registry / @cosmicdrift/kumiko-dev-server / 0.119.0

@cosmicdrift/kumiko-dev-server@0.119.0

Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 347 KB of source, external domains: 0.0.0.0, biomejs.dev, docs.kumiko.rocks

Source & flagged code

14 flagged

src/scaffold-app.tsView file

Lines 452-492typescript

452 sf.addVariableStatement({

453 declarationKind: VariableDeclarationKind.Const,

454 declarations: [

455 {

456 name: "envSchema",

457 initializer: "composeEnvSchema({ core: frameworkCoreEnvSchema, features: bootFeatures })",

458 },

459 ],

460 });

461

462 sf.addStatements((writer) => {

463 writer

464 .write("await runProdApp(")

465 .inlineBlock(() => {

466 writer.writeLine("features: APP_FEATURES,");

467 writer.writeLine("envSchema,");

468 writer.writeLine('staticDir: "./dist",');

469 writer.write("auth: ").inlineBlock(() => {

470 writer.write("admin: ").inlineBlock(() => {

471 writer.writeLine(`email: "admin@${appName}.local",`);

472 writer.writeLine(`password: "change-me-on-first-deploy",`);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/scaffold-app.tsView on unpkg · L472

473 writer.writeLine(`displayName: "Admin",`);

474 writer.write("memberships: [");

475 writer.indent(() => {

476 writer.inlineBlock(() => {

477 writer.writeLine("tenantId: DEFAULT_TENANT_ID,");

478 writer.writeLine(`tenantKey: "${appName}",`);

479 writer.writeLine(`tenantName: "${appName}",`);

480 writer.writeLine(`roles: ["TenantAdmin"],`);

481 });

482 writer.write(",");

483 });

484 writer.write("],");

485 });

486 });

487 })

488 .write(");");

489 });

490

491 sf.insertText(

492 0,

551patternName = generic_password severity = medium line = 551 matchedText = writer.w...,`);

Medium

Secret Pattern

Hardcoded password in src/scaffold-app.ts

src/scaffold-app.tsView on unpkg · L551

bin/kumiko-schema-check.tsView file

Lines 47-87typescript

47 i++;

48 }

49 }

50 return { runConfigPath, generatePath: generatePath ?? resolveGeneratePath(cwd) };

51}

53function readRegistryFeatures(generateSrc: string): Set<string

src/__tests__/resolve-auth-mail.test.tsView file

Lines 1-31typescript

1import { describe, expect, test } from "bun:test";

2import { type RunProdAppAuthOptions, resolveAuthMail } from "../run-prod-app";

4// Pins the auth.mail convenience (resolveAuthMail): one mail block expands

5// into the four explicit flow setups built from DEFAULT_AUTH_PATHS, the

6// null-transport guard (no SMTP_HOST → flows stay unwired), and explicit

7// per-flow setups winning over the mail default.

src/__tests__/scaffold-app.test.tsView file

Lines 86-126typescript

86 const dest = join(tmp, "my-shop");

87 await scaffoldApp({ name: "my-shop", destination: dest });

89 const schema = readFileSync(join(dest, "kumiko/schema.ts"), "utf-8");

src/__tests__/run-prod-app.integration.test.tsView file

Lines 765-805typescript

765 } finally {

766 await close();

767 }

768 });

769

770 test("eventDispatcher.disabled: kein lokaler Dispatcher gebaut", async () => {

771 const handle =

src/__tests__/run-dev-app.integration.test.tsView file

Lines 12-52typescript

12} from "@cosmicdrift/kumiko-bundled-features/text-content";

13import {

14 createEntity,

15 createTextField,

16 defineFeature,

17 defineQueryHandler,

18} from "@cosmicdrift/kumiko-framework/engine";

19import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";

src/__tests__/welcome-banner.test.tsView file

Lines 1-28typescript

1import { describe, expect, test } from "bun:test";

2import { renderWelcomeBanner } from "../welcome-banner";

4describe("renderWelcomeBanner", () => {

5 test("includes URL + admin login + features dir + docs link", () => {

6 const

src/__tests__/compose-features-wiring.integration.test.tsView file

Lines 178-218typescript

178 beforeAll(async () => {

179 suite = await bootStack("with-both");

180 });

181

182 afterAll(async () => {

183 await suite.stack.

Source & flagged code

14 flagged · loading source

src/scaffold-app.tsView file

472patternName = generic_password severity = medium line = 472 matchedText = writer.w...,`);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/scaffold-app.tsView on unpkg · L472

551patternName = generic_password severity = medium line = 551 matchedText = writer.w...,`);

Medium

Secret Pattern

Hardcoded password in src/scaffold-app.ts

src/scaffold-app.tsView on unpkg · L551

bin/kumiko-schema-check.tsView file

67async function readMountedFeatures(runConfigPath: string): Promise<Set<string>> { L68: const mod = (await import(runConfigPath)) as { L69: APP_FEATURES?: ReadonlyArray<{ name: string }>;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kumiko-schema-check.tsView on unpkg · L67

src/__tests__/resolve-auth-mail.test.tsView file

11patternName = generic_password severity = medium line = 11 matchedText = password...gh",

Medium

Secret Pattern

Hardcoded password in src/__tests__/resolve-auth-mail.test.ts

src/__tests__/resolve-auth-mail.test.tsView on unpkg · L11

src/__tests__/scaffold-app.test.tsView file

106patternName = generic_password severity = medium line = 106 matchedText = expect(d..."`);

Medium

Secret Pattern

Hardcoded password in src/__tests__/scaffold-app.test.ts

src/__tests__/scaffold-app.test.tsView on unpkg · L106

src/__tests__/run-prod-app.integration.test.tsView file

785patternName = generic_password severity = medium line = 785 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/__tests__/run-prod-app.integration.test.ts

src/__tests__/run-prod-app.integration.test.tsView on unpkg · L785

src/__tests__/run-dev-app.integration.test.tsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/__tests__/run-dev-app.integration.test.ts

src/__tests__/run-dev-app.integration.test.tsView on unpkg · L32

src/__tests__/welcome-banner.test.tsView file

8patternName = generic_password severity = medium line = 8 matchedText = admin: {..." },

Medium

Secret Pattern

Hardcoded password in src/__tests__/welcome-banner.test.ts

src/__tests__/welcome-banner.test.tsView on unpkg · L8

src/__tests__/compose-features-wiring.integration.test.tsView file

198patternName = generic_password severity = medium line = 198 matchedText = await se... });

Medium

Secret Pattern