registry / @beiguancyc/parse-server / 9.9.0-ruixiang.1

@beiguancyc/parse-server@9.9.0-ruixiang.1

An express module providing a Parse-compatible API server

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 5.71 MB of source, external domains: accounts.google.com, accounts.spotify.com, api.github.com, api.instagram.com, api.line.me, api.linkedin.com, api.spotify.com, api.twitter.com, api.weibo.com, api.weixin.qq.com, appleid.apple.com, buy.itunes.apple.com, cacerts.digicert.com, datatracker.ietf.org, docs.mongodb.com, docs.parseplatform.org, embeddable-sandbox.cdn.apollographql.com, expressjs.com, files.parse.com, files.parsetfss.com, github.com, graph.facebook.com, graph.instagram.com, graph.microsoft.com, graph.qq.com, graphql.org, login.microsoftonline.com, oauth2.googleapis.com, opencollective.com, parseplatform.org, sandbox.itunes.apple.com, www.apollographql.com, www.facebook.com, www.googleapis.com, www.linkedin.com, www.mongodb.com

Source & flagged code

5 flagged

package.jsonView file

Lines 92-155json

92 "graphql-tag": "2.12.6",

93 "jasmine": "6.1.0",

94 "jasmine-spec-reporter": "7.0.0",

95 "jsdoc": "4.0.5",

96 "jsdoc-babel": "0.5.0",

97 "lint-staged": "16.4.0",

98 "m": "1.10.0",

99 "madge": "8.0.0",

100 "mock-files-adapter": "file:spec/dependencies/mock-files-adapter",

101 "mock-mail-adapter": "file:spec/dependencies/mock-mail-adapter",

102 "mongodb-runner": "5.9.3",

103 "node-abort-controller": "3.1.1",

104 "node-fetch": "3.3.2",

105 "nyc": "17.1.0",

106 "prettier": "3.8.1",

107 "semantic-release": "25.0.3",

108 "typescript": "5.9.3",

109 "typescript-eslint": "8.58.0",

110 "yaml": "2.8.3"

111 },

112 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L112

113 "ci:check": "node ./ci/ciCheck.js",

114 "ci:checkNodeEngine": "node ./ci/nodeEngineCheck.js",

115 "ci:definitionsCheck": "node ./ci/definitionsCheck.js",

116 "definitions": "node ./resources/buildConfigDefinitions.js && prettier --write 'src/Options/*.js'",

117 "docs": "jsdoc -c ./jsdoc-conf.json",

118 "lint": "eslint --cache ./ --flag unstable_config_lookup_from_file",

119 "lint-fix": "eslint --fix --cache ./ --flag unstable_config_lookup_from_file",

120 "build": "babel src/ -d lib/ --copy-files --extensions '.ts,.js'",

121 "build:types": "tsc",

122 "watch": "babel --watch src/ -d lib/ --copy-files",

123 "watch:ts": "tsc --watch",

124 "test:mongodb:7.0.16": "MONGODB_VERSION=7.0.16 npm run test",

125 "test:mongodb:8.0.4": "MONGODB_VERSION=8.0.4 npm run test",

126 "test:postgres:testonly": "cross-env PARSE_SERVER_TEST_DB=postgres PARSE_SERVER_TEST_DATABASE_URI=postgres://postgres:password@localhost:5432/parse_server_postgres_adapter_test_database npm run testonly",

127 "testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} TESTING=1 jasmine",

128 "test": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} mongodb-runner exec -t ${MONGODB_TOPOLOGY} --version ${MONGODB_VERSION} -- --port 27017 -- npm run testonly",

129 "test:types": "eslint types/tests.ts -c ./types/eslint.config.mjs",

130 "coverage:mongodb": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} mongodb-runner exec -t ${MONGODB_TOPOLOGY} --version ${MONGODB_VERSION} -- --port 27017 -- npm run coverage",

131 "coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} TESTING=1 nyc jasmine",

132 "start": "node ./bin/parse-server",

133 "prettier": "prettier --write {src,spec}/{**/*,*}.js",

134 "prepare": "npm run build",

135 "postinstall": "node -p 'require(\"./postinstall.js\")()'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L135

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L135

136 "madge:circular": "node_modules/.bin/madge ./src --circular",

137 "benchmark": "cross-env MONGODB_VERSION=8.0.4 MONGODB_TOPOLOGY=standalone mongodb-runner exec -t standalone --version 8.0.4 -- --port 27017 -- npm run benchmark:only",

138 "benchmark:only": "node --expose-gc --max-old-space-size=1024 benchmark/performance.js",

139 "benchmark:quick": "cross-env BENCHMARK_ITERATIONS=10 npm run benchmark:only"

140 },

141 "types": "types/index.d.ts",

142 "engines": {

143 "node": ">=20.19.0 <21.0.0 || >=22.13.0 <23.0.0 || >=24.11.0 <25.0.0"

144 },

145 "bin": {

146 "parse-server": "bin/parse-server"

147 },

148 "optionalDependencies": {

149 "@node-rs/bcrypt": "1.10.7"

150 },

151 "collective": {

152 "type": "opencollective",

153 "url": "https://opencollective.com/parse-server",

154 "logo": "https://opencollective.com/parse-server/logo.txt?reverse=true&variant=binary"

155 },

lib/Routers/AudiencesRouter.jsView file

Lines 1-26javascript

1"use strict";

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.default = exports.AudiencesRouter = void 0;

7var _ClassesRouter =

lib/Adapters/Auth/OAuth1Client.jsView file

Lines 1-22javascript

1"use strict";

3var https = require('https'),

4 crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Adapters/Auth/OAuth1Client.jsView on unpkg · L2

5var Parse = require(

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts changed=madge:circular

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node -p 'require("./postinstall.js")()'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -p 'require("./postinstall.js")()'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/Routers/AudiencesRouter.jsView file

6exports.default = exports.AudiencesRouter = void 0; L7: var _ClassesRouter = _interopRequireDefault(require("./ClassesRouter")); L8: var _rest = _interopRequireDefault(require("../rest"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Routers/AudiencesRouter.jsView on unpkg · L6

lib/Adapters/Auth/OAuth1Client.jsView file

2L3: var https = require('https'), L4: crypto = require('crypto'); ... L26: res.on('end', function () { L27: data = JSON.parse(data); L28: resolve(data); ... L33: if (request.body) { L34: httpRequest.write(request.body); L35: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Adapters/Auth/OAuth1Client.jsView on unpkg · L2

Findings

1 Critical1 High5 Medium6 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirelib/Routers/AudiencesRouter.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Adapters/Auth/OAuth1Client.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 92-155json

92 "graphql-tag": "2.12.6",

93 "jasmine": "6.1.0",

94 "jasmine-spec-reporter": "7.0.0",

95 "jsdoc": "4.0.5",

96 "jsdoc-babel": "0.5.0",

97 "lint-staged": "16.4.0",

98 "m": "1.10.0",

99 "madge": "8.0.0",

100 "mock-files-adapter": "file:spec/dependencies/mock-files-adapter",

101 "mock-mail-adapter": "file:spec/dependencies/mock-mail-adapter",

102 "mongodb-runner": "5.9.3",

103 "node-abort-controller": "3.1.1",

104 "node-fetch": "3.3.2",

105 "nyc": "17.1.0",

106 "prettier": "3.8.1",

107 "semantic-release": "25.0.3",

108 "typescript": "5.9.3",

109 "typescript-eslint": "8.58.0",

110 "yaml": "2.8.3"

111 },

112 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L112

113 "ci:check": "node ./ci/ciCheck.js",

114 "ci:checkNodeEngine": "node ./ci/nodeEngineCheck.js",

115 "ci:definitionsCheck": "node ./ci/definitionsCheck.js",

116 "definitions": "node ./resources/buildConfigDefinitions.js && prettier --write 'src/Options/*.js'",

117 "docs": "jsdoc -c ./jsdoc-conf.json",

118 "lint": "eslint --cache ./ --flag unstable_config_lookup_from_file",

119 "lint-fix": "eslint --fix --cache ./ --flag unstable_config_lookup_from_file",

120 "build": "babel src/ -d lib/ --copy-files --extensions '.ts,.js'",

121 "build:types": "tsc",

122 "watch": "babel --watch src/ -d lib/ --copy-files",

123 "watch:ts": "tsc --watch",

124 "test:mongodb:7.0.16": "MONGODB_VERSION=7.0.16 npm run test",

125 "test:mongodb:8.0.4": "MONGODB_VERSION=8.0.4 npm run test",

127 "testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} TESTING=1 jasmine",

129 "test:types": "eslint types/tests.ts -c ./types/eslint.config.mjs",

131 "coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=8.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} TESTING=1 nyc jasmine",

132 "start": "node ./bin/parse-server",

133 "prettier": "prettier --write {src,spec}/{**/*,*}.js",

134 "prepare": "npm run build",

135 "postinstall": "node -p 'require(\"./postinstall.js\")()'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L135

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L135

136 "madge:circular": "node_modules/.bin/madge ./src --circular",

137 "benchmark": "cross-env MONGODB_VERSION=8.0.4 MONGODB_TOPOLOGY=standalone mongodb-runner exec -t standalone --version 8.0.4 -- --port 27017 -- npm run benchmark:only",

138 "benchmark:only": "node --expose-gc --max-old-space-size=1024 benchmark/performance.js",

139 "benchmark:quick": "cross-env BENCHMARK_ITERATIONS=10 npm run benchmark:only"

140 },

141 "types": "types/index.d.ts",

142 "engines": {

143 "node": ">=20.19.0 <21.0.0 || >=22.13.0 <23.0.0 || >=24.11.0 <25.0.0"

144 },

145 "bin": {

146 "parse-server": "bin/parse-server"

147 },

148 "optionalDependencies": {

149 "@node-rs/bcrypt": "1.10.7"

150 },

151 "collective": {

152 "type": "opencollective",

153 "url": "https://opencollective.com/parse-server",

154 "logo": "https://opencollective.com/parse-server/logo.txt?reverse=true&variant=binary"

155 },

lib/Routers/AudiencesRouter.jsView file

Lines 1-26javascript

1"use strict";

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.default = exports.AudiencesRouter = void 0;

7var _ClassesRouter =

lib/Adapters/Auth/OAuth1Client.jsView file

Lines 1-22javascript

1"use strict";

3var https = require('https'),

4 crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Adapters/Auth/OAuth1Client.jsView on unpkg · L2

5var Parse = require(