registry / @cmmd-center/forge / 0.9.3

@cmmd-center/forge@0.9.3

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 3.61 MB of source, external domains: api.example.com, github.com, jsonplaceholder.typicode.com

Oversized source lightweight scan

dist/bin.cjs11.2 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

dist/bin.mjs10.9 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStrings

Source & flagged code

9 flagged

dist/HttpServer-ByyNdEXm.mjsView file

Lines 4104-4144javascript

4104/**

4105* @since 4.0.0

4106* @category Tracer

4107*/

4108const tracer = /* @__PURE__ */ make$2((httpApp) => withFiber((fiber) => {

4109 const request = getUnsafe$1(fiber.context, HttpServerRequest);

4110 if (!fiber.getRef(TracerEnabled) || fiber.getRef(TracerDisabledWhen)(request)) return httpApp;

4111 const span = makeSpanUnsafe(fiber, fiber.getRef(SpanNameGenerator)(request), {

4112 parent: getOrUndefined(fromHeaders(request.headers)),

4113 kind: "server"

4114 });

4115 const prevServices = fiber.context;

4116 fiber.setContext(add(fiber.context, ParentSpan, span));

4117 return onExitPrimitive(httpApp, (exit) => {

4118 fiber.setContext(prevServices);

4119 const endTime = fiber.getRef(Clock).currentTimeNanosUnsafe();

4120 fiber.currentDispatcher.scheduleTask(() => {

4121 const url = toURL(request);

4122 if (isSome(url) && (url.value.username !== "" || url.value.password !== "")) {

4123 url.value.username = "REDACTED";

4124 url.value.password = "REDACTED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/HttpServer-ByyNdEXm.mjsView on unpkg · L4124

4125 }

4126 const redactedHeaderNames = fiber.getRef(CurrentRedactedNames);

4127 const requestHeaders = redact(request.headers, redactedHeaderNames);

4128 span.attribute("http.request.method", request.method);

4129 if (isSome(url)) {

4130 span.attribute("url.full", url.value.toString());

4131 span.attribute("url.path", url.value.pathname);

4132 if (url.value.search.slice(1) !== "") span.attribute("url.query", url.value.search.slice(1));

4133 span.attribute("url.scheme", url.value.protocol.slice(0, -1));

4134 }

4135 if (request.headers["user-agent"] !== void 0) span.attribute("user_agent.original", request.headers["user-agent"]);

4136 for (const name in requestHeaders) span.attribute(`http.request.header.${name}`, String(requestHeaders[name]));

4137 if (isSome(request.remoteAddress)) span.attribute("client.address", request.remoteAddress.value);

4138 const response = exitResponse(exit);

4139 span.attribute("http.response.status_code", response.status);

4140 const responseHeaders = redact(response.headers, redactedHeaderNames);

4141 for (const name in responseHeaders) span.attribute(`http.response.header.${name}`, String(responseHeaders[name]));

4142 span.end(endTime, exit);

4143 }, 0);

4144 }, true);

dist/execAsync-jnYVB5RZ.cjsView file

Lines 1-18javascript

1#!/usr/bin/env node

3//#region ../../node_modules/.bun/@opentelemetry+resources@2.10.0+e40b0dfdd726a224/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js

4var require_execAsync = /* @__PURE__ */ require("./chunk-BhaIgcZK.cjs").__commonJSMin(((exports) => {

5 Object.defineProperty

dist/open-Cf0bgbyx.mjsView file

Lines 43-83javascript

43};

44function isInsideContainer() {

45 if (cachedResult === void 0) cachedResult = hasContainerEnv() || isDocker();

46 return

dist/Mime-aSilaQX9.cjsView file

Lines 1-41javascript

1#!/usr/bin/env node

3const require_chunk = require("./chunk-BhaIgcZK.cjs");

4//#region ../../node_modules/.bun/ws@8.21.2/node_modules/ws/lib/constants.js

5var require_constants = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,

dist/NodeTerminal-_XekCzf-.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { $c as none, Ac as Service, Ba as _await, Da as addFinalizer, Dn as asVoid, Ei as void_, Fl as isNotUndefined, Gc as fromUndefinedOr, Hc as flatMap$1, Il as isNullish, Ir as orDie, Ja as

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 11393574 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 11393574 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/HttpServer-aJkhz6yu.cjsView file

Lines 4114-4154javascript

4114* @since 4.0.0

4115* @category Tracer

4116*/

4117const tracer = /* @__PURE__ */ make$2((httpApp) => require_Schema.withFiber

Source & flagged code

9 flagged · loading source

dist/HttpServer-ByyNdEXm.mjsView file

4124patternName = generic_password severity = medium line = 4124 matchedText = url.valu...ED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/HttpServer-ByyNdEXm.mjsView on unpkg · L4124

dist/execAsync-jnYVB5RZ.cjsView file

6exports.execAsync = void 0; L7: const child_process = require("child_process"); L8: exports.execAsync = require("util").promisify(child_process.exec);

High

Child Process

Package source references child process execution.

dist/execAsync-jnYVB5RZ.cjsView on unpkg · L6

dist/open-Cf0bgbyx.mjsView file

63//#endregion L64: //#region ../../node_modules/.bun/powershell-utils@0.1.0/node_modules/powershell-utils/index.js L65: const execFile$3 = promisify(childProcess.execFile);

Findings

4 High7 Medium6 Low

HighChild Processdist/execAsync-jnYVB5RZ.cjs

HighShelldist/open-Cf0bgbyx.mjs

HighCross File Remote Execution Contextdist/NodeTerminal-_XekCzf-.mjs

HighSemantic Analysis Limiteddist/open-Cf0bgbyx.mjs

MediumSecret Patterndist/HttpServer-ByyNdEXm.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/bin.mjs

MediumOversized Cli Entrypointdist/bin.mjs

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/HttpServer-aJkhz6yu.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Crypto

Affected versions and remediation

This report applies to @cmmd-center/forge@0.9.3.

See all versions of @cmmd-center/forge for other recorded verdicts.

Review the evidence and your use of @cmmd-center/forge@0.9.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 21:56:48.064Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.