registry / @bonsae/nrg / 0.31.0

@bonsae/nrg@0.31.0

NRG framework — build Node-RED nodes with Vue 3, TypeScript, and JSON Schema

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 372 KB of source, external domains: 127.0.0.1, bonsaedev.github.io, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged

vite/index.jsView file

Lines 61-101javascript

61 }

62 const stat = fs.statSync(srcPath);

63 if (stat.isDirectory()) {

64 fs.cpSync(srcPath, destPath, { recursive: true });

65 } else {

66 fs.mkdirSync(path.dirname(destPath), { recursive: true });

67 fs.copyFileSync(srcPath, destPath);

68 }

69 }

70}

71var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

72function discoverResourceCopyTargets(resourcesDir) {

73 if (!fs.existsSync(resourcesDir)) return [];

74 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

75 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

76 ).map((entry) => ({

77 src: path.join(resourcesDir, entry.name),

78 dest: entry.name

79 }));

80}

81function getPackageName() {

82 const pkgPath = path.resolve("./package.json");

83 if (fs.existsSync(pkgPath)) {

84 try {

85 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

86 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L81

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L81

87 } catch {

88 return "node-red-nodes";

89 }

90 }

91 return "node-red-nodes";

92}

93function mergeOptions(defaults, overrides) {

94 if (!overrides) return { ...defaults };

95 const result = { ...defaults };

96 for (const key of Object.keys(overrides)) {

97 const overrideVal = overrides[key];

98 const defaultVal = defaults[key];

99 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

100 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

101 } else if (overrideVal !== void 0 && !Array.isArray(overrideVal) && !Array.isArray(defaultVal) && typeof overrideVal === "object" && typeof defaultVal === "object" && overrideVal !== null && defaultVal !==

Lines 230-270javascript

230 console.log(`\u2502`);

231 }

232 endGroup(message) {

233 console.log(`\u2502`);

234 console.log(`\u2514\u2500 ${message ?? "Done"}`);

235 console.log();

236 }

server/resources/nrg-client.jsView file

Lines 1-13javascript

1(function(){"use strict";try{if(typeof document<"u"){var e=document.createElement("style");e.appendChild(document.createTextNode('.nrg-form-app[data-v-3feedc7a]{padding-bottom:16px}.nrg-lifecycle-port[data-v-3feedc7a]{white-space:nowrap}.nrg-lifecycle td.nrg-lifecycle-desc[data-v-3feedc7a],.nrg-input td.nrg-input-desc[data-v-3feedc7a]{text-align:left;white-space:nowrap;color:var(--red-ui-text-color-disabled, #999)}.nrg-section[data-v-3feedc7a]{border-top:1px solid var(--red-ui-secondary-border-color, #ddd);margin-top:12px;padding-top:8px}.nrg-section-title[data-v-3feedc7a]{font-weight:700;font ...

server/index.cjsView file

Lines 399-439javascript

399 this.node.error(message, msg);

400 }

401 get id() {

402 return this.node.id;

403 }

404 get name() {

405 return this.node.name;

406 }

407

Source & flagged code

5 flagged · loading source

vite/index.jsView file

250// src/vite/node-red-launcher/entry-point.ts L251: import { exec } from "child_process"; L252: import { randomUUID } from "crypto";

High

Child Process

Package source references child process execution.

vite/index.jsView on unpkg · L250

81Cross-file remote execution chain: vite/index.js spawns server/resources/nrg-client.js; helper contains network access plus dynamic code execution. L81: function getPackageName() { L82: const pkgPath = path.resolve("./package.json"); L83: if (fs.existsSync(pkgPath)) { L84: try { L85: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L86: return pkg.name; ... L250: // src/vite/node-red-launcher/entry-point.ts L251: import { exec } from "child_process"; L252: import { randomUUID } from "crypto"; ... L261: try { L262: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L263: const pkgJsonPath = require_.resolve("node-red/package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L81

81function getPackageName() { L82: const pkgPath = path.resolve("./package.json"); L83: if (fs.existsSync(pkgPath)) { L84: try { L85: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L86: return pkg.name; ... L250: // src/vite/node-red-launcher/entry-point.ts L251: import { exec } from "child_process"; L252: import { randomUUID } from "crypto"; ... L261: try { L262: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L263: const pkgJsonPath = require_.resolve("node-red/package.json");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L81

server/resources/nrg-client.jsView file

4|| (${C} === "string" && ${w} && ${w} == +${w} && !(${w} % 1))`).assign(q,(0,o._)`+${w}`);return;case"boolean":g.elseIf((0,o._)`${w} === "false" || ${w} === 0 || ${w} === null`).as... L5: || ${C} === "boolean" || ${w} === null`).assign(q,(0,o._)`[${w}]`)}}}function b({gen:n,parentData:i,parentDataProperty:_},g){n.if((0,o._)`${i} !== undefined`,()=>n.assign((0,o._)`$... L6: missingProperty: ${S},

Low

Eval

Package source references a known benign dynamic code generation pattern.

server/resources/nrg-client.jsView on unpkg · L4

server/index.cjsView file

419// src/core/server/nodes/io-node.ts L420: var import_typebox = require("@sinclair/typebox"); L421:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/index.cjsView on unpkg · L419

Findings

3 High3 Medium5 Low

HighChild Processvite/index.js

HighShell

HighCross File Remote Execution Contextvite/index.js

MediumDynamic Requireserver/index.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalserver/resources/nrg-client.js

LowWeak Cryptovite/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

vite/index.jsView file

Lines 61-101javascript

61 }

62 const stat = fs.statSync(srcPath);

63 if (stat.isDirectory()) {

64 fs.cpSync(srcPath, destPath, { recursive: true });

65 } else {

66 fs.mkdirSync(path.dirname(destPath), { recursive: true });

67 fs.copyFileSync(srcPath, destPath);

68 }

69 }

70}

71var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

72function discoverResourceCopyTargets(resourcesDir) {

73 if (!fs.existsSync(resourcesDir)) return [];

74 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

75 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

76 ).map((entry) => ({

77 src: path.join(resourcesDir, entry.name),

78 dest: entry.name

79 }));

80}

81function getPackageName() {

82 const pkgPath = path.resolve("./package.json");

83 if (fs.existsSync(pkgPath)) {

84 try {

85 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

86 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L81

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L81

87 } catch {

88 return "node-red-nodes";

89 }

90 }

91 return "node-red-nodes";

92}

93function mergeOptions(defaults, overrides) {

94 if (!overrides) return { ...defaults };

95 const result = { ...defaults };

96 for (const key of Object.keys(overrides)) {

97 const overrideVal = overrides[key];

98 const defaultVal = defaults[key];

99 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

100 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

Lines 230-270javascript

230 console.log(`\u2502`);

231 }

232 endGroup(message) {

233 console.log(`\u2502`);

234 console.log(`\u2514\u2500 ${message ?? "Done"}`);

235 console.log();

236 }

server/resources/nrg-client.jsView file

Lines 1-13javascript

server/index.cjsView file

Lines 399-439javascript

399 this.node.error(message, msg);

400 }

401 get id() {

402 return this.node.id;

403 }

404 get name() {

405 return this.node.name;

406 }

407