Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vercel-labs/opensrc
main @ f96078a
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Credential Leakage: 1 prior fix. Scrutinize any change in this area.
packages/opensrc/cli/src/core/registries/mod.rs: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Credential Leakage: Auth tokens for major VCS providers (GitHub, GitLab, Bitbucket) were leaked to third-party domains because the registry module used naive string containment checks rather than strict, parsed URL host matching.
Signature Validation Bypass: The post-installation routine was susceptible to a signature validation bypass because of insufficient checksum filename matching, allowing malicious assets to potentially skip validation if named deceptively.