vikit-cli: Suspicious npm security report (Warn)

Loading npm security reports…

vikit-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView file

Lines 1-38markdown

1# Git Safety Protocols

3## Secret Detection Patterns

5### Scan Command

6```bash

8```

10### Patterns to Detect

12| Category | Pattern | Example |

13|----------|---------|---------|

14| API Keys | `api[_-]?key`, `apiKey` | `API_KEY=abc123` |

15| AWS | `AKIA[0-9A-Z]{16}` | `AKIAIOSFODNN7EXAMPLE` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

Critical

Secret Pattern

AWS access key ID in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

16| Tokens | `token`, `auth_token`, `jwt` | `AUTH_TOKEN=xyz` |

17| Passwords | `password`, `passwd`, `pwd` | `DB_PASSWORD=secret` |

18| Private Keys | `-----BEGIN PRIVATE KEY-----` | PEM files |

Critical

Secret Pattern

RSA private key in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L18

19| DB URLs | `mongodb://`, `postgres://`, `mysql://` | Connection strings |

20| OAuth | `client_secret`, `oauth_token` | `CLIENT_SECRET=abc` |

22### Files to Warn About

23- `.env`, `.env.*` (except `.env.example`)

24- `*.key`, `*.pem`, `*.p12`

25- `credentials.json`, `secrets.json`

26- `config/private.*`

28### Action on Detection

291. **BLOCK commit immediately**

302. Show matching lines: `git diff --cached | grep -B2 -A2 <pattern>`

313. Suggest: "Add to .gitignore or use environment variables"

324. Offer to unstage: `git reset HEAD <file>`

34## Branch Protection

36### Never Force Push To

37- `main`, `master`, `production`, `prod`, `release/*`

bin/vikit.jsView file

Lines 20-57javascript

20 const [major, minor] = process.versions.node.split(".").map(Number);

21 const [minMajor, minMinor] = MIN_NODE_VERSION;

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3713116 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView file

15patternName = aws_access_key severity = critical line = 15 matchedText = | AWS | ...E` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

15patternName = aws_access_key severity = critical line = 15 matchedText = | AWS | ...E` |

Critical

Secret Pattern

AWS access key ID in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

18patternName = private_key_rsa severity = critical line = 18 matchedText = | Privat...es |

Critical

Secret Pattern

RSA private key in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L18

bin/vikit.jsView file

40const distUrl = pathToFileURL(distPath).href; L41: await import(distUrl); L42: };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vikit.jsView on unpkg · L40

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3713116 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

5 flagged

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView file

Lines 1-38markdown

1# Git Safety Protocols

3## Secret Detection Patterns

5### Scan Command

6```bash

8```

10### Patterns to Detect

12| Category | Pattern | Example |

13|----------|---------|---------|

14| API Keys | `api[_-]?key`, `apiKey` | `API_KEY=abc123` |

15| AWS | `AKIA[0-9A-Z]{16}` | `AKIAIOSFODNN7EXAMPLE` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

Critical

Secret Pattern

AWS access key ID in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L15

16| Tokens | `token`, `auth_token`, `jwt` | `AUTH_TOKEN=xyz` |

17| Passwords | `password`, `passwd`, `pwd` | `DB_PASSWORD=secret` |

18| Private Keys | `-----BEGIN PRIVATE KEY-----` | PEM files |

Critical

Secret Pattern

RSA private key in dist/core/.claude/skills/vk-git/references/safety-protocols.md

dist/core/.claude/skills/vk-git/references/safety-protocols.mdView on unpkg · L18

19| DB URLs | `mongodb://`, `postgres://`, `mysql://` | Connection strings |

20| OAuth | `client_secret`, `oauth_token` | `CLIENT_SECRET=abc` |

22### Files to Warn About

23- `.env`, `.env.*` (except `.env.example`)

24- `*.key`, `*.pem`, `*.p12`

25- `credentials.json`, `secrets.json`

26- `config/private.*`

28### Action on Detection

291. **BLOCK commit immediately**

302. Show matching lines: `git diff --cached | grep -B2 -A2 <pattern>`

313. Suggest: "Add to .gitignore or use environment variables"

324. Offer to unstage: `git reset HEAD <file>`

34## Branch Protection

36### Never Force Push To

37- `main`, `master`, `production`, `prod`, `release/*`

bin/vikit.jsView file

Lines 20-57javascript

20 const [major, minor] = process.versions.node.split(".").map(Number);

21 const [minMajor, minMinor] = MIN_NODE_VERSION;

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3713116 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

vikit-cli@1.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code