github.com / Fission-AI

Fission-AI/OpenSpec

TypeScript·1297 files·commit c04f30e·scanned 5d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 72,753+ stars — findings likely false positives

verdict accurate?

72,753 stars

38% file coverage

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/telemetry/index.ts, src/core/templates/workflows/explore.ts. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry2 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials..devcontainer/devcontainer.json

  "mounts": [
    "source=${localEnv:HOME}${localEnv:USERPROFILE}/.ssh,target=/home/node/.ssh,readonly,type=bind,consistency=cached"
  ],

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.src/core/templates/workflows/explore.ts+4

infoAuthor has no other public repositoriesGitHub user "openspec-release-bot[bot]" has no other public repositories, common for burner accounts used in scams.+2

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.src/telemetry/index.ts

// This is safe to embed as it only allows sending events, not reading data
const POSTHOG_API_KEY = 'phc_Hthu8YvaIJ9QaFKyTG4TbVwkbd5ktcAFzVTKeMmoW2g';
// Using reverse proxy to avoid ad blockers and k...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

487 files scanned @ c04f30e | 10/22/2026 | heuristic scan — always review manually

risk by category

code execution13

network & exfiltration0

file system access5

obfuscation4

supply chain2

owasp / injection3

telemetry

files 487/1297rules hit 6engine v7commit c04f30e

github

Fission-AI/OpenSpec

Spec-driven development (SDD) for AI coding assistants.

TypeScript

72753

4966

449d

1297 files

487 scanned(38%)

c04f30e

architecture░▒▓

entry (3) flagged (2) pkg (26)

426 nodes · 1450 edgesscroll to zoom · click node to jump to finding