github TypeScript analyzed d36a417

LeassTaTT/syncrona

Modern CLI + AI-ready MCP server for ServiceNow — edit scoped-app code as plain files, version it in Git, and run metadata, dependency and impact analysis.

maintainer: LeassTaTT
licence: GPL-3.0
first seen: 2026-06-21
last seen: 2026-06-26
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-08-25 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-08-21 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-08-19 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-08-17 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-08-07 code analysis flagged dynamic code execution ×4 in LeassTaTT/syncrona
HIGH 2026-07-29 code analysis flagged dynamic code execution ×4 in LeassTaTT/syncrona
HIGH 2026-07-18 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-07-14 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-07-06 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-06-28 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-06-26 code analysis flagged dynamic code execution in LeassTaTT/syncrona
HIGH 2026-06-24 code analysis flagged dynamic code execution in LeassTaTT/syncrona

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d36a417 · analyzer v33 · 1w ago

skills & prompt files 1

agent-rules IvanBBaev-syncrona-d36a417/CLAUDE.md

danger signals4

dynamic code execution vm exec IvanBBaev-syncrona-d36a417/packages/core/src/config.ts :432 vm.runInNewContext(source, sandbox, { filename: configPath });
dynamic code execution vm exec IvanBBaev-syncrona-d36a417/packages/core/src/tests/configBugfix.test.ts :121 expect(() => vm.runInNewContext(code, sandbox)).not.toThrow();
dynamic code execution vm exec IvanBBaev-syncrona-d36a417/packages/core/src/tests/pluginManagerProcess.test.ts :126 const crossRealmRegex = vm.runInNewContext("/\\.js$/") as RegExp;
dynamic code execution new Function() IvanBBaev-syncrona-d36a417/packages/webpack-plugin/test/index.test.js :53 new Function(result.output)();

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 525

filesystem 204

fs IvanBBaev-syncrona-d36a417/packages/core/src/FileUtils.ts :4 import fs, { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/Logger.ts :4 import fs from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/PluginManager.ts :5 import fs from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/commandHelpers.ts :3 import { promises as fsp, readFileSync } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/commands.ts :3 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/config.ts :4 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/diagnosticsCommands.ts :3 import { promises as fsp, readFileSync } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/downloadCheckpoint.ts :8 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/envFile.ts :2 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/gitUtils.ts :7 import fs from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/mcpCommand.ts :3 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/mirrorCommand.ts :597 const bytes = await fs.readFile(target);

show 28 more

fs IvanBBaev-syncrona-d36a417/packages/core/src/pushCommand.ts :4 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/repairCommand.ts :3 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/scopeDocs.ts :3 import { promises as fsp } from "fs";
fs IvanBBaev-syncrona-d36a417/packages/core/src/snClient.ts :4 import fs from "node:fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/authCommands.test.ts :26 // callers doing `import fs from "fs"` (default) or `import { readFileSync }`
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/authStore.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/collaborationLock.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/commandsFlow.test.ts :168 // callers doing `import fs from "fs"` (default) or `import { readFileSync }`
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/commandsInitAuto.test.ts :81 // promises members the init flow drives, so callers doing `import fs from "fs"`
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/configBugfix.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/configCoverage.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/configValidation.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/core-pluginsRev140.test.ts :4 import fs from "node:fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/core-pluginsRev141.test.ts :2 import fs from "node:fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/core-repairRev140.test.ts :24 import { mkdtempSync, mkdirSync, writeFileSync, existsSync, rmSync } from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/coverageFloors.test.ts :27 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/cred.test.ts :2 import fs from "fs"
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/devManifestReload.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/diagnosticsCommandsCoverage.test.ts :99 // The command imports readFileSync + promises from "fs". Keep the real promises
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/downloadCheckpoint.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/downloadWriteSeamInjection.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/e2eCliSmoke.test.ts :3 import { existsSync } from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/emptyFieldConvergence.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/envFile.test.ts :2 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/fieldRepresentationExtension.test.ts :26 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/fileUtilsCoverage.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/fileUtilsDepth.test.ts :3 import fs from "fs";
fs (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/fileUtilsExt.test.ts :3 import fs from "fs";

164 more not shown — this panel samples each group; the count above is the real total.

shell / exec 33

shell IvanBBaev-syncrona-d36a417/packages/core/src/diagnosticsCommands.ts :4 import { execFileSync } from "child_process";
shell IvanBBaev-syncrona-d36a417/packages/core/src/gitUtils.ts :2 import * as cp from "child_process";
shell IvanBBaev-syncrona-d36a417/packages/core/src/mcpCommand.ts :7 import { spawn } from "child_process";
shell IvanBBaev-syncrona-d36a417/packages/core/src/mirrorCommand.ts :48 import { execFile } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/commandsFlow.test.ts :157 const actual = jest.requireActual("child_process") as typeof import("child_process");
shell (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/core-pluginsRev140.test.ts :3 import { spawnSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/e2eCliSmoke.test.ts :2 import { execFile } from "child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/mirrorCommandWiring.test.ts :3 import { execFile } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/unhandledRejectionConfig.test.ts :29 import { spawnSync } from "child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/scripts/check-coverage-gate.js :2 const { spawnSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/scripts/check-tool-contract.js :117 // Non-global clone so exec() returns the block's FIRST name (the tool's own),
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/scripts/stdio-fuzz.js :38 const { spawn } = require("node:child_process");

show 21 more

shell IvanBBaev-syncrona-d36a417/packages/mcp-server/src/handlers/jiraToolHandlers.ts :2 import { execFile } from "child_process";
shell IvanBBaev-syncrona-d36a417/packages/mcp-server/src/processRunner.ts :2 import { spawn } from "child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/authMethods.test.js :15 const { execFileSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/contract.test.js :7 const { spawnSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/governance-gate-soundness.test.js :12 const { spawnSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/index.test.js :8 const { execFileSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/jiraToolHandlers.test.js :4 const { execFileSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-auditRev142.test.js :28 const { spawn } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/processRunnerSettle.test.js :24 "require('child_process').spawn(process.execPath,['-e','setTimeout(()=>{},6000)'],{stdio:'inherit'});" +
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/safetyPolicy.rev83-allowlist.test.js :112 { command: 'node', args: ['-e', 'require("child_process").execSync("id")'] },
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/sourceTextGateWiring.test.js :20 const { spawnSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/workspaceHandlers.cov.test.js :491 const { spawnSync } = require('node:child_process');
shell (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/workspaceHandlers.rev82-sandbox.test.js :59 'console.log(console.log.constructor("return process")().mainModule.require("child_process").execSync("id").toString())';
shell (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/getOnlyBuild.test.ts :40 import { execFileSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/runMirrorCommand.cadence.test.ts :44 import { execFileSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/runMirrorCommand.test.ts :42 import { execFileSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/scripts/check-source-text.mjs :59 import { spawnSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/scripts/depcruise-selftest.mjs :38 import { execFileSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/scripts/lock-race.mjs :47 import { spawn } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/scripts/scan-secrets.mjs :38 import { spawnSync } from "node:child_process";
shell (weak) IvanBBaev-syncrona-d36a417/scripts/verify-pack-contents.mjs :27 import { execFileSync } from "node:child_process";

network 26

net IvanBBaev-syncrona-d36a417/packages/core/src/mirrorCommand.ts :219 const response = await fetch(new URL(tokenPath, baseUrl), {
net IvanBBaev-syncrona-d36a417/packages/core/src/snClient.ts :3 import https from "node:https";
net (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/appUtilsBugfix.test.ts :177 // One missing table -> one scoped fetch (PERF-3, REV-91: one fetch per table).
net (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/core-clientRev170.test.ts :14 import { createServer, type Server } from "node:http";
net (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/e2eNetworkSmoke.test.ts :2 import http from "http";
net (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/snClientPure.test.ts :3 import type { AxiosResponse } from "axios";
net (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/updateNotifierCoverage.test.ts :22 // - fetchLatestVersion against a fully mocked global fetch (NO real network),
net IvanBBaev-syncrona-d36a417/packages/core/src/updateNotifier.ts :231 const response = await fetch(url, {
net IvanBBaev-syncrona-d36a417/packages/jira/src/client.ts :129 const response = await fetch(url, {
net IvanBBaev-syncrona-d36a417/packages/mcp-server/src/healthServer.ts :2 import { createServer } from "http";
net IvanBBaev-syncrona-d36a417/packages/mcp-server/src/servicenowCore.ts :50 } from "undici";
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/authMethods.test.js :9 const http = require('node:http');

show 14 more

net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/authStoreMultiMethod.test.js :14 const http = require('node:http');
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/index.test.js :801 const healthRes = await fetch(server.url);
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-indexRev213.test.js :31 const net = require('node:net');
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/oauth.test.js :4 const http = require('node:http');
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/servicenowCore.proxy.test.js :19 const { Agent, EnvHttpProxyAgent } = require('undici');
net (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/wave5Regressions.test.js :4 const http = require('node:http');
net IvanBBaev-syncrona-d36a417/packages/mirror/src/http/client.ts :272 const defaultFetch: MirrorFetch = (url, init) => fetch(url, init);
net IvanBBaev-syncrona-d36a417/packages/mirror/src/runMirrorCommand.ts :283 * Fetcher uses, restated here for fatals raised OUTSIDE a fetch (catalog build,
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/derivedInvariance.test.ts :159 for (const forbidden of ["Date.now", "new Date(", "Math.random", "fetch("]) {
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/fakeInstance/client.ts :18 import { request as httpRequest, type IncomingHttpHeaders } from "node:http";
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/fakeInstance/server.ts :43 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/getOnlyBuild.test.ts :106 ['fetch(url, { method: "POST" })'],
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/httpClient.test.ts :26 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net (weak) IvanBBaev-syncrona-d36a417/packages/mirror/test/runMirrorCommand.test.ts :318 fetch: (input, init) => fetch(input, init),

secrets 42

secrets IvanBBaev-syncrona-d36a417/packages/core/src/snClient.ts :709 const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "" } = process.env;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/authCommands.test.ts :312 expect(process.env.SN_API_KEY).toBe("KEY-123");
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/commandsDownload.test.ts :54 password: process.env.SN_PASSWORD || "",
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/commandsFlow.test.ts :221 password: process.env.SN_PASSWORD || "",
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/cred.test.ts :24 delete process.env.SN_PASSWORD;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/credentialSource.test.ts :52 process.env.SN_PASSWORD = "p";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/devRefreshProfile.test.ts :67 process.env.SN_PASSWORD = "base.pw";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/instanceHost.test.ts :87 process.env.SN_PASSWORD = "p";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/mcpProfileFallbackWarning.test.ts :115 process.env.SN_PASSWORD = "pw";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/mirrorCommandWiring.test.ts :401 process.env.SN_PASSWORD = "s3cr3t";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/profileInstanceFallbackWarning.test.ts :73 process.env.SN_PASSWORD = "pw";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/snClientBugfix.test.ts :32 SN_PASSWORD: process.env.SN_PASSWORD,

show 28 more

secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/snClientMethods.test.ts :716 process.env.SN_PASSWORD = "pw";
secrets (weak) IvanBBaev-syncrona-d36a417/packages/core/src/tests/storeKey.test.ts :75 savedStoreKey = process.env.SYNCRONA_STORE_KEY;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/credential-store/test/credentialStoreIO.test.ts :26 process.env.SYNCRONA_STORE_KEY = "a".repeat(64); // 32-byte hex key
secrets (weak) IvanBBaev-syncrona-d36a417/packages/credential-store/test/jiraCredentials.test.ts :24 process.env.SYNCRONA_STORE_KEY = "b".repeat(64); // 32-byte hex key
secrets (weak) IvanBBaev-syncrona-d36a417/packages/jira/test/jira.test.ts :1148 process.env.JIRA_TOKEN = "tok";
secrets IvanBBaev-syncrona-d36a417/packages/mcp-server/src/audit.ts :117 const raw = process.env.SYNCRONA_STORE_KEY;
secrets IvanBBaev-syncrona-d36a417/packages/mcp-server/src/handlers/workspaceHandlers.ts :142 * — it blocks naive `process.env.SN_PASSWORD` reads and stops the secrets being
secrets IvanBBaev-syncrona-d36a417/packages/mcp-server/src/servicenowCore.ts :642 SN_PASSWORD: cleanEnvValue(process.env.SN_PASSWORD || ""),
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/audit.sec120-121-123.test.js :63 const prev = process.env.SYNCRONA_STORE_KEY;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/auditIntegrity.test.js :126 const prev = process.env.SYNCRONA_STORE_KEY;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/authMethods.test.js :285 process.env.SN_API_KEY = 'k-1';
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/authStoreMultiMethod.test.js :84 process.env.SYNCRONA_STORE_KEY = '11'.repeat(32);
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/backgroundScriptFallbackAuthBudget.test.js :62 process.env.SN_PASSWORD = 'secret';
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/branchRisk.compareInstances.test.js :68 process.env.SYNCRONA_STORE_KEY = '22'.repeat(32);
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/branchRisk.insights.test.js :34 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/index.test.js :107 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/insightCompare.cov.test.js :45 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/insightMisc.cov.test.js :41 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/jiraToolHandlers.test.js :84 process.env.JIRA_TOKEN = 'tok';
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-atfRev212.test.js :43 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-auditRev142.test.js :33 process.env.SYNCRONA_STORE_KEY = 'rev142-regression-key'; // gitleaks:allow
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-coreRev157.test.js :82 process.env.SYNCRONA_STORE_KEY = '11'.repeat(32);
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-handlersRev152.test.js :38 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/mcp-handlersRev158.test.js :67 process.env.JIRA_TOKEN = 'tok';
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/metadataAnalysisHandlers.cov.test.js :58 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/servicenowCore.cov.test.js :222 process.env.SN_CLIENT_KEY = keyPath;
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/sessionHandlers.cov.test.js :38 SN_PASSWORD: process.env.SN_PASSWORD,
secrets (weak) IvanBBaev-syncrona-d36a417/packages/mcp-server/test/tokenCacheEviction.test.js :97 process.env.SN_PASSWORD = 'secret';

2 more not shown — this panel samples each group; the count above is the real total.

install hooks 15

prepack IvanBBaev-syncrona-d36a417/packages/babel-plugin-remove-modules/package.json :7 tsc
prepack IvanBBaev-syncrona-d36a417/packages/babel-plugin/package.json :7 tsc
prepack IvanBBaev-syncrona-d36a417/packages/babel-preset-servicenow/package.json :7 tsc
prepack IvanBBaev-syncrona-d36a417/packages/core/package.json :11 tsc
prepack IvanBBaev-syncrona-d36a417/packages/credential-store/package.json :8 tsc
prepack IvanBBaev-syncrona-d36a417/packages/eslint-plugin/package.json :7 tsc
prepack IvanBBaev-syncrona-d36a417/packages/jira/package.json :8 tsc
prepack IvanBBaev-syncrona-d36a417/packages/mcp-server/package.json :21 tsc
prepack IvanBBaev-syncrona-d36a417/packages/mirror/package.json :8 tsc
prepack IvanBBaev-syncrona-d36a417/packages/prettier-plugin/package.json :7 tsc
prepack IvanBBaev-syncrona-d36a417/packages/redaction/package.json :8 tsc
prepack IvanBBaev-syncrona-d36a417/packages/sass-plugin/package.json :7 tsc

show 3 more

prepack IvanBBaev-syncrona-d36a417/packages/sn-transport/package.json :8 tsc
prepack IvanBBaev-syncrona-d36a417/packages/typescript-plugin/package.json :7 npx tsc
prepack IvanBBaev-syncrona-d36a417/packages/webpack-plugin/package.json :7 tsc

declared dependencies 5

@changesets/cli@^2.31.0
dependency-cruiser@^18.0.0
eslint@^10.7.0
typescript@~6.0.3
typescript-eslint@^8.64.0

obfuscation 1

dynamic require()/import() IvanBBaev-syncrona-d36a417/packages/mcp-server/test/index.test.js :1443 const { auditMutatingTool } = require(${JSON.stringify(toolServicePath)});