Loading npm security reports…

4bnode@4.1.8: Suspicious npm security report (Warn) | LPM Firewall

registry / 4bnode / 4.1.8

4bnode@4.1.8

4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 33 file(s), 226 KB of source

Source & flagged code

7 flagged

skeleton/.envView file

•patternName = blocked_file severity = critical matchedText = skeleton/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skeleton/.envView on unpkg

index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from "fs";

4import path from "path";

5import crypto from "crypto";

6import { execSync, execFileSync } from "child_process";

7import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L5

8import chalk from "chalk";

9import { input, select, password } from "@inquirer/prompts";

10import { sanitizeName } from "./lib/names.js";

11import {

12 checkMongoConfig,

13 checkRoutesDir,

14 checkModelsExist,

15 listModels,

16 listRoutes,

17 getModelSchemaDetailed,

18} from "./lib/project.js";

19import {

20 showBanner,

21 createSpinner,

22 showSuccess,

23 showNextSteps,

24 showError,

25 showHeader,

scripts/audit-dev-surface.mjsView file

Lines 16-56javascript

16import fs from 'fs';

17import path from 'path';

18import crypto from 'crypto';

20const args =

add-email.jsView file

Lines 14-54javascript

14 buildMailerService,

15 isOfficialMailDomain,

16 OFFICIAL_MAIL_DOMAIN_PASSWORD,

17 OFFICIAL_MAIL_NOTIFY,

18} from "./lib/codegen.js";

20// The 4brains.in domain can't be configured directly — require the shared

21// authorization password (exits on a wrong answer).

22async

lib/ui.jsView file

Lines 132-172javascript

132}

133

134// ── Installing deps (with spinner) ──────────────────

135

136export async function installDeps(packages, opts = {}) {

137 const { execSync }

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View file

•path = skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2 kind = high_entropy_blob sizeBytes = 208184 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View on unpkg

Source & flagged code

7 flagged · loading source

skeleton/.envView file

Source & flagged code

7 flagged

skeleton/.envView file

•patternName = blocked_file severity = critical matchedText = skeleton/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skeleton/.envView on unpkg

index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from "fs";

4import path from "path";

5import crypto from "crypto";

6import { execSync, execFileSync } from "child_process";

7import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L5

8import chalk from "chalk";

9import { input, select, password } from "@inquirer/prompts";

10import { sanitizeName } from "./lib/names.js";

11import {

12 checkMongoConfig,

13 checkRoutesDir,

14 checkModelsExist,

15 listModels,

16 listRoutes,

17 getModelSchemaDetailed,

18} from "./lib/project.js";

19import {

20 showBanner,

21 createSpinner,

22 showSuccess,

23 showNextSteps,

24 showError,

25 showHeader,

scripts/audit-dev-surface.mjsView file

Lines 16-56javascript

16import fs from 'fs';

17import path from 'path';

18import crypto from 'crypto';

20const args =

add-email.jsView file

Lines 14-54javascript

14 buildMailerService,

15 isOfficialMailDomain,

16 OFFICIAL_MAIL_DOMAIN_PASSWORD,

17 OFFICIAL_MAIL_NOTIFY,

18} from "./lib/codegen.js";

20// The 4brains.in domain can't be configured directly — require the shared

21// authorization password (exits on a wrong answer).

22async

lib/ui.jsView file

Lines 132-172javascript

132}

133

134// ── Installing deps (with spinner) ──────────────────

135

136export async function installDeps(packages, opts = {}) {

137 const { execSync }

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View file

•path = skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2 kind = high_entropy_blob sizeBytes = 208184 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View on unpkg

Lines 87-127javascript

87 let notifyCtx = null; // set when an authorized 4brains.in sender is configured

89 if (preset.type === "resend") {

90 // IntraApp(Postmaster) → Resend API. Only an API key + from address.

91 const apiKey = (await password({ message: "Resend API key (re_...):", mask: "*" })).trim();

92 const from = (await input({ message: "From address:", default: "" })).trim();

93 await ensureOfficialAllowed(from);

94 if (isOfficialMailDomain(from)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");

95 if (apiKey) updateEnvFile(envPath, "RESEND_API_KEY", apiKey);

96 if (from) updateEnvFile(envPath, "MAIL_FROM", from);

97 dep = "resend";

98 summary.push(from ? `From: ${from}` : "From: (set MAIL_FROM in .env)");

99 if (isOfficialMailDomain(from) && apiKey) notifyCtx = { kind: "resend", from, apiKey };

100 } else {

101 // Custom SMTP → nodemailer. TLS selects the port (465 vs 587).

102 const host = (await input({ message: "SMTP host:", default: preset.host || "" })).trim();

103 const secure = await confirm({ message: "Use TLS (port 465)? (No = port 587)", default: false });

104 const defPort = secure ? 465 : 587;

105 const port = (await input({ message: "SMTP port:", default: String(defPort) })).trim();

106 const user = (await input({ message: "SMTP user:", default: "" })).trim();

107 const pass = (await password({ message: "SMTP password:", mask: "*" })).trim();

Medium

Secret Pattern

Hardcoded password in add-email.js

add-email.jsView on unpkg · L107

108 const from = (await input({ message: "From address:", default: user })).trim();

109 await ensureOfficialAllowed(from || user);

110 if (isOfficialMailDomain(from || user)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");

111 updateEnvFile(envPath, "SMTP_HOST", host);

112 updateEnvFile(envPath, "SMTP_PORT", port || String(defPort));

113 updateEnvFile(envPath, "SMTP_SECURE", secure ? "true" : "false");

114 updateEnvFile(envPath, "SMTP_USER", user);

115 if (pass) updateEnvFile(envPath, "SMTP_PASS", pass);

116 updateEnvFile(envPath, "SMTP_FROM", from || user);

117 dep = "nodemailer";

118 summary.push(`Host: ${host}:${port || defPort}`);

119 if (isOfficialMailDomain(from || user)) notifyCtx = { kind: "smtp", from: from || user, smtp: { host, port: port || defPort, secure, user, pass } };

120 }

121

122 console.log();

123 showFileAction("updated", ".env");

124

125 fs.mkdirSync(dir, { recursive: true });

126 // Rewrite the mailer only if missing or on the old single-backend version.

127 if (!fs.existsSync(mailerPath) || !fs.readFileSync(mailerPath, "utf8").includes("MAIL_PROVIDER")) {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code