279
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L279 287 patternName = generic_password
severity = medium
line = 287
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L287 tests/e2e/multi-tenant.e2e.test.ts
341 patternName = generic_password
severity = medium
line = 341
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L341