registry / @abgov/nx-oc / 12.15.0

@abgov/nx-oc@12.15.0

Government of Alberta - Nx plugin for OpenShift.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 104 KB of source, external domains: access-uat.alberta.ca, access.example.com, api.example.com, api.example.openshift.com, github.com, gitlab.com, mirror.openshift.com, test-test-sandbox.apps.test.example.com

Source & flagged code

2 flagged

src/generators/sandbox/sandbox.jsView file

Lines 132-172javascript

132 };

133 });

134 for (const { name, port } of proxyServices) {

135 commands.push(`oc get service ${name} -n ${sandboxProject} >/dev/null 2>&1 || ` +

136 `oc create service clusterip ${name} --tcp=${port}:${port} -n ${sandboxProject}`);

137 }

138 // Build the image locally and push to the container registry, then import it

139 // into the namespace's imagestream. reference-policy=local mirrors it into the

140 // internal registry so pods pull in-cluster (no per-pod pull secret, no node

141 // egress to the registry). This replaces the in-cluster BuildConfig: no

142 // full-workspace upload, and local layer caching makes iteration fast.

143 commands.push(`npx nx build ${projectName} --configuration production`);

144 commands.push(`podman build --platform=linux/amd64 -f .openshift/${projectName}/Dockerfile -t ${imageRef} .`);

145 // Prereq: the publishing account is logged in with write:packages. gh supplies

146 // the token so no PAT is stored; the same session token backs the pull secret.

147 commands.push(`gh auth token | podman login ${registryHost} -u "$(gh api user -q .login)" --password-stdin`);

148 commands.push(`podman push ${imageRef}`);

149 // Per-deploy pull secret from the gh session (sandbox images are re-imported

150 // every run, so a session token is sufficient — no long-lived PAT needed).

151 commands.push(`oc create secret docker-registry ghcr-pull ` +

152 `--docker-server=${registryHost} --docker-username="$(gh api user -q .login)" --docker-password="$(gh auth token)" ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

src/generators/sandbox/sandbox.jsView on unpkg · L152

153 `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`);

154 // oc tag sets/repoints the imagestream tag (import-image refuses to change an

155 // existing tag's source); import --confirm then pulls the manifest.

156 commands.push(`oc tag ${imageRef} ${projectName}:sandbox --reference-policy=local -n ${sandboxProject}`);

157 commands.push(`oc import-image ${projectName}:sandbox --confirm -n ${sandboxProject}`);

158 commands.push(`oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`);

159 commands.push(`oc rollout restart deployment/${projectName} -n ${sandboxProject}`);

160 commands.push(`oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=180s`);

161 config.targets = Object.assign(Object.assign({}, config.targets), { sandbox: {

162 executor: 'nx:run-commands',

163 options: {

164 commands,

165 parallel: false,

166 },

167 }, 'sandbox-teardown': {

168 executor: 'nx:run-commands',

169 options: {

170 commands: [

171 `oc delete all,configmap,is -l app=${projectName} -n ${sandboxProject} --ignore-not-found`,

172 `oc delete imagestream ${projectName} -n ${sandboxProject} --ignore-not-found`,

src/utils/oc-utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @abgov/nx-oc@12.13.0 matchedIdentity = npm:QGFiZ292L254LW9j:12.13.0 similarity = 0.759 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/utils/oc-utils.jsView on unpkg

Source & flagged code

2 flagged · loading source

src/generators/sandbox/sandbox.jsView file

152patternName = generic_password severity = medium line = 152 matchedText = `--docke... ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

src/generators/sandbox/sandbox.jsView on unpkg · L152

src/utils/oc-utils.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/utils/oc-utils.jsView on unpkg

Findings

1 High2 Medium3 Low

HighPrevious Version Dangerous Deltasrc/utils/oc-utils.js

MediumSecret Patternsrc/generators/sandbox/sandbox.js

MediumNetwork

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings