@aegis-scan/cli
AEGIS CLI — paranoid stack-specific security scanner for Next.js + Supabase. 0-1000 score, 42 built-in checkers (+20 external-tool wrappers: 16 SAST/DAST + 1 passive subdomain-recon + 3 LLM-agent pentest frameworks), AST-based cross-file taint analysis, 4
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Fires on a test file asserting that file:///etc/passwd URLs are rejected — not credential harvesting. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Fires on test assertions that private IP requests are blocked — expected in a security scanner's test suite. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Fires on a legitimate AES-GCM encrypt/decrypt utility in a template file; not obfuscation. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Same AES-GCM crypto utility; base64 used for ciphertext encoding, not payload hiding. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @aegis-scan/cli is a scoped security-scanner package; Levenshtein proximity to 'joi' is coincidental. | ai |
v0.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.