registry / vaspera / 2.19.0

vaspera@2.19.0

Enterprise security certification with deterministic scanners, cost tracking, and compliance mapping

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 50 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 327 file(s), 3.35 MB of source, external domains: adaptivecards.io, api.example.com, api.linear.app, api.vercel.com, app.com, app.example.com, aquasecurity.github.io, atlas.mitre.org, attacker.com, badges.vaspera.dev, bandit.readthedocs.io, brakemanscanner.org, cli.github.com, cloudkms.googleapis.com, company.atlassian.net, company.okta.com, company.service-now.com, cppcheck.sourceforge.io, custom-builder.com, custom.auth.com, custom.build, discord.com, docs.npmjs.com, eslint.org, eur-lex.europa.eu, evil.com, example.com, example.okta.com, github.com, hooks.example.com, hooks.slack.com, http-intake.logs.ap1.datadoghq.com, http-intake.logs.datadoghq.com, http-intake.logs.datadoghq.eu, http-intake.logs.ddog-gov.com, http-intake.logs.us3.datadoghq.com, http-intake.logs.us5.datadoghq.com, img.shields.io, in-toto.io, linear.app, metadata.google.internal, nuclei.projectdiscovery.io, opa.example.com, otel.example.com, outlook.office.com, owasp.org, raw.githubusercontent.com, registry.npmjs.org, reports.example.com, scim.example.com

Source & flagged code

42 flagged

dist/transcripts/redaction.test.jsView file

Lines 77-117javascript

77 expect(result.redactions.filter((r) => r.type === "credit-card").length).toBe(0);

78 });

79 });

80 describe("IP address detection", () => {

81 it("redacts public IP addresses", () => {

82 const result = redactPII("Server: 8.8.8.8");

83 expect(result.hadPII).toBe(true);

84 expect(result.redacted).toBe("Server: [REDACTED:IP]");

85 });

86 it("excludes localhost", () => {

87 const result = redactPII("Localhost: 127.0.0.1");

88 expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);

89 });

90 it("excludes private ranges", () => {

91 const result = redactPII("Internal: 192.168.1.1");

92 expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);

93 });

94 });

95 describe("API key detection", () => {

96 it("redacts GitHub tokens", () => {

97 const result = redactPII("Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/transcripts/redaction.test.jsView on unpkg · L97

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L97

98 expect(result.hadPII).toBe(true);

99 expect(result.redacted).toContain("[REDACTED:GH_TOKEN]");

100 });

101 it("redacts OpenAI API keys", () => {

102 const result = redactPII("Key: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");

103 expect(result.hadPII).toBe(true);

104 expect(result.redacted).toContain("[REDACTED:OPENAI_KEY]");

105 });

106 it("redacts AWS access keys", () => {

107 const result = redactPII("AWS: AKIAIOSFODNN7EXAMPLE");

108 expect(result.hadPII).toBe(true);

109 expect(result.redacted).toContain("[REDACTED:AWS_KEY]");

110 });

111 it("redacts Slack tokens", () => {

112 const result = redactPII("Slack: xoxb-123456789012-1234567890123-abcdefghijklmnop");

113 expect(result.hadPII).toBe(true);

114 expect(result.redacted).toContain("[REDACTED:SLACK_TOKEN]");

115 });

116 });

117 describe("JWT detection", () => {

107patternName = aws_access_key severity = critical line = 107 matchedText = const re...E");

Critical

Secret Pattern

AWS access key ID in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L107

163patternName = github_pat severity = critical line = 163 matchedText = const re...x");

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L163

127patternName = generic_password severity = medium line = 127 matchedText = const re..."');

Medium

Secret Pattern

Hardcoded password in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L127

dist/util/subprocess.jsView file

Lines 1-30javascript

1/**

2 * Safe subprocess execution for scanner adapters.

3 *

4 * Wraps execFile (never a shell) so argument values — project paths,

5 * target URLs, config file paths — can never be interpreted as shell

6 * syntax. This is the only sanctioned way to invoke external scanner

7 * binaries (CONSTITUTION: "No string-concat shell commands").

8 *

9 * @module util/subprocess

10 */

11import { execFile }

dist/agents/adversary/tactics/injection.jsView file

Lines 124-164javascript

124 {

125 id: "ssti-jinja2",

126 name: "Jinja2 Template from String",

127 description: "Jinja2 Template() with user-controlled string",

128 cwe: "CWE-1336",

129 severity: "critical",

dist/plugins/loader.jsView file

Lines 280-320javascript

280 manifest,

281 path: packagePath,

282 source: "npm",

283 scan,

284 enabled: true,

285 };

286 }

287 catch (error) {

288 logger.error

dist/exporters/checkmarx.jsView file

Lines 1-21javascript

1/**

2 * Checkmarx Exporter

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/exporters/checkmarx.jsView on unpkg · L1

3 *

4 * Exports findings to Checkmarx XML format.

5 *

6 * @module exporters/checkmarx

7 */

8import { writeFile } from "fs/promises";

dist/scanners/dast/zap.jsView file

Lines 1-34javascript

1/**

2 * OWASP ZAP Scanner Integration

3 *

4 * Integrates with OWASP ZAP (Zed Attack Proxy) for dynamic

5 * application security testing.

6 *

7 * @module scanners/dast/zap

8 */

9import spawn from "cross-spawn";

10import { logger } from

dist/enterprise/signing/kms.jsView file

Lines 8-48javascript

8 */

9import { createHash, createSign, createVerify } from "crypto";

10// ============================================================================

11// AWS KMS Client

12// ============================================================================

13/**

14 * AWS KMS signing client

15 */

16export class AWSKMSClient {

dist/agents/logic-flaw-detector.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = vaspera@2.17.1 matchedIdentity = npm:dmFzcGVyYQ:2.17.1 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/logic-flaw-detector.jsView on unpkg

dist/enterprise/signing/kms.test.jsView file

97patternName = aws_access_key severity = critical line = 97 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/enterprise/signing/kms.test.js

dist/enterprise/signing/kms.test.jsView on unpkg · L97

dist/enterprise/auth/oidc.test.jsView file

177patternName = supabase_service_key severity = critical line = 177 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L177

203patternName = supabase_service_key severity = critical line = 203 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L203

222patternName = supabase_service_key severity = critical line = 222 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L222

233patternName = supabase_service_key severity = critical line = 233 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/__tests__/logger-redaction.test.jsView file

44patternName = github_pat severity = critical line = 44 matchedText = detail: ...aa",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L44

53patternName = github_pat severity = critical line = 53 matchedText = url: "ht...po",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L53

dist/scanners/secrets.test.jsView file

54patternName = aws_access_key severity = critical line = 54 matchedText = await wr...;`);

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L54

64patternName = github_pat severity = critical line = 64 matchedText = await wr...;`);

Critical

Secret Pattern

GitHub personal access token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L64

73patternName = slack_bot_token severity = critical line = 73 matchedText = await wr...;`);

Critical

Secret Pattern

Slack bot token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L73

82patternName = aws_access_key severity = critical line = 82 matchedText = await wr...pped

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L82

dist/scanners/deploy/index.jsView file

75patternName = generic_password severity = medium line = 75 matchedText = # pa...ass"

Medium

Secret Pattern

Hardcoded password in dist/scanners/deploy/index.js

dist/scanners/deploy/index.jsView on unpkg · L75

dist/scanners/runtime/golden-path-runner.jsView file

512patternName = generic_password severity = medium line = 512 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L512

520patternName = generic_password severity = medium line = 520 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L520

dist/commands/audits/secrets.jsView file

11patternName = private_key_rsa severity = critical line = 11 matchedText = - Privat...---)

Critical

Secret Pattern

RSA private key in dist/commands/audits/secrets.js

dist/commands/audits/secrets.jsView on unpkg · L11

dist/eval/fixtures.jsView file

255patternName = aws_access_key severity = critical line = 255 matchedText = export c...LE';

Critical

Secret Pattern

AWS access key ID in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L255

259patternName = stripe_live_secret severity = critical line = 259 matchedText = export c...dc';

Critical

Secret Pattern

Stripe live secret key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L259

262patternName = github_pat severity = critical line = 262 matchedText = export c...xx';

Critical

Secret Pattern

GitHub personal access token in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L262

311patternName = private_key_rsa severity = critical line = 311 matchedText = export c...----

Critical

Secret Pattern

RSA private key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L311

skills/vaspera-deploy/SKILL.mdView file

109patternName = generic_password severity = medium line = 109 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in skills/vaspera-deploy/SKILL.md

skills/vaspera-deploy/SKILL.mdView on unpkg · L109

Source & flagged code

42 flagged · loading source

dist/transcripts/redaction.test.jsView file

97patternName = github_pat severity = critical line = 97 matchedText = const re...x");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/transcripts/redaction.test.jsView on unpkg · L97

97patternName = github_pat severity = critical line = 97 matchedText = const re...x");

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L97

107patternName = aws_access_key severity = critical line = 107 matchedText = const re...E");

Critical

Secret Pattern

AWS access key ID in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L107

163patternName = github_pat severity = critical line = 163 matchedText = const re...x");

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L163

127patternName = generic_password severity = medium line = 127 matchedText = const re..."');

Medium

Secret Pattern

Hardcoded password in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L127

dist/util/subprocess.jsView file

10*/ L11: import { execFile } from "child_process"; L12: export class CommandError extends Error {

High

Child Process

Package source references child process execution.

dist/util/subprocess.jsView on unpkg · L10

dist/agents/adversary/tactics/injection.jsView file

144name: "Eval with User Input", L145: description: "eval() with potentially user-controlled input", L146: cwe: "CWE-94",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/agents/adversary/tactics/injection.jsView on unpkg · L144

dist/plugins/loader.jsView file

300// Dynamic import L301: const module = await import(modulePath); L302: const fn = exportName === "default" ? module.default : module[exportName];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/loader.jsView on unpkg · L300

dist/exporters/checkmarx.jsView file

1/** L2: * Checkmarx Exporter

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/exporters/checkmarx.jsView on unpkg · L1

dist/scanners/dast/zap.jsView file

14*/ L15: const ZAP_API_URL = process.env.ZAP_API_URL || "http://localhost:8080"; L16: const ZAP_API_KEY = process.env.ZAP_API_KEY || ""; ... L22: // Try docker first L23: const dockerChild = spawn("docker", ["images", "owasp/zap2docker-stable", "--format", "{{.Repository}}"], { L24: timeout: 10000,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/scanners/dast/zap.jsView on unpkg · L14

dist/enterprise/signing/kms.jsView file

28const digest = createHash("sha256").update(content).digest(); L29: const digestBase64 = digest.toString("base64"); L30: // Build AWS Signature Version 4 request ... L87: } L88: const url = `https://kms.${region}.amazonaws.com/`; L89: const host = `kms.${region}.amazonaws.com`; ... L201: }, L202: body: JSON.stringify(body), L203: }); ... L218: try { L219: const response = await fetch("http://metadata.google.[redacted]-accounts/default/token", { L220: headers: { "Metadata-Flavor": "Google" },

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/enterprise/signing/kms.jsView on unpkg · L28

dist/agents/logic-flaw-detector.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/logic-flaw-detector.jsView on unpkg

dist/enterprise/signing/kms.test.jsView file

97patternName = aws_access_key severity = critical line = 97 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/enterprise/signing/kms.test.js

dist/enterprise/signing/kms.test.jsView on unpkg · L97

dist/enterprise/auth/oidc.test.jsView file

177patternName = supabase_service_key severity = critical line = 177 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L177

203patternName = supabase_service_key severity = critical line = 203 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L203

222patternName = supabase_service_key severity = critical line = 222 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L222

233patternName = supabase_service_key severity = critical line = 233 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L233

276patternName = supabase_service_key severity = critical line = 276 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L276

281patternName = supabase_service_key severity = critical line = 281 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L281

286patternName = supabase_service_key severity = critical line = 286 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L286

291patternName = supabase_service_key severity = critical line = 291 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L291

dist/__tests__/logger-redaction.test.jsView file

44patternName = github_pat severity = critical line = 44 matchedText = detail: ...aa",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L44

53patternName = github_pat severity = critical line = 53 matchedText = url: "ht...po",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L53

dist/scanners/secrets.test.jsView file

54patternName = aws_access_key severity = critical line = 54 matchedText = await wr...;`);

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L54

64patternName = github_pat severity = critical line = 64 matchedText = await wr...;`);

Critical

Secret Pattern

GitHub personal access token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L64

73patternName = slack_bot_token severity = critical line = 73 matchedText = await wr...;`);

Critical

Secret Pattern

Slack bot token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L73

82patternName = aws_access_key severity = critical line = 82 matchedText = await wr...pped

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L82

112patternName = private_key_rsa severity = critical line = 112 matchedText = await wr...----

Critical

Secret Pattern

RSA private key in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L112

127patternName = stripe_live_secret severity = critical line = 127 matchedText = await wr... key

Critical

Secret Pattern

Stripe live secret key in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L127

136patternName = stripe_live_secret severity = critical line = 136 matchedText = expect(f...c");

Critical

Secret Pattern

Stripe live secret key in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L136

144patternName = aws_access_key severity = critical line = 144 matchedText = const aw...LE";

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L144

145patternName = github_pat severity = critical line = 145 matchedText = const gi...xx";

Critical

Secret Pattern

GitHub personal access token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L145

153patternName = slack_bot_token severity = critical line = 153 matchedText = await wr...;`);

Critical

Secret Pattern

Slack bot token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L153

dist/scanners/deploy/index.jsView file

75patternName = generic_password severity = medium line = 75 matchedText = # pa...ass"

Medium

Secret Pattern

Hardcoded password in dist/scanners/deploy/index.js

dist/scanners/deploy/index.jsView on unpkg · L75

dist/scanners/runtime/golden-path-runner.jsView file

512patternName = generic_password severity = medium line = 512 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L512

520patternName = generic_password severity = medium line = 520 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L520

dist/commands/audits/secrets.jsView file

11patternName = private_key_rsa severity = critical line = 11 matchedText = - Privat...---)

Critical

Secret Pattern

RSA private key in dist/commands/audits/secrets.js

dist/commands/audits/secrets.jsView on unpkg · L11

dist/eval/fixtures.jsView file

255patternName = aws_access_key severity = critical line = 255 matchedText = export c...LE';

Critical

Secret Pattern

AWS access key ID in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L255

259patternName = stripe_live_secret severity = critical line = 259 matchedText = export c...dc';

Critical

Secret Pattern

Stripe live secret key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L259

262patternName = github_pat severity = critical line = 262 matchedText = export c...xx';

Critical

Secret Pattern

GitHub personal access token in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L262

311patternName = private_key_rsa severity = critical line = 311 matchedText = export c...----

Critical

Secret Pattern

RSA private key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L311

skills/vaspera-deploy/SKILL.mdView file

109patternName = generic_password severity = medium line = 109 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in skills/vaspera-deploy/SKILL.md

skills/vaspera-deploy/SKILL.mdView on unpkg · L109

Findings

30 Critical5 High9 Medium6 Low

CriticalCritical Secretdist/transcripts/redaction.test.js

CriticalSecret Patterndist/transcripts/redaction.test.js

CriticalSecret Patterndist/enterprise/signing/kms.test.js

CriticalSecret Patterndist/enterprise/auth/oidc.test.js

CriticalSecret Patterndist/__tests__/logger-redaction.test.js

CriticalSecret Patterndist/scanners/secrets.test.js

CriticalSecret Patterndist/commands/audits/secrets.js

CriticalSecret Patterndist/eval/fixtures.js

HighChild Processdist/util/subprocess.js

HighShell

HighSame File Env Network Executiondist/scanners/dast/zap.js

HighCloud Metadata Accessdist/enterprise/signing/kms.js

HighPrevious Version Dangerous Deltadist/agents/logic-flaw-detector.js

MediumDynamic Requiredist/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/transcripts/redaction.test.js

MediumSecret Patterndist/scanners/deploy/index.js

MediumSecret Patterndist/scanners/runtime/golden-path-runner.js

MediumSecret Patternskills/vaspera-deploy/SKILL.md

LowScripts Present

LowEvaldist/agents/adversary/tactics/injection.js

LowWeak Cryptodist/exporters/checkmarx.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorRyan Colkitt

Maintainersrcolkitt

Version2.19.3

PublishedJul 13, 2026

LicenseMIT

Dependencies16

Integrityverified

Package size1.56 MB

Files1,654

Keywordsmcpmodel-context-protocolsecurityhardeningcertificationcode-qualitystatic-analysisclaude

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → ./dist/index.d.tsbin → vaspera-hardening, vaspera-install-skills

RuntimeNo engine / OS / CPU constraints

Artifact8.13 MB · 1,654 files1 signature(s)

Install lifecycleNo install hooks · other: benchmark, benchmark:agents, benchmark:competitive, benchmark:llm +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

42 flagged

dist/transcripts/redaction.test.jsView file

Lines 77-117javascript

77 expect(result.redactions.filter((r) => r.type === "credit-card").length).toBe(0);

78 });

79 });

80 describe("IP address detection", () => {

81 it("redacts public IP addresses", () => {

82 const result = redactPII("Server: 8.8.8.8");

83 expect(result.hadPII).toBe(true);

84 expect(result.redacted).toBe("Server: [REDACTED:IP]");

85 });

86 it("excludes localhost", () => {

87 const result = redactPII("Localhost: 127.0.0.1");

88 expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);

89 });

90 it("excludes private ranges", () => {

91 const result = redactPII("Internal: 192.168.1.1");

92 expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);

93 });

94 });

95 describe("API key detection", () => {

96 it("redacts GitHub tokens", () => {

97 const result = redactPII("Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/transcripts/redaction.test.jsView on unpkg · L97

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L97

98 expect(result.hadPII).toBe(true);

99 expect(result.redacted).toContain("[REDACTED:GH_TOKEN]");

100 });

101 it("redacts OpenAI API keys", () => {

102 const result = redactPII("Key: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");

103 expect(result.hadPII).toBe(true);

104 expect(result.redacted).toContain("[REDACTED:OPENAI_KEY]");

105 });

106 it("redacts AWS access keys", () => {

107 const result = redactPII("AWS: AKIAIOSFODNN7EXAMPLE");

108 expect(result.hadPII).toBe(true);

109 expect(result.redacted).toContain("[REDACTED:AWS_KEY]");

110 });

111 it("redacts Slack tokens", () => {

112 const result = redactPII("Slack: xoxb-123456789012-1234567890123-abcdefghijklmnop");

113 expect(result.hadPII).toBe(true);

114 expect(result.redacted).toContain("[REDACTED:SLACK_TOKEN]");

115 });

116 });

117 describe("JWT detection", () => {

107patternName = aws_access_key severity = critical line = 107 matchedText = const re...E");

Critical

Secret Pattern

AWS access key ID in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L107

163patternName = github_pat severity = critical line = 163 matchedText = const re...x");

Critical

Secret Pattern

GitHub personal access token in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L163

127patternName = generic_password severity = medium line = 127 matchedText = const re..."');

Medium

Secret Pattern

Hardcoded password in dist/transcripts/redaction.test.js

dist/transcripts/redaction.test.jsView on unpkg · L127

dist/util/subprocess.jsView file

Lines 1-30javascript

1/**

2 * Safe subprocess execution for scanner adapters.

3 *

4 * Wraps execFile (never a shell) so argument values — project paths,

5 * target URLs, config file paths — can never be interpreted as shell

6 * syntax. This is the only sanctioned way to invoke external scanner

7 * binaries (CONSTITUTION: "No string-concat shell commands").

8 *

9 * @module util/subprocess

10 */

11import { execFile }

dist/agents/adversary/tactics/injection.jsView file

Lines 124-164javascript

124 {

125 id: "ssti-jinja2",

126 name: "Jinja2 Template from String",

127 description: "Jinja2 Template() with user-controlled string",

128 cwe: "CWE-1336",

129 severity: "critical",

dist/plugins/loader.jsView file

Lines 280-320javascript

280 manifest,

281 path: packagePath,

282 source: "npm",

283 scan,

284 enabled: true,

285 };

286 }

287 catch (error) {

288 logger.error

dist/exporters/checkmarx.jsView file

Lines 1-21javascript

1/**

2 * Checkmarx Exporter

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/exporters/checkmarx.jsView on unpkg · L1

3 *

4 * Exports findings to Checkmarx XML format.

5 *

6 * @module exporters/checkmarx

7 */

8import { writeFile } from "fs/promises";

dist/scanners/dast/zap.jsView file

Lines 1-34javascript

1/**

2 * OWASP ZAP Scanner Integration

3 *

4 * Integrates with OWASP ZAP (Zed Attack Proxy) for dynamic

5 * application security testing.

6 *

7 * @module scanners/dast/zap

8 */

9import spawn from "cross-spawn";

10import { logger } from

dist/enterprise/signing/kms.jsView file

Lines 8-48javascript

8 */

9import { createHash, createSign, createVerify } from "crypto";

10// ============================================================================

11// AWS KMS Client

12// ============================================================================

13/**

14 * AWS KMS signing client

15 */

16export class AWSKMSClient {

dist/agents/logic-flaw-detector.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/logic-flaw-detector.jsView on unpkg

dist/enterprise/signing/kms.test.jsView file

97patternName = aws_access_key severity = critical line = 97 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/enterprise/signing/kms.test.js

dist/enterprise/signing/kms.test.jsView on unpkg · L97

dist/enterprise/auth/oidc.test.jsView file

177patternName = supabase_service_key severity = critical line = 177 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L177

203patternName = supabase_service_key severity = critical line = 203 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L203

222patternName = supabase_service_key severity = critical line = 222 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/enterprise/auth/oidc.test.jsView on unpkg · L222

233patternName = supabase_service_key severity = critical line = 233 matchedText = const mo...RE";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/enterprise/auth/oidc.test.js

dist/__tests__/logger-redaction.test.jsView file

44patternName = github_pat severity = critical line = 44 matchedText = detail: ...aa",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L44

53patternName = github_pat severity = critical line = 53 matchedText = url: "ht...po",

Critical

Secret Pattern

GitHub personal access token in dist/__tests__/logger-redaction.test.js

dist/__tests__/logger-redaction.test.jsView on unpkg · L53

dist/scanners/secrets.test.jsView file

54patternName = aws_access_key severity = critical line = 54 matchedText = await wr...;`);

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L54

64patternName = github_pat severity = critical line = 64 matchedText = await wr...;`);

Critical

Secret Pattern

GitHub personal access token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L64

73patternName = slack_bot_token severity = critical line = 73 matchedText = await wr...;`);

Critical

Secret Pattern

Slack bot token in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L73

82patternName = aws_access_key severity = critical line = 82 matchedText = await wr...pped

Critical

Secret Pattern

AWS access key ID in dist/scanners/secrets.test.js

dist/scanners/secrets.test.jsView on unpkg · L82

dist/scanners/deploy/index.jsView file

75patternName = generic_password severity = medium line = 75 matchedText = # pa...ass"

Medium

Secret Pattern

Hardcoded password in dist/scanners/deploy/index.js

dist/scanners/deploy/index.jsView on unpkg · L75

dist/scanners/runtime/golden-path-runner.jsView file

512patternName = generic_password severity = medium line = 512 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L512

520patternName = generic_password severity = medium line = 520 matchedText = body: { ...g" }

Medium

Secret Pattern

Hardcoded password in dist/scanners/runtime/golden-path-runner.js

dist/scanners/runtime/golden-path-runner.jsView on unpkg · L520

dist/commands/audits/secrets.jsView file

11patternName = private_key_rsa severity = critical line = 11 matchedText = - Privat...---)

Critical

Secret Pattern

RSA private key in dist/commands/audits/secrets.js

dist/commands/audits/secrets.jsView on unpkg · L11

dist/eval/fixtures.jsView file

255patternName = aws_access_key severity = critical line = 255 matchedText = export c...LE';

Critical

Secret Pattern

AWS access key ID in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L255

259patternName = stripe_live_secret severity = critical line = 259 matchedText = export c...dc';

Critical

Secret Pattern

Stripe live secret key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L259

262patternName = github_pat severity = critical line = 262 matchedText = export c...xx';

Critical

Secret Pattern

GitHub personal access token in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L262

311patternName = private_key_rsa severity = critical line = 311 matchedText = export c...----

Critical

Secret Pattern

RSA private key in dist/eval/fixtures.js

dist/eval/fixtures.jsView on unpkg · L311

skills/vaspera-deploy/SKILL.mdView file

109patternName = generic_password severity = medium line = 109 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in skills/vaspera-deploy/SKILL.md

skills/vaspera-deploy/SKILL.mdView on unpkg · L109