registry / @bonsae/nrg / 0.36.0

@bonsae/nrg@0.36.0

NRG framework — build Node-RED nodes with Vue 3, TypeScript, and JSON Schema

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 437 KB of source, external domains: 127.0.0.1, bonsaedev.github.io, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged

vite/index.jsView file

Lines 75-115javascript

75 }

76 const stat = fs.statSync(srcPath);

77 if (stat.isDirectory()) {

78 fs.cpSync(srcPath, destPath, { recursive: true });

79 } else {

80 fs.mkdirSync(path.dirname(destPath), { recursive: true });

81 fs.copyFileSync(srcPath, destPath);

82 }

83 }

84}

85var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

86function discoverResourceCopyTargets(resourcesDir) {

87 if (!fs.existsSync(resourcesDir)) return [];

88 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

89 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

90 ).map((entry) => ({

91 src: path.join(resourcesDir, entry.name),

92 dest: entry.name

93 }));

94}

95function getPackageName() {

96 const pkgPath = path.resolve("./package.json");

97 if (fs.existsSync(pkgPath)) {

98 try {

99 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

100 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L95

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L95

101 } catch {

102 return "node-red-nodes";

103 }

104 }

105 return "node-red-nodes";

106}

107function mergeOptions(defaults, overrides) {

108 if (!overrides) return { ...defaults };

109 const result = { ...defaults };

110 for (const key of Object.keys(overrides)) {

111 const overrideVal = overrides[key];

112 const defaultVal = defaults[key];

113 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

114 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

115 } else if (overrideVal !== void 0 && !Array.isArray(overrideVal) && !Array.isArray(defaultVal) && typeof overrideVal === "object" && typeof defaultVal === "object" && overrideVal !== null && defaultVal !==

Lines 257-308javascript

257 endGroup(message) {

258 console.log(`\u2502`);

259 console.log(`\u2514\u2500 ${message ?? "Done"}`);

260 console.log();

261 }

262 startSpinner(message) {

263 this.spinner.start

lib/server/resources/nrg.0682c337.jsView file

Lines 1-25javascript

1(function(){"use strict";try{if(typeof document<"u"){var e=document.createElement("style");e.appendChild(document.createTextNode('.nrg-tray-content[data-v-715e36f4]{height:100%;padding:12px;box-sizing:border-box}.nrg-label[data-v-ec9d13ab]{display:inline-block;width:100%;margin-bottom:4px;cursor:default}.nrg-label i[data-v-ec9d13ab]{margin-right:5px}.nrg-required[data-v-ec9d13ab]{color:var(--red-ui-text-color-error);margin-left:2px}.editor-wrapper[data-v-5c00c59b]{position:relative}.expand-button[data-v-5c00c59b]{position:absolute;top:-23px;right:0;z-index:10;transition:color .3s ease;cursor:p ...

Source & flagged code

5 flagged · loading source

vite/index.jsView file

277// src/tools/vite/node-red-launcher/entry-point.ts L278: import { exec } from "node:child_process"; L279: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

vite/index.jsView on unpkg · L277

95Cross-file remote execution chain: vite/index.js spawns lib/server/resources/nrg.0682c337.js; helper contains network access plus dynamic code execution. L95: function getPackageName() { L96: const pkgPath = path.resolve("./package.json"); L97: if (fs.existsSync(pkgPath)) { L98: try { L99: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L100: return pkg.name; ... L277: // src/tools/vite/node-red-launcher/entry-point.ts L278: import { exec } from "node:child_process"; L279: import { randomUUID } from "node:crypto"; ... L288: try { L289: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L290: const pkgJsonPath = require_.resolve("node-red/package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L95

288try { L289: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L290: const pkgJsonPath = require_.resolve("node-red/package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vite/index.jsView on unpkg · L288

95function getPackageName() { L96: const pkgPath = path.resolve("./package.json"); L97: if (fs.existsSync(pkgPath)) { L98: try { L99: const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); L100: return pkg.name; ... L277: // src/tools/vite/node-red-launcher/entry-point.ts L278: import { exec } from "node:child_process"; L279: import { randomUUID } from "node:crypto"; ... L288: try { L289: const require_ = createRequire(path2.join(process.cwd(), "package.json")); L290: const pkgJsonPath = require_.resolve("node-red/package.json");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L95

lib/server/resources/nrg.0682c337.jsView file

5|| (${I} === "string" && ${_} && ${_} == +${_} && !(${_} % 1))`).assign(q,(0,n._)`+${_}`);return;case"boolean":g.elseIf((0,n._)`${_} === "false" || ${_} === 0 || ${_} === null`).as... L6: || ${I} === "boolean" || ${_} === null`).assign(q,(0,n._)`[${_}]`)}}}function b({gen:a,parentData:i,parentDataProperty:w},g){a.if((0,n._)`${i} !== undefined`,()=>a.assign((0,n._)`$... L7: missingProperty: ${x},

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/server/resources/nrg.0682c337.jsView on unpkg · L5

Findings

3 High4 Medium5 Low

HighChild Processvite/index.js

HighShell

HighCross File Remote Execution Contextvite/index.js

MediumDynamic Requirevite/index.js

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowEvallib/server/resources/nrg.0682c337.js

LowWeak Cryptovite/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

vite/index.jsView file

Lines 75-115javascript

75 }

76 const stat = fs.statSync(srcPath);

77 if (stat.isDirectory()) {

78 fs.cpSync(srcPath, destPath, { recursive: true });

79 } else {

80 fs.mkdirSync(path.dirname(destPath), { recursive: true });

81 fs.copyFileSync(srcPath, destPath);

82 }

83 }

84}

85var RESOURCE_PIPELINE_FOLDERS = /* @__PURE__ */ new Set(["icons", "locales"]);

86function discoverResourceCopyTargets(resourcesDir) {

87 if (!fs.existsSync(resourcesDir)) return [];

88 return fs.readdirSync(resourcesDir, { withFileTypes: true }).filter(

89 (entry) => entry.isDirectory() && !RESOURCE_PIPELINE_FOLDERS.has(entry.name)

90 ).map((entry) => ({

91 src: path.join(resourcesDir, entry.name),

92 dest: entry.name

93 }));

94}

95function getPackageName() {

96 const pkgPath = path.resolve("./package.json");

97 if (fs.existsSync(pkgPath)) {

98 try {

99 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));

100 return pkg.name;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vite/index.jsView on unpkg · L95

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vite/index.jsView on unpkg · L95

101 } catch {

102 return "node-red-nodes";

103 }

104 }

105 return "node-red-nodes";

106}

107function mergeOptions(defaults, overrides) {

108 if (!overrides) return { ...defaults };

109 const result = { ...defaults };

110 for (const key of Object.keys(overrides)) {

111 const overrideVal = overrides[key];

112 const defaultVal = defaults[key];

113 if (overrideVal !== void 0 && Array.isArray(overrideVal) && Array.isArray(defaultVal)) {

114 result[key] = [.../* @__PURE__ */ new Set([...defaultVal, ...overrideVal])];

Lines 257-308javascript

257 endGroup(message) {

258 console.log(`\u2502`);

259 console.log(`\u2514\u2500 ${message ?? "Done"}`);

260 console.log();

261 }

262 startSpinner(message) {

263 this.spinner.start

lib/server/resources/nrg.0682c337.jsView file

Lines 1-25javascript