registry / @bonsae/nrg / 0.32.0

@bonsae/nrg@0.32.0

NRG framework — build Node-RED nodes with Vue 3, TypeScript, and JSON Schema

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 422 KB of source, external domains: 127.0.0.1, bonsaedev.github.io, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged

vite/index.jsView file

Lines 76-116javascript

76 }

77 const stat = fs.statSync(srcPath);

78 if (stat.isDirectory()) {

79 fs.cpSync(srcPath, destPath, { recursive: true });

80 } else {

81 fs.mkdirSync(path.dirname(destPath), { recursive: true });

82 fs.copyFileSync(srcPath, destPath);

83 }

84 }

85}

86var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

87function discoverResourceCopyTargets(resourcesDir) {

88 if (!fs.existsSync(resourcesDir)) return [];

89 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

90 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

91 ).map((entry) => ({

92 src: path.join(resourcesDir, entry.name),

93 dest: entry.name

94 }));

95}

96function getPackageName() {

97 const pkgPath = path.resolve("./package.json");

98 if (fs.existsSync(pkgPath)) {

99 try {

100 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

101 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L96

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L96

102 } catch {

103 return "node-red-nodes";

104 }

105 }

106 return "node-red-nodes";

107}

108function mergeOptions(defaults, overrides) {

109 if (!overrides) return { ...defaults };

110 const result = { ...defaults };

111 for (const key of Object.keys(overrides)) {

112 const overrideVal = overrides[key];

113 const defaultVal = defaults[key];

114 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

115 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

116 } else if (overrideVal !== void 0 && !Array.isArray(overrideVal) && !Array.isArray(defaultVal) && typeof overrideVal === "object" && typeof defaultVal === "object" && overrideVal !== null && defaultVal !==

Lines 245-296javascript

245 console.log(`\u2502`);

246 }

247 endGroup(message) {

248 console.log(`\u2502`);

249 console.log(`\u2514\u2500 ${message ?? "Done"}`);

250 console.log();

251 }

lib/server/resources/nrg.229bba2d.jsView file

Lines 1-14javascript

1(function(){"use strict";try{if(typeof document<"u"){var e=document.createElement("style");e.appendChild(document.createTextNode('.nrg-form-app[data-v-e262ed17]{padding-bottom:16px}.nrg-lifecycle-port[data-v-e262ed17]{white-space:nowrap}.nrg-lifecycle td.nrg-lifecycle-desc[data-v-e262ed17]{text-align:left;white-space:nowrap;color:var(--red-ui-text-color-disabled, #999)}.nrg-help-list[data-v-e262ed17]{margin:4px 0 6px;padding-left:16px;font-size:11px;line-height:1.5;color:var(--red-ui-text-color-disabled, #999)}.nrg-help-list li[data-v-e262ed17]{margin:1px 0}.nrg-section[data-v-e262ed17]{border ...

Source & flagged code

5 flagged · loading source

vite/index.jsView file

265// src/tools/vite/node-red-launcher/entry-point.ts L266: import { exec } from "child_process"; L267: import { randomUUID } from "crypto";

High

Child Process

Package source references child process execution.

vite/index.jsView on unpkg · L265

96Cross-file remote execution chain: vite/index.js spawns lib/server/resources/nrg.229bba2d.js; helper contains network access plus dynamic code execution. L96: function getPackageName() { L97: const pkgPath = path.resolve("./package.json"); L98: if (fs.existsSync(pkgPath)) { L99: try { L100: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L101: return pkg.name; ... L265: // src/tools/vite/node-red-launcher/entry-point.ts L266: import { exec } from "child_process"; L267: import { randomUUID } from "crypto"; ... L276: try { L277: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L278: const pkgJsonPath = require_.resolve("node-red/package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L96

276try { L277: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L278: const pkgJsonPath = require_.resolve("node-red/package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vite/index.jsView on unpkg · L276

96function getPackageName() { L97: const pkgPath = path.resolve("./package.json"); L98: if (fs.existsSync(pkgPath)) { L99: try { L100: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L101: return pkg.name; ... L265: // src/tools/vite/node-red-launcher/entry-point.ts L266: import { exec } from "child_process"; L267: import { randomUUID } from "crypto"; ... L276: try { L277: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L278: const pkgJsonPath = require_.resolve("node-red/package.json");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L96

lib/server/resources/nrg.229bba2d.jsView file

5|| (${C} === "string" && ${_} && ${_} == +${_} && !(${_} % 1))`).assign(q,(0,n._)`+${_}`);return;case"boolean":g.elseIf((0,n._)`${_} === "false" || ${_} === 0 || ${_} === null`).as... L6: || ${C} === "boolean" || ${_} === null`).assign(q,(0,n._)`[${_}]`)}}}function b({gen:a,parentData:i,parentDataProperty:w},g){a.if((0,n._)`${i} !== undefined`,()=>a.assign((0,n._)`$... L7: missingProperty: ${S},

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/server/resources/nrg.229bba2d.jsView on unpkg · L5

Findings

3 High3 Medium5 Low

HighChild Processvite/index.js

HighShell

HighCross File Remote Execution Contextvite/index.js

MediumDynamic Requirevite/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvallib/server/resources/nrg.229bba2d.js

LowWeak Cryptovite/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

vite/index.jsView file

Lines 76-116javascript

76 }

77 const stat = fs.statSync(srcPath);

78 if (stat.isDirectory()) {

79 fs.cpSync(srcPath, destPath, { recursive: true });

80 } else {

81 fs.mkdirSync(path.dirname(destPath), { recursive: true });

82 fs.copyFileSync(srcPath, destPath);

83 }

84 }

85}

86var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

87function discoverResourceCopyTargets(resourcesDir) {

88 if (!fs.existsSync(resourcesDir)) return [];

89 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

90 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

91 ).map((entry) => ({

92 src: path.join(resourcesDir, entry.name),

93 dest: entry.name

94 }));

95}

96function getPackageName() {

97 const pkgPath = path.resolve("./package.json");

98 if (fs.existsSync(pkgPath)) {

99 try {

100 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

101 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L96

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L96

102 } catch {

103 return "node-red-nodes";

104 }

105 }

106 return "node-red-nodes";

107}

108function mergeOptions(defaults, overrides) {

109 if (!overrides) return { ...defaults };

110 const result = { ...defaults };

111 for (const key of Object.keys(overrides)) {

112 const overrideVal = overrides[key];

113 const defaultVal = defaults[key];

114 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

115 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

Lines 245-296javascript

245 console.log(`\u2502`);

246 }

247 endGroup(message) {

248 console.log(`\u2502`);

249 console.log(`\u2514\u2500 ${message ?? "Done"}`);

250 console.log();

251 }

lib/server/resources/nrg.229bba2d.jsView file

Lines 1-14javascript