registry / thuban / 0.3.3

thuban@0.3.3

The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Zero dependencies.

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 32 file(s), 489 KB of source, external domains: github.com, thuban.dev

Source & flagged code

8 flagged

packages/scanner/secret-scanner.test.jsView file

Lines 4-50javascript

4const os = require('os');

5const path = require('path');

6const { execFileSync } = require('child_process');

7const SecretScanner = require('./secret-scanner');

9function createTempRepo() {

10 const rootPath = fs.mkdtempSync(path.join(os.tmpdir(), 'thuban-secret-scanner-'));

11 execFileSync('git', ['init'], { cwd: rootPath, stdio: 'ignore' });

12 execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: rootPath, stdio: 'ignore' });

13 execFileSync('git', ['config', 'user.name', 'Test User'], { cwd: rootPath, stdio: 'ignore' });

14 return rootPath;

15}

17test('detects hardcoded secrets, .env exposure, and history leaks', async () => {

18 const rootPath = createTempRepo();

20 fs.writeFileSync(path.join(rootPath, '.gitignore'), 'node_modules/\n');

21 fs.writeFileSync(

22 path.join(rootPath, 'config.js'),

23 [

24 'const stripe = "sk_live_1234567890abcdefghijklmnop";',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

packages/scanner/secret-scanner.test.jsView on unpkg · L24

Critical

Secret Pattern

Stripe live secret key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L24

25 'const password = "SuperSecret123!";',

Medium

Secret Pattern

Hardcoded password in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L25

26 'const token = "Bearer abcdefghijklmnopqrstuvwxyz123456";',

27 'const db = "postgres://appuser:dbpassword@localhost:5432/app";'

28 ].join('\n')

29 );

30 fs.writeFileSync(path.join(rootPath, '.env'), 'API_KEY=AIzaSyA123456789012345678901234567890123\n');

High

Secret Pattern

Google API key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L30

32 execFileSync('git', ['add', '.'], { cwd: rootPath, stdio: 'ignore' });

33 execFileSync('git', ['commit', '-m', 'initial'], { cwd: rootPath, stdio: 'ignore' });

35 fs.writeFileSync(path.join(rootPath, 'removed.js'), 'const oldKey = "ghp_abcdefghijklmnopqrstuvwxyz123456";\n');

36 execFileSync('git', ['add', 'removed.js'], { cwd: rootPath, stdio: 'ignore' });

37 execFileSync('git', ['commit', '-m', 'add leaked token'], { cwd: rootPath, stdio: 'ignore' });

38 fs.unlinkSync(path.join(rootPath, 'removed.js'));

39 execFileSync('git', ['add', '-A'], { cwd: rootPath, stdio: 'ignore' });

40 execFileSync('git', ['commit', '-m', 'remove leaked token'], { cwd: rootPath, stdio: 'ignore' });

42 const scanner = new SecretScanner({ rootPath });

43 const result = await scanner.scanAll();

45 assert.ok(result.issues.some((issue) => issue.type === 'Stripe Secret Key'));

46 assert.ok(result.issues.some((issue) => issue.type === 'Hardcoded Password or Secret Assignment'));

47 assert.ok(result.issues.some((issue) => issue.type === 'Database Connection String with Password'));

48 assert.ok(result.issues.some((issue) => issue.type === '.env File Present'));

49 assert.ok(result.issues.some((issue) => issue.type.includes('Git History')));

50 assert.ok(result.summary.bySeverity.critical >= 1);

packages/scanner/code-scanner.jsView file

Lines 96-136javascript

96 },

97 {

98 id: 'SEC002',

99 name: 'Hardcoded Password',

100 pattern: /password\s*[:=]\s*['"][^'"]+['"]/i,

101 severity

packages/scanner/ghost-code-detector.jsView file

Lines 1-30javascript

1/**

2 * Thuban Ghost Code Detector

3 *

4 * @purpose Find AI-generated functions that were pasted but never called

5 * @module thuban

6 * @layer scanner

7 * @exports-to cli

8 * @critical-for Unique feature — no other tool targets "pasted but unwired" code

9 */

packages/scanner/copy-paste-detector.jsView file

Lines 1-36javascript

1/**

2 * Thuban Copy-Paste Drift Detector

3 *

4 * @purpose Find similar code blocks pasted in multiple files with slight variations

5 * @module thuban

6 * @layer scanner

7 * @exports-to cli

8 * @critical-for Code quality — AI generates similar solutions everywhere

9 */

cli.jsView file

Lines 64-104javascript

64 bgGreen: '\x1b[42m',

65 bgYellow: '\x1b[43m',

66};

68function c(color, text) {

69 return `${COLORS[color]}${

Source & flagged code

8 flagged · loading source

packages/scanner/secret-scanner.test.jsView file

24patternName = stripe_live_secret severity = critical line = 24 matchedText = 'const s...";',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

packages/scanner/secret-scanner.test.jsView on unpkg · L24

24patternName = stripe_live_secret severity = critical line = 24 matchedText = 'const s...";',

Critical

Secret Pattern

Stripe live secret key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L24

30patternName = google_api_key severity = high line = 30 matchedText = fs.write...n');

High

Secret Pattern

Google API key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L30

25patternName = generic_password severity = medium line = 25 matchedText = 'const p...";',

Medium

Secret Pattern

Hardcoded password in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L25

packages/scanner/code-scanner.jsView file

116id: 'SEC004', L117: name: 'eval() Usage', L118: pattern: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

packages/scanner/code-scanner.jsView on unpkg · L116

packages/scanner/ghost-code-detector.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/scanner/ghost-code-detector.jsView on unpkg · L10

packages/scanner/copy-paste-detector.jsView file

16constructor(opts = {}) { L17: this.rootPath = opts.rootPath || process.cwd(); L18: this.minLines = opts.minLines || 5; // Minimum function size to consider ... L62: L63: // ─── Private ───────────────────────────────────────────── L64:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/scanner/copy-paste-detector.jsView on unpkg · L16

cli.jsView file

84const status = lm.getStatus(); L85: const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L86: console.log(c('gray', ` v${pkg.version} · ${status.tierName} tier`) + (status.licensed ? c('green', ' ✓') : '') + c('gray', ' · https://thuban.dev')); L87: console.log(''); ... L355: const tmpDir = path.join(os.tmpdir(), 'thuban-scan-' + Date.now()); L356: const { execFileSync } = require('child_process'); L357: try { ... L1752: const { exec } = require('child_process'); L1753: const platform = process.platform; L1754: const cmd = platform === 'win32' ? 'start' : platform === 'darwin' ? 'open' : 'xdg-open'; ... L2203: function getTelemetryConfigPath() { L2204: const home = process.env.HOME || process.env.USERPROFILE || os.homedir();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.jsView on unpkg · L84

Findings

2 Critical2 High5 Medium7 Low

CriticalCritical Secretpackages/scanner/secret-scanner.test.js

CriticalSecret Patternpackages/scanner/secret-scanner.test.js

HighSandbox Evasion Gated Capabilitycli.js

HighSecret Patternpackages/scanner/secret-scanner.test.js

MediumDynamic Requirepackages/scanner/ghost-code-detector.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpackages/scanner/secret-scanner.test.js

LowScripts Present

LowEvalpackages/scanner/code-scanner.js

LowWeak Cryptopackages/scanner/copy-paste-detector.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

packages/scanner/secret-scanner.test.jsView file

Lines 4-50javascript

4const os = require('os');

5const path = require('path');

6const { execFileSync } = require('child_process');

7const SecretScanner = require('./secret-scanner');

9function createTempRepo() {

10 const rootPath = fs.mkdtempSync(path.join(os.tmpdir(), 'thuban-secret-scanner-'));

11 execFileSync('git', ['init'], { cwd: rootPath, stdio: 'ignore' });

12 execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: rootPath, stdio: 'ignore' });

13 execFileSync('git', ['config', 'user.name', 'Test User'], { cwd: rootPath, stdio: 'ignore' });

14 return rootPath;

15}

17test('detects hardcoded secrets, .env exposure, and history leaks', async () => {

18 const rootPath = createTempRepo();

20 fs.writeFileSync(path.join(rootPath, '.gitignore'), 'node_modules/\n');

21 fs.writeFileSync(

22 path.join(rootPath, 'config.js'),

23 [

24 'const stripe = "sk_live_1234567890abcdefghijklmnop";',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

packages/scanner/secret-scanner.test.jsView on unpkg · L24

Critical

Secret Pattern

Stripe live secret key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L24

25 'const password = "SuperSecret123!";',

Medium

Secret Pattern

Hardcoded password in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L25

26 'const token = "Bearer abcdefghijklmnopqrstuvwxyz123456";',

27 'const db = "postgres://appuser:dbpassword@localhost:5432/app";'

28 ].join('\n')

29 );

30 fs.writeFileSync(path.join(rootPath, '.env'), 'API_KEY=AIzaSyA123456789012345678901234567890123\n');

High

Secret Pattern

Google API key in packages/scanner/secret-scanner.test.js

packages/scanner/secret-scanner.test.jsView on unpkg · L30

32 execFileSync('git', ['add', '.'], { cwd: rootPath, stdio: 'ignore' });

33 execFileSync('git', ['commit', '-m', 'initial'], { cwd: rootPath, stdio: 'ignore' });

35 fs.writeFileSync(path.join(rootPath, 'removed.js'), 'const oldKey = "ghp_abcdefghijklmnopqrstuvwxyz123456";\n');

36 execFileSync('git', ['add', 'removed.js'], { cwd: rootPath, stdio: 'ignore' });

37 execFileSync('git', ['commit', '-m', 'add leaked token'], { cwd: rootPath, stdio: 'ignore' });

38 fs.unlinkSync(path.join(rootPath, 'removed.js'));

39 execFileSync('git', ['add', '-A'], { cwd: rootPath, stdio: 'ignore' });

40 execFileSync('git', ['commit', '-m', 'remove leaked token'], { cwd: rootPath, stdio: 'ignore' });

42 const scanner = new SecretScanner({ rootPath });

43 const result = await scanner.scanAll();

45 assert.ok(result.issues.some((issue) => issue.type === 'Stripe Secret Key'));

46 assert.ok(result.issues.some((issue) => issue.type === 'Hardcoded Password or Secret Assignment'));

47 assert.ok(result.issues.some((issue) => issue.type === 'Database Connection String with Password'));

48 assert.ok(result.issues.some((issue) => issue.type === '.env File Present'));

49 assert.ok(result.issues.some((issue) => issue.type.includes('Git History')));

50 assert.ok(result.summary.bySeverity.critical >= 1);

packages/scanner/code-scanner.jsView file

Lines 96-136javascript

96 },

97 {

98 id: 'SEC002',

99 name: 'Hardcoded Password',

100 pattern: /password\s*[:=]\s*['"][^'"]+['"]/i,

101 severity

packages/scanner/ghost-code-detector.jsView file

Lines 1-30javascript

1/**

2 * Thuban Ghost Code Detector

3 *

4 * @purpose Find AI-generated functions that were pasted but never called

5 * @module thuban

6 * @layer scanner

7 * @exports-to cli

8 * @critical-for Unique feature — no other tool targets "pasted but unwired" code

9 */

packages/scanner/copy-paste-detector.jsView file

Lines 1-36javascript

1/**

2 * Thuban Copy-Paste Drift Detector

3 *

4 * @purpose Find similar code blocks pasted in multiple files with slight variations

5 * @module thuban

6 * @layer scanner

7 * @exports-to cli

8 * @critical-for Code quality — AI generates similar solutions everywhere

9 */

cli.jsView file

Lines 64-104javascript

64 bgGreen: '\x1b[42m',

65 bgYellow: '\x1b[43m',

66};

68function c(color, text) {

69 return `${COLORS[color]}${