registry / @cosmicdrift/kumiko-dev-server / 0.147.2

@cosmicdrift/kumiko-dev-server@0.147.2

Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 34 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 370 KB of source, external domains: 0.0.0.0, biomejs.dev, docs.kumiko.rocks

Source & flagged code

29 flagged

src/scaffold-app.tsView file

Lines 454-494typescript

454 sf.addVariableStatement({

455 declarationKind: VariableDeclarationKind.Const,

456 declarations: [

457 {

458 name: "envSchema",

459 initializer: "composeEnvSchema({ core: frameworkCoreEnvSchema, features: bootFeatures })",

460 },

461 ],

462 });

463

464 sf.addStatements((writer) => {

465 writer

466 .write("await runProdApp(")

467 .inlineBlock(() => {

468 writer.writeLine("features: APP_FEATURES,");

469 writer.writeLine("envSchema,");

470 writer.writeLine('staticDir: "./dist",');

471 writer.write("auth: ").inlineBlock(() => {

472 writer.write("admin: ").inlineBlock(() => {

473 writer.writeLine(`email: "admin@${appName}.local",`);

474 writer.writeLine(`password: "change-me-on-first-deploy",`);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/scaffold-app.tsView on unpkg · L474

475 writer.writeLine(`displayName: "Admin",`);

476 writer.write("memberships: [");

477 writer.indent(() => {

478 writer.inlineBlock(() => {

479 writer.writeLine("tenantId: DEFAULT_TENANT_ID,");

480 writer.writeLine(`tenantKey: "${appName}",`);

481 writer.writeLine(`tenantName: "${appName}",`);

482 writer.writeLine(`roles: ["TenantAdmin"],`);

483 });

484 writer.write(",");

485 });

486 writer.write("],");

487 });

488 });

489 })

490 .write(");");

491 });

492

493 sf.insertText(

494 0,

553patternName = generic_password severity = medium line = 553 matchedText = writer.w...,`);

Medium

Secret Pattern

Hardcoded password in src/scaffold-app.ts

src/scaffold-app.tsView on unpkg · L553

bin/kumiko-schema-check.tsView file

Lines 47-87typescript

47 i++;

48 }

49 }

50 return { runConfigPath, generatePath: generatePath ?? resolveGeneratePath(cwd) };

51}

53function readRegistryFeatures(generateSrc: string): Set<string

src/create-kumiko-server.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cosmicdrift/kumiko-dev-server@0.146.4 matchedIdentity = npm:[redacted]:0.146.4 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/create-kumiko-server.tsView on unpkg

src/__tests__/compose-features-mfa-wiring.integration.test.tsView file

Lines 105-249typescript

105

106describe("composeFeatures wiring — auth-mfa (kumiko-framework#266 Step 6)", () => {

107 let stack: TestStack;

108

109 beforeAll(async () => {

110 stack = await bootStack

src/__tests__/resolve-auth-mail.test.tsView file

11patternName = generic_password severity = medium line = 11 matchedText = password...gh",

Medium

Secret Pattern

Hardcoded password in src/__tests__/resolve-auth-mail.test.ts

src/__tests__/resolve-auth-mail.test.tsView on unpkg · L11

src/__tests__/scaffold-app.test.tsView file

106patternName = generic_password severity = medium line = 106 matchedText = expect(d..."`);

Medium

Secret Pattern

Hardcoded password in src/__tests__/scaffold-app.test.ts

src/__tests__/scaffold-app.test.tsView on unpkg · L106

src/__tests__/run-prod-app.integration.test.tsView file

785patternName = generic_password severity = medium line = 785 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/__tests__/run-prod-app.integration.test.ts

src/__tests__/run-prod-app.integration.test.tsView on unpkg · L785

src/__tests__/run-dev-app.integration.test.tsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/__tests__/run-dev-app.integration.test.ts

src/__tests__/run-dev-app.integration.test.tsView on unpkg · L32

src/__tests__/welcome-banner.test.tsView file

8patternName = generic_password severity = medium line = 8 matchedText = admin: {..." },

Medium

Secret Pattern

Hardcoded password in src/__tests__/welcome-banner.test.ts

src/__tests__/welcome-banner.test.tsView on unpkg · L8

src/__tests__/compose-features-wiring.integration.test.tsView file

198patternName = generic_password severity = medium line = 198 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/__tests__/compose-features-wiring.integration.test.ts

src/__tests__/compose-features-wiring.integration.test.tsView on unpkg · L198

230patternName = generic_password severity = medium line = 230 matchedText = password...76",

Medium

Secret Pattern

Hardcoded password in src/__tests__/compose-features-wiring.integration.test.ts

src/__tests__/compose-features-wiring.integration.test.tsView on unpkg · L230

236patternName = generic_password severity = medium line = 236 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/__tests__/compose-features-wiring.integration.test.ts

src/__tests__/compose-features-wiring.integration.test.tsView on unpkg · L236

Source & flagged code

29 flagged · loading source

src/scaffold-app.tsView file

474patternName = generic_password severity = medium line = 474 matchedText = writer.w...,`);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/scaffold-app.tsView on unpkg · L474

553patternName = generic_password severity = medium line = 553 matchedText = writer.w...,`);

Medium

Secret Pattern

Hardcoded password in src/scaffold-app.ts

src/scaffold-app.tsView on unpkg · L553

bin/kumiko-schema-check.tsView file

67async function readMountedFeatures(runConfigPath: string): Promise<Set<string>> { L68: const mod = (await import(runConfigPath)) as { L69: APP_FEATURES?: ReadonlyArray<{ name: string }>;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kumiko-schema-check.tsView on unpkg · L67

src/create-kumiko-server.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/create-kumiko-server.tsView on unpkg

src/__tests__/compose-features-mfa-wiring.integration.test.tsView file

125patternName = generic_password severity = medium line = 125 matchedText = password...34",

Medium

Secret Pattern