registry / @beiguancyc/parse-server / 9.9.0-ruixiang.1

@beiguancyc/parse-server@9.9.0-ruixiang.1

An express module providing a Parse-compatible API server

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 5.71 MB of source, external domains: accounts.google.com, accounts.spotify.com, api.github.com, api.instagram.com, api.line.me, api.linkedin.com, api.spotify.com, api.twitter.com, api.weibo.com, api.weixin.qq.com, appleid.apple.com, buy.itunes.apple.com, cacerts.digicert.com, datatracker.ietf.org, docs.mongodb.com, docs.parseplatform.org, embeddable-sandbox.cdn.apollographql.com, expressjs.com, files.parse.com, files.parsetfss.com, github.com, graph.facebook.com, graph.instagram.com, graph.microsoft.com, graph.qq.com, graphql.org, login.microsoftonline.com, oauth2.googleapis.com, opencollective.com, parseplatform.org, sandbox.itunes.apple.com, www.apollographql.com, www.facebook.com, www.googleapis.com, www.linkedin.com, www.mongodb.com

Source & flagged code

5 flagged

package.jsonView file

Lines 92-155json

92 "graphql-tag": "2.12.6",

93 "jasmine": "6.1.0",

94 "jasmine-spec-reporter": "7.0.0",

95 "jsdoc": "4.0.5",

96 "jsdoc-babel": "0.5.0",

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts changed=madge:circular

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node -p 'require("./postinstall.js")()'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -p 'require("./postinstall.js")()'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/Routers/AudiencesRouter.jsView file

6exports.default = exports.AudiencesRouter = void 0; L7: var _ClassesRouter = _interopRequireDefault(require("./ClassesRouter")); L8: var _rest = _interopRequireDefault(require("../rest"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Routers/AudiencesRouter.jsView on unpkg · L6

lib/Adapters/Auth/OAuth1Client.jsView file

2L3: var https = require('https'), L4: crypto = require('crypto'); ... L26: res.on('end', function () { L27: data = JSON.parse(data); L28: resolve(data); ... L33: if (request.body) { L34: httpRequest.write(request.body); L35: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Adapters/Auth/OAuth1Client.jsView on unpkg · L2

Findings

1 Critical1 High5 Medium6 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirelib/Routers/AudiencesRouter.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Adapters/Auth/OAuth1Client.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

lib/Routers/AudiencesRouter.jsView file

Lines 1-26javascript

1"use strict";

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.default = exports.AudiencesRouter = void 0;

7var _ClassesRouter = _interopRequireDefault(require("./ClassesRouter"));

8var _rest = _interopRequireDefault(require("../rest"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Routers/AudiencesRouter.jsView on unpkg · L6

9var middleware = _interopRequireWildcard(require("../middlewares"));

10function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule)

11function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }

12class AudiencesRouter extends _ClassesRouter.default {

13 className() {

14 return '_Audience';

15 }

16 handleFind(req) {

17 const body = Object.assign(req.body || {}, _ClassesRouter.default.JSONFromQuery(req.query));

18 const options = _ClassesRouter.default.optionsFromBody(body, req.config.defaultLimit);

19 return _rest.default.find(req.config, req.auth, '_Audience', body.where, options, req.info.clientSDK, req.info.context).then(response => {

20 response.results.forEach(item => {

21 item.query = JSON.parse(item.query);

22 });

23 return {

24 response: response

25 };

26 });

Long lines were clipped for display.

lib/Adapters/Auth/OAuth1Client.jsView file

Lines 1-22javascript

1"use strict";

3var https = require('https'),

4 crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Adapters/Auth/OAuth1Client.jsView on unpkg · L2

5var Parse = require('parse/node').Parse;

6var OAuth = function (options) {

7 if (!options) {

8 throw new Parse.Error(Parse.Error.INTERNAL_SERVER_ERROR, 'No options passed to OAuth');

9 }

10 this.consumer_key = options.consumer_key;

11 this.consumer_secret = options.consumer_secret;

12 this.auth_token = options.auth_token;

13 this.auth_token_secret = options.auth_token_secret;

14 this.host = options.host;

15 this.oauth_params = options.oauth_params || {};

16};

17OAuth.prototype.send = function (method, path, params, body) {

18 var request = this.buildRequest(method, path, params, body);

19 // Encode the body properly, the current Parse Implementation don't do it properly

20 return new Promise(function (resolve, reject) {

21 var httpRequest = https.request(request, function (res) {

22 var data = '';