registry / @abgov/nx-oc / 13.0.0

@abgov/nx-oc@13.0.0

Government of Alberta - Nx plugin for OpenShift.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 130 KB of source, external domains: access-uat.alberta.ca, access.adsp-dev.gov.ab.ca, access.alberta.ca, access.example.com, api.example.com, api.example.openshift.com, cli.github.com, directory-service.adsp-dev.gov.ab.ca, directory-service.adsp-uat.alberta.ca, directory-service.adsp.alberta.ca, github.com, gitlab.com, mirror.openshift.com, test-test-sandbox.apps.test.example.com

Source & flagged code

2 flagged

src/executors/sandbox/sandbox.jsView file

Lines 179-217javascript

179 `The frontend will deploy, but requests proxied to ${name} will 502 until it is deployed:\n` +

180 ` nx run ${name}:sandbox\n` +

181 ` (or re-run this target with --deployBackend to deploy it first).`);

182 }

183 }

184 }

185 // ---- build locally + push to the registry ----

186 if (!skipBuild) {

187 run('Build', `npx nx build ${projectName} --configuration production`, cwd);

188 run('Podman build', `podman build --platform=linux/amd64 -f .openshift/${projectName}/Dockerfile -t ${imageRef} .`, cwd);

189 }

190 if (!skipPush) {

191 // gh supplies the token so no PAT is stored; the same session token backs

192 // the pull secret below.

193 run('Registry login', `gh auth token | podman login ${registryHost} -u "$(gh api user -q .login)" --password-stdin`, cwd);

194 run('Push image', `podman push ${imageRef}`, cwd);

195 }

196 // ---- import into the namespace imagestream + roll out ----

197 // Per-deploy pull secret from the gh session (no long-lived PAT needed).

198 run('Upsert pull secret', `oc create secret docker-registry ghcr-pull ` +

199 `--docker-server=${registryHost} --docker-username="$(gh api user -q .login)" --docker-password="$(gh auth token)" ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

src/executors/sandbox/sandbox.jsView on unpkg · L199

200 `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`, cwd);

201 // oc tag sets/repoints the imagestream tag with reference-policy=local so

202 // pods pull in-cluster; import --confirm then pulls the current manifest.

203 run('Tag imagestream', `oc tag ${imageRef} ${projectName}:${imageTag} --reference-policy=local -n ${sandboxProject}`, cwd);

204 importWithRetry(`${projectName}:${imageTag}`, sandboxProject, cwd, importRetries);

205 run('Apply manifest', `oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`, cwd);

206 run('Restart rollout', `oc rollout restart deployment/${projectName} -n ${sandboxProject}`, cwd);

207 run('Wait for rollout', `oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=180s`, cwd);

208 devkit_1.logger.info(`\n✓ Sandbox deploy complete for ${projectName}.`);

209 return { success: true };

210 }

211 catch (err) {

212 devkit_1.logger.error(`\n[nx-oc:sandbox] ${err.message}`);

213 return { success: false };

214 }

215 });

216}

217//# sourceMappingURL=sandbox.js.map

•matchType = previous_version_dangerous_delta matchedPackage = @abgov/nx-oc@12.15.1 matchedIdentity = npm:QGFiZ292L254LW9j:12.15.1 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/executors/sandbox/sandbox.jsView on unpkg

Source & flagged code

2 flagged · loading source

src/executors/sandbox/sandbox.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/executors/sandbox/sandbox.jsView on unpkg

199patternName = generic_password severity = medium line = 199 matchedText = `--docke... ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

src/executors/sandbox/sandbox.jsView on unpkg · L199

Findings

1 High3 Medium3 Low

HighPrevious Version Dangerous Deltasrc/executors/sandbox/sandbox.js

MediumSecret Patternsrc/executors/sandbox/sandbox.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings