registry / @almadar/integrations / 2.15.0

@almadar/integrations@2.15.0

External service integrations for Almadar applications

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 142 KB of source, external domains: accounts.google.com, api.github.com, auth.example.com, github.com, storage.mock.local

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-29javascript

1import { createLogger } from '@almadar/logger';

2import { integratorsRegistry } from '@almadar/patterns';

3import Stripe from 'stripe';

4import { google } from 'googleapis';

5import twilio from 'twilio';

6import sgMail from '@sendgrid/mail';

7import { Resend } from 'resend';

8import { getAvailableProvider, LLMClient } from '@almadar/llm';

9import { z } from 'zod';

10import { execSync, spawn } from 'child_process';

11import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L9

12import { join } from 'path';

13import { tmpdir } from 'os';

15// src/core/logger.ts

16var ConsoleLogger = class {

17 constructor(_level = "info") {

18 this.log = createLogger("almadar:integrations");

19 }

20 debug(message, meta) {

21 this.log.debug(message, meta);

22 }

23 info(message, meta) {

24 this.log.info(message, meta);

25 }

26 warn(message, meta) {

27 this.log.warn(message, meta);

28 }

29 error(message, meta) {

Lines 1737-1777javascript

1737 throw new Error(`Unknown CLI action: ${action}`);

1738 }

1739 return {

1740 success: true,

1741 data,

1742 metadata: this.createMetadata(action, Date.now() - startTime)

1743 };

1744 }

Source & flagged code

3 flagged · loading source

dist/index.jsView file

9import { z } from 'zod'; L10: import { execSync, spawn } from 'child_process'; L11: import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

9import { z } from 'zod'; L10: import { execSync, spawn } from 'child_process'; L11: import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs'; ... L153: error: integrationError, L154: metadata: this.createMetadata(action, 0, 0) L155: }; ... L1127: super(config); L1128: this.apiUrl = config.env.DEEPAGENT_API_URL || "http://localhost:3000"; L1129: this.apiKey = config.env.DEEPAGENT_API_KEY || ""; ... L1240: } L1241: return await response.json(); L1242: }

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L9

1757this.logger.debug("Validating schema", { path: schemaPath }); L1758: const output = execSync( L1759: `npx @almadar/cli validate "${schemaPath}" --format=json`, L1760: {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1757

Findings

4 High3 Medium4 Low

HighChild Processdist/index.js

HighShell

HighCredential Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-29javascript

1import { createLogger } from '@almadar/logger';

2import { integratorsRegistry } from '@almadar/patterns';

3import Stripe from 'stripe';

4import { google } from 'googleapis';

5import twilio from 'twilio';

6import sgMail from '@sendgrid/mail';

7import { Resend } from 'resend';

8import { getAvailableProvider, LLMClient } from '@almadar/llm';

9import { z } from 'zod';

10import { execSync, spawn } from 'child_process';

11import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L9

12import { join } from 'path';

13import { tmpdir } from 'os';

15// src/core/logger.ts

16var ConsoleLogger = class {

17 constructor(_level = "info") {

18 this.log = createLogger("almadar:integrations");

19 }

20 debug(message, meta) {

21 this.log.debug(message, meta);

22 }

23 info(message, meta) {

24 this.log.info(message, meta);

25 }

26 warn(message, meta) {

27 this.log.warn(message, meta);

28 }

29 error(message, meta) {

Lines 1737-1777javascript

1737 throw new Error(`Unknown CLI action: ${action}`);

1738 }

1739 return {

1740 success: true,

1741 data,

1742 metadata: this.createMetadata(action, Date.now() - startTime)

1743 };

1744 }