registry / @codeseedelearning/mool / 0.0.4

@codeseedelearning/mool@0.0.4

CLI for the Mool framework — scaffold and run Mool projects.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 33 file(s), 30.2 KB of source

Source & flagged code

3 flagged

src/templates/basic/routes/web.tsView file

Lines 17-81typescript

18Route.get("/health", () => "OK");

20Event.listen("user.registered", (payload) => {

21 console.log("New user registered:", payload);

22});

24Route.get("/users", async () => {

25 const users = await User.all();

27 return users.map((user) => {

28 const { password, ...safeUser } = user;

29 return safeUser;

30 });

31});

33Route.post("/users", async (request) => {

34 const { valid, errors } = validate(request.body, {

35 name: "required|string|min:2",

36 email: "required|email",

37 password: "required|string|min:6",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/templates/basic/routes/web.tsView on unpkg · L37

38 });

40 if (!valid) {

41 return { success: false, errors };

42 }

44 const user = await User.create({

45 name: request.body.name,

46 email: request.body.email,

47 password: hashPassword(String(request.body.password)),

48 created_at: new Date().toISOString(),

49 });

51 Event.dispatch("user.registered", { id: user.id, email: user.email });

53 const { password, ...safeUser } = user;

55 return { success: true, user: safeUser };

56});

58Route.post("/login", async (request) => {

59 const { valid, errors } = validate(request.body, {

60 email: "required|email",

61 password: "required|string",

Medium

Secret Pattern

Hardcoded password in src/templates/basic/routes/web.ts

src/templates/basic/routes/web.tsView on unpkg · L61

62 });

64 if (!valid) {

65 return { success: false, errors };

66 }

68 const [user] = await User.where("email", request.body.email);

70 if (!user || !verifyPassword(String(request.body.password), String(user.password))) {

71 return { success: false, message: "Invalid credentials" };

72 }

74 const token = createToken({ id: user.id, email: user.email });

76 return { success: true, token };

77});

79// AuthMiddleware verifies the Bearer token, attaches the decoded payload to

80// request.state.user, and 401s (a real HTTP 401, via HttpResponse) before

81// the handler ever runs if the token is missing/invalid/expired.

src/commands/dev-command.tsView file

Lines 2-42typescript

2import { pathToFileURL } from "node:url";

3import { promises as fs } from "node:fs";

5import { Command } from "../types/command.js";

6import type { Application } from "@codeseedelearning/mool-core";

Source & flagged code

3 flagged · loading source

src/templates/basic/routes/web.tsView file

37patternName = generic_password severity = medium line = 37 matchedText = password...:6",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/templates/basic/routes/web.tsView on unpkg · L37

61patternName = generic_password severity = medium line = 61 matchedText = password...ng",

Medium

Secret Pattern

Hardcoded password in src/templates/basic/routes/web.ts

src/templates/basic/routes/web.tsView on unpkg · L61

src/commands/dev-command.tsView file

22L23: const module = await import(pathToFileURL(bootstrapPath).href); L24: const app: Application = module.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/commands/dev-command.tsView on unpkg · L22

Findings

4 Medium2 Low

MediumSecret Patternsrc/templates/basic/routes/web.ts

MediumDynamic Requiresrc/commands/dev-command.ts

MediumEnvironment Vars

MediumSecret Patternsrc/templates/basic/routes/web.ts

LowFilesystem

LowNo License

Source & flagged code

3 flagged

src/templates/basic/routes/web.tsView file

Lines 17-81typescript

18Route.get("/health", () => "OK");

20Event.listen("user.registered", (payload) => {

21 console.log("New user registered:", payload);

22});

24Route.get("/users", async () => {

25 const users = await User.all();

27 return users.map((user) => {

28 const { password, ...safeUser } = user;

29 return safeUser;

30 });

31});

33Route.post("/users", async (request) => {

34 const { valid, errors } = validate(request.body, {

35 name: "required|string|min:2",

36 email: "required|email",

37 password: "required|string|min:6",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/templates/basic/routes/web.tsView on unpkg · L37

38 });

40 if (!valid) {

41 return { success: false, errors };

42 }

44 const user = await User.create({

45 name: request.body.name,

46 email: request.body.email,

47 password: hashPassword(String(request.body.password)),

48 created_at: new Date().toISOString(),

49 });

51 Event.dispatch("user.registered", { id: user.id, email: user.email });

53 const { password, ...safeUser } = user;

55 return { success: true, user: safeUser };

56});

58Route.post("/login", async (request) => {

59 const { valid, errors } = validate(request.body, {

60 email: "required|email",

61 password: "required|string",

Medium

Secret Pattern

Hardcoded password in src/templates/basic/routes/web.ts

src/templates/basic/routes/web.tsView on unpkg · L61

62 });

64 if (!valid) {

65 return { success: false, errors };

66 }

68 const [user] = await User.where("email", request.body.email);

70 if (!user || !verifyPassword(String(request.body.password), String(user.password))) {

71 return { success: false, message: "Invalid credentials" };

72 }

74 const token = createToken({ id: user.id, email: user.email });

76 return { success: true, token };

77});

79// AuthMiddleware verifies the Bearer token, attaches the decoded payload to

80// request.state.user, and 401s (a real HTTP 401, via HttpResponse) before

81// the handler ever runs if the token is missing/invalid/expired.

src/commands/dev-command.tsView file

Lines 2-42typescript

2import { pathToFileURL } from "node:url";

3import { promises as fs } from "node:fs";

5import { Command } from "../types/command.js";

6import type { Application } from "@codeseedelearning/mool-core";