Loading npm security reports…
sdlc-agent-4-enterprise-server@1.14.0: Clean npm security report | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 50 low-signal pattern(s) reviewed.
sdlc-agent-4-enterprise-server@1.14.0 Code Intelligence MCP Server — multi-agent SDLC pipeline with semantic memory, code graph, and draw.io integration
scanned 3mo ago · by lpm-firewall-ai Source inspection found a package-aligned MCP/server application with no install hook and no concrete malicious chain. Static alerts stem from optional runtime tooling, explicit extension configuration, and test fixtures.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the declared server or invokes extension commands.
Impact
No unconsented install-time mutation, credential exfiltration, remote payload execution, or destructive behavior established.
Mechanism
Local MCP service, optional configured LLM/web requests, and explicit workspace configuration.
AI rationale
Source inspection found a package-aligned MCP/server application with no install hook and no concrete malicious chain. Static alerts stem from optional runtime tooling, explicit extension configuration, and test fixtures.
Evidence
package.json dist/index.js start.js extension/src/mcp-injector.ts extension/src/mcp-config-builder.ts servers/fastapi/tests/mocks/normalizers.py .kiro/settings/mcp.json .code-intel/orchestration.json
Network endpoints5
127.0.0.1:8000 localhost:11434 api.openai.com /v1api.anthropic.com /v1api.duckduckgo.com /
public snapshot AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
package.json has only prepublishOnly; no install-time lifecycle hook. dist/index.js starts the declared MCP HTTP server; no hidden install/import execution found. start.js is not a manifest entrypoint and its Ollama installer is gated by START_OLLAMA=true. Extension MCP writes target workspace .kiro config only through explicit UI/server actions and uses localhost. Credential test strings are fixtures; normalizers.py is plain test normalization code. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket
Supply chain HighEntropyStrings Minified Protestware Telemetry UrlStrings
Manifest No manifest risk signals triggered.
40 flagged · loading source dist/modules/memory/masking/__tests__/CredentialDetector.test.js View file 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 32 patternName = private_key_rsa
severity = critical
line = 32
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
6 Critical 6 High 30 Medium 8 Low
Critical Critical Secret dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Previous Version Dangerous Delta start.js
Critical Secret Pattern dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Secret Pattern dist/modules/memory/masking/__tests__/CredentialDetector.test.js
Critical Secret Pattern src/modules/memory/masking/__tests__/CredentialDetector.test.ts
Critical Secret Pattern src/modules/memory/masking/__tests__/CredentialDetector.test.ts
High Child Process start.js
High Shell tests/e2e/setup/global-setup.ts
High Same File Env Network Execution extension/webview-assets/3d-force-graph.min.js
High Sandbox Evasion Gated Capability
Affected versions and remediation This report applies to sdlc-agent-4-enterprise-server@1.14.0 .
See all versions of sdlc-agent-4-enterprise-server for other recorded verdicts.
Review the evidence and your use of sdlc-agent-4-enterprise-server@1.14.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-07-19 18:16:47.029Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
91% Clean
AI assessment confidence
Package metadata npm Author SA4E Team
Maintainers dnguyenminh1975
Version 1.14.0
Latest on npm 1.55.2
Published Jul 19, 2026
License MIT
Dependencies 12
Integrity verified
Package size 6.93 MB
Files 3,552
Keywords mcp code-intelligence sdlc agents memory knowledge-base draw.io
scanned 1,798 file(s), 12.5 MB of source, external domains: 127.0.0.1, 192.168.1.7, api-eu.mixpanel.com, api-inference.huggingface.co, api.302.ai, api.abacus.ai, api.abliteration.ai, api.aihubmix.com, api.ambient.ai, api.anthropic.com, api.anyapi.io, api.atomic.chat, api.auriko.com, api.bailing.ai, api.berget.ai, api.cerebras.ai, api.chutes.ai, api.clarifai.com, api.claudinio.com, api.cohere.com, api.cortecs.ai, api.crofai.com, api.d.run, api.deepinfra.com, api.deepseek.com, api.digitalocean.com, api.dinference.com, api.duckduckgo.com, api.evroc.com, api.fastrouter.ai, api.fireworks.ai, api.freemodel.ai, api.frogbot.ai, api.github.com, api.gmi.ai, api.google.com, api.groq.com, api.hpc-ai.com, api.hunyuan.cloud.tencent.com, api.hyperbolic.xyz, api.iflow.ai, api.inception.ai, api.inceptron.ai, api.inference.net, api.io.net, api.jiekou.ai, api.kenari.ai, api.kuae.cloud, api.lilac.ai, api.llama-api.com
dist/modules/memory/masking/__tests__/CredentialDetector.test.js
• matchType = previous_version_dangerous_delta
matchedPackage = sdlc-agent-4-enterprise-server@1.10.0
matchedIdentity = npm:[redacted]:1.10.0
similarity = 0.858
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
start.js View on unpkg 4 import { fileURLToPath } from "url";
L5: import { spawn } from "child_process";
L6: import { randomUUID } from "crypto";
60 stdio: ['ignore', 'pipe', 'pipe'],
L61: shell: true,
L62: });
High Shell
Package source references shell execution.
tests/e2e/setup/global-setup.ts View on unpkg · L60 48 const serverEntry = path.resolve(__dirname, '../../../src/index.ts');
L49: serverProcess = spawn('npx', ['tsx', serverEntry], {
L50: cwd: path.resolve(__dirname, '../../..'),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
tests/e2e/setup/global-setup.ts View on unpkg · L48 extension/webview-assets/3d-force-graph.min.js View file 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
L4: // Analyze the 2 colors and returns the color contrast defined by (WCAG Version 2)
L5: op.readability=function(e,t){var n=op(e),i=op(t);return(Math.max(n.getLuminance(),i.getLuminance())+.05)/(Math.min(n.getLuminance(),i.getLuminance())+.05)},op.isReadable=function(e...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
Low Eval
Package source references a known benign dynamic code generation pattern.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 35 Object.defineProperty(exports, "__esModule", { value: true });
L36: const vitest_1 = require("vitest");
L37: const fs = __importStar(require("fs"));
Medium Dynamic Require
Package source references dynamic require/import behavior.
extension/tests/mcp-bridge.test.js View on unpkg · L35 dist/engine/tools/drawio-renderers.js View file 1 import * as fs from 'fs';
L2: import { execSync } from 'child_process';
L3: let _cachedDrawioCliPath = null;
...
L13: const candidates = [];
L14: if (process.platform === 'win32') {
L15: candidates.push('C:\\Program Files\\draw.io\\draw.io.exe', `${process.env.LOCALAPPDATA || ''}\\Programs\\draw.io\\draw.io.exe`, `${process.env.PROGRAMFILES || ''}\\draw.io\\draw.io...
L16: }
...
L43: const xml = fs.readFileSync(inputPath, 'utf-8');
L44: const encoded = Buffer.from(xml).toString('base64');
L45: const viewerUrl = `https://viewer.diagrams.net/?lightbox=1&nav=0#R${encoded}`;
L46: await orchestrationEngine.executeUpstreamTool('chrome-devtools-mcp', 'navigate_page', {
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/engine/tools/drawio-renderers.js View on unpkg · L1 src/engine/parsers/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
src/engine/parsers/grammars/tree-sitter-go.wasm View on unpkg extension/scripts/capture-screenshots.py View file • path = extension/scripts/capture-screenshots.py
kind = build_helper
sizeBytes = 1578
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
extension/scripts/capture-screenshots.py View on unpkg documents/SA4E-18/BRD-v1-SA4E-18.docx View file • path = documents/SA4E-18/BRD-v1-SA4E-18.docx
kind = compressed_blob
sizeBytes = 1955250
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
documents/SA4E-18/BRD-v1-SA4E-18.docx View on unpkg • path = documents/SA4E-18/BRD-v1-SA4E-18.docx
kind = nested_archive_needs_inspection
sizeBytes = 1955250
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
documents/SA4E-18/BRD-v1-SA4E-18.docx View on unpkg servers/fastapi/tests/mocks/normalizers.py View file • path = [redacted].py
kind = payload_in_excluded_dir
sizeBytes = 489
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
servers/fastapi/tests/mocks/normalizers.py View on unpkg dist/admin/__tests__/admin-db.test.js View file 24 patternName = generic_password
severity = medium
line = 24
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in dist/admin/__tests__/admin-db.test.js
dist/admin/__tests__/admin-db.test.js View on unpkg · L24 dist/modules/memory/masking/detectors/CredentialDetector.js View file 4 patternName = generic_password
severity = medium
line = 4
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in dist/modules/memory/masking/detectors/CredentialDetector.js
dist/modules/memory/masking/detectors/CredentialDetector.js View on unpkg · L4 81 patternName = generic_password
severity = medium
line = 81
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L81 147 patternName = generic_password
severity = medium
line = 147
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L147 159 patternName = generic_password
severity = medium
line = 159
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L159 166 patternName = generic_password
severity = medium
line = 166
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L166 209 patternName = generic_password
severity = medium
line = 209
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L209 227 patternName = generic_password
severity = medium
line = 227
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L227 251 patternName = generic_password
severity = medium
line = 251
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L251 262 patternName = generic_password
severity = medium
line = 262
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L262 279 patternName = generic_password
severity = medium
line = 279
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L279 287 patternName = generic_password
severity = medium
line = 287
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L287 83 patternName = generic_password
severity = medium
line = 83
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L83 122 patternName = generic_password
severity = medium
line = 122
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L122 257 patternName = generic_password
severity = medium
line = 257
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L257 124 patternName = generic_password
severity = medium
line = 124
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L124 140 patternName = generic_password
severity = medium
line = 140
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L140 155 patternName = generic_password
severity = medium
line = 155
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L155 171 patternName = generic_password
severity = medium
line = 171
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L171 341 patternName = generic_password
severity = medium
line = 341
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L341 src/admin/__tests__/admin-db.test.ts View file 58 patternName = generic_password
severity = medium
line = 58
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in src/admin/__tests__/admin-db.test.ts
src/admin/__tests__/admin-db.test.ts View on unpkg · L58 src/modules/memory/masking/__tests__/CredentialDetector.test.ts View file 14 patternName = github_pat
severity = critical
line = 14
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L14 39 patternName = private_key_rsa
severity = critical
line = 39
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L39 src/modules/memory/masking/detectors/CredentialDetector.ts View file 7 patternName = generic_password
severity = medium
line = 7
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in src/modules/memory/masking/detectors/CredentialDetector.ts
src/modules/memory/masking/detectors/CredentialDetector.ts View on unpkg · L7 dist/engine/tools/drawio-renderers.js
High Runtime Package Install tests/e2e/setup/global-setup.ts
High Payload In Excluded Dir servers/fastapi/tests/mocks/normalizers.py
Medium Dynamic Require extension/tests/mcp-bridge.test.js
Medium Ships Wasm Module src/engine/parsers/grammars/tree-sitter-go.wasm
Medium Ships Build Helper extension/scripts/capture-screenshots.py
Medium Ships Compressed Blob documents/SA4E-18/BRD-v1-SA4E-18.docx
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/admin/__tests__/admin-db.test.js
Medium Secret Pattern dist/modules/memory/masking/detectors/CredentialDetector.js
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/integration/auth.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/admin-api.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern tests/e2e/multi-tenant.e2e.test.ts
Medium Secret Pattern src/admin/__tests__/admin-db.test.ts
Medium Secret Pattern src/modules/memory/masking/detectors/CredentialDetector.ts
Low Non Install Lifecycle Scripts
Low Eval extension/webview-assets/3d-force-graph.min.js
Low Nested Archive Needs Inspection documents/SA4E-18/BRD-v1-SA4E-18.docx
package.json
Entrypoints main → dist/index.js types → ./dist/index.d.ts bin → sdlc-agent-4-enterprise-server
Runtime node >=18.14.1
Artifact 29.7 MB · 3,552 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket HighEntropyStrings Minified Protestware Telemetry UrlStrings Manifest: clean
40 flagged dist/modules/memory/masking/__tests__/CredentialDetector.test.js View file 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 11 patternName = github_pat
severity = critical
line = 11
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L11 32 patternName = private_key_rsa
severity = critical
line = 32
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in dist/modules/memory/masking/__tests__/CredentialDetector.test.js
dist/modules/memory/masking/__tests__/CredentialDetector.test.js View on unpkg · L32 • matchType = previous_version_dangerous_delta
matchedPackage = sdlc-agent-4-enterprise-server@1.10.0
matchedIdentity = npm:[redacted]:1.10.0
similarity = 0.858
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
start.js View on unpkg 4 import { fileURLToPath } from "url";
L5: import { spawn } from "child_process";
L6: import { randomUUID } from "crypto";
60 stdio: ['ignore', 'pipe', 'pipe'],
L61: shell: true,
L62: });
High Shell
Package source references shell execution.
tests/e2e/setup/global-setup.ts View on unpkg · L60 48 const serverEntry = path.resolve(__dirname, '../../../src/index.ts');
L49: serverProcess = spawn('npx', ['tsx', serverEntry], {
L50: cwd: path.resolve(__dirname, '../../..'),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
tests/e2e/setup/global-setup.ts View on unpkg · L48 extension/webview-assets/3d-force-graph.min.js View file 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
L4: // Analyze the 2 colors and returns the color contrast defined by (WCAG Version 2)
L5: op.readability=function(e,t){var n=op(e),i=op(t);return(Math.max(n.getLuminance(),i.getLuminance())+.05)/(Math.min(n.getLuminance(),i.getLuminance())+.05)},op.isReadable=function(e...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 1 // Version 1.80.0 3d-force-graph - https://github.com/vasturiano/3d-force-graph
L2: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:...
L3: // <http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef (WCAG Version 2)
Low Eval
Package source references a known benign dynamic code generation pattern.
extension/webview-assets/3d-force-graph.min.js View on unpkg · L1 35 Object.defineProperty(exports, "__esModule", { value: true });
L36: const vitest_1 = require("vitest");
L37: const fs = __importStar(require("fs"));
Medium Dynamic Require
Package source references dynamic require/import behavior.
extension/tests/mcp-bridge.test.js View on unpkg · L35 dist/engine/tools/drawio-renderers.js View file 1 import * as fs from 'fs';
L2: import { execSync } from 'child_process';
L3: let _cachedDrawioCliPath = null;
...
L13: const candidates = [];
L14: if (process.platform === 'win32') {
L15: candidates.push('C:\\Program Files\\draw.io\\draw.io.exe', `${process.env.LOCALAPPDATA || ''}\\Programs\\draw.io\\draw.io.exe`, `${process.env.PROGRAMFILES || ''}\\draw.io\\draw.io...
L16: }
...
L43: const xml = fs.readFileSync(inputPath, 'utf-8');
L44: const encoded = Buffer.from(xml).toString('base64');
L45: const viewerUrl = `https://viewer.diagrams.net/?lightbox=1&nav=0#R${encoded}`;
L46: await orchestrationEngine.executeUpstreamTool('chrome-devtools-mcp', 'navigate_page', {
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/engine/tools/drawio-renderers.js View on unpkg · L1 src/engine/parsers/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
src/engine/parsers/grammars/tree-sitter-go.wasm View on unpkg extension/scripts/capture-screenshots.py View file • path = extension/scripts/capture-screenshots.py
kind = build_helper
sizeBytes = 1578
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
extension/scripts/capture-screenshots.py View on unpkg documents/SA4E-18/BRD-v1-SA4E-18.docx View file • path = documents/SA4E-18/BRD-v1-SA4E-18.docx
kind = compressed_blob
sizeBytes = 1955250
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
documents/SA4E-18/BRD-v1-SA4E-18.docx View on unpkg • path = documents/SA4E-18/BRD-v1-SA4E-18.docx
kind = nested_archive_needs_inspection
sizeBytes = 1955250
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
documents/SA4E-18/BRD-v1-SA4E-18.docx View on unpkg servers/fastapi/tests/mocks/normalizers.py View file • path = [redacted].py
kind = payload_in_excluded_dir
sizeBytes = 489
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
servers/fastapi/tests/mocks/normalizers.py View on unpkg dist/admin/__tests__/admin-db.test.js View file 24 patternName = generic_password
severity = medium
line = 24
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in dist/admin/__tests__/admin-db.test.js
dist/admin/__tests__/admin-db.test.js View on unpkg · L24 dist/modules/memory/masking/detectors/CredentialDetector.js View file 4 patternName = generic_password
severity = medium
line = 4
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in dist/modules/memory/masking/detectors/CredentialDetector.js
dist/modules/memory/masking/detectors/CredentialDetector.js View on unpkg · L4 81 patternName = generic_password
severity = medium
line = 81
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L81 147 patternName = generic_password
severity = medium
line = 147
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L147 159 patternName = generic_password
severity = medium
line = 159
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L159 166 patternName = generic_password
severity = medium
line = 166
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts 83 patternName = generic_password
severity = medium
line = 83
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L83 122 patternName = generic_password
severity = medium
line = 122
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L122 257 patternName = generic_password
severity = medium
line = 257
matchedText = password...3!',
Medium Secret Pattern
Hardcoded password in tests/e2e/admin-api.e2e.test.ts
tests/e2e/admin-api.e2e.test.ts View on unpkg · L257 124 patternName = generic_password
severity = medium
line = 124
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L124 140 patternName = generic_password
severity = medium
line = 140
matchedText = password...ss',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L140 155 patternName = generic_password
severity = medium
line = 155
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L155 171 patternName = generic_password
severity = medium
line = 171
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
src/admin/__tests__/admin-db.test.ts View file 58 patternName = generic_password
severity = medium
line = 58
matchedText = const pa...s!';
Medium Secret Pattern
Hardcoded password in src/admin/__tests__/admin-db.test.ts
src/admin/__tests__/admin-db.test.ts View on unpkg · L58 src/modules/memory/masking/__tests__/CredentialDetector.test.ts View file 14 patternName = github_pat
severity = critical
line = 14
matchedText = const r ...x');
Critical Secret Pattern
GitHub personal access token in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L14 39 patternName = private_key_rsa
severity = critical
line = 39
matchedText = const r ...-');
Critical Secret Pattern
RSA private key in src/modules/memory/masking/__tests__/CredentialDetector.test.ts
src/modules/memory/masking/__tests__/CredentialDetector.test.ts View on unpkg · L39 src/modules/memory/masking/detectors/CredentialDetector.ts View file 7 patternName = generic_password
severity = medium
line = 7
matchedText = password...,}',
Medium Secret Pattern
Hardcoded password in src/modules/memory/masking/detectors/CredentialDetector.ts
src/modules/memory/masking/detectors/CredentialDetector.ts View on unpkg · L7 209 patternName = generic_password
severity = medium
line = 209
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L209 227 patternName = generic_password
severity = medium
line = 227
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L227 251 patternName = generic_password
severity = medium
line = 251
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L251 262 patternName = generic_password
severity = medium
line = 262
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L262 279 patternName = generic_password
severity = medium
line = 279
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L279 287 patternName = generic_password
severity = medium
line = 287
matchedText = body: JS... }),
Medium Secret Pattern
Hardcoded password in tests/integration/auth.test.ts
tests/integration/auth.test.ts View on unpkg · L287 tests/e2e/multi-tenant.e2e.test.ts
341 patternName = generic_password
severity = medium
line = 341
matchedText = password...23',
Medium Secret Pattern
Hardcoded password in tests/e2e/multi-tenant.e2e.test.ts
tests/e2e/multi-tenant.e2e.test.ts View on unpkg · L341