registry / @djangocfg/nextjs / 2.1.463

@djangocfg/nextjs@2.1.463

⚠ Under review

Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 334 KB of source, external domains: api.stripe.com, checkout.stripe.com, djangocfg.com, github.com, js.stripe.com, mcp.djangocfg.com, registry.npmjs.org, www.sitemaps.org

Source & flagged code

5 flagged

dist/config/index.mjsView file

Lines 458-498javascript

458// src/ai/constants.ts

459var MCP_BASE_URL = "https://mcp.djangocfg.com";

460var MCP_SERVER_URL = `${MCP_BASE_URL}/mcp`;

461var MCP_API_URL = `${MCP_BASE_URL}/api/search`;

462var AI_DOCS_HINT = `\u{1F916} AI Docs: ${MCP_SERVER_URL} | pnpm ai-docs search "query"`;

463var AI_HINT = `

464DjangoCFG Documentation is available via MCP server.

465

466To get help with DjangoCFG configuration:

4671. Use the MCP server: ${MCP_SERVER_URL}

4682. Or search directly: ${MCP_API_URL}?q=YOUR_QUERY&limit=5

469

470Example queries:

471- "How to configure PostgreSQL database?"

472- "What is DatabaseConfig?"

473- "How to setup Redis cache?"

474- "Email configuration with SMTP"

475`;

476

477// src/config/packages/installer.ts

478import chalk from "chalk";

479import { execSync, spawn } from "child_process";

480import Conf from "conf";

High

Child Process

Package source references child process execution.

dist/config/index.mjsView on unpkg · L478

481import consola2 from "consola";

482import { createInterface } from "readline";

483function createMemoryCache() {

484 const store = /* @__PURE__ */ new Map();

485 return {

486 get(key) {

487 return store.get(String(key));

488 },

489 set(key, value) {

490 store.set(String(key), value);

491 },

492 clear() {

493 store.clear();

494 }

495 };

496}

497function createInstallerCache() {

498 try {

Lines 634-674javascript

634 console.log(` ${chalk.red("\u2717")} ${text2 || currentText}`);

635 }

636 return this;

637 },

638 stop() {

639 if (interval) clearInterval(interval);

•matchType = previous_version_dangerous_delta matchedPackage = @djangocfg/nextjs@2.1.447 matchedIdentity = npm:QGRqYW5nb2NmZy9uZXh0anM:2.1.447 similarity = 0.937 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config/index.mjsView on unpkg

src/config/plugins/devStartup.tsView file

Lines 70-110typescript

70 if (this.options.checkUpdates !== false) {

71 try {

72 await checkAndUpdatePackages({

73 autoUpdate: this.options.autoUpdate,

74 forceCheckWorkspace: this.options.forceCheckWorkspace,

75 force: true, // Force check ignoring cooldown

src/config/packages/updater.tsView file

Lines 317-357typescript

317}

318

319/**

320 * Update a single package with progress

321 */

322async function updateSinglePackage(

323 pkg: PackageVersion,

324 pm: 'pnpm' | 'yarn'

Source & flagged code

5 flagged · loading source

dist/config/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config/index.mjsView on unpkg

478import chalk from "chalk"; L479: import { execSync, spawn } from "child_process"; L480: import Conf from "conf";

High

Child Process

Package source references child process execution.

dist/config/index.mjsView on unpkg · L478

654const proc = spawn(cmd, args, { L655: shell: true, L656: cwd: process.cwd(),

High

Shell

Package source references shell execution.

dist/config/index.mjsView on unpkg · L654

src/config/plugins/devStartup.tsView file

90private checkPWASetup(): void { L91: const fs = require('fs'); L92: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config/plugins/devStartup.tsView on unpkg · L90

src/config/packages/updater.tsView file

337const command = pm === 'pnpm' L338: ? `pnpm add ${pkg.name}@latest` L339: : pm === 'yarn' ... L343: return new Promise((resolve) => { L344: const proc = spawn(command, { L345: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/config/packages/updater.tsView on unpkg · L337

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/config/index.mjs

HighChild Processdist/config/index.mjs

HighShelldist/config/index.mjs

HighRuntime Package Installsrc/config/packages/updater.ts

MediumDynamic Requiresrc/config/plugins/devStartup.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/config/index.mjsView file

Lines 458-498javascript

458// src/ai/constants.ts

459var MCP_BASE_URL = "https://mcp.djangocfg.com";

460var MCP_SERVER_URL = `${MCP_BASE_URL}/mcp`;

461var MCP_API_URL = `${MCP_BASE_URL}/api/search`;

462var AI_DOCS_HINT = `\u{1F916} AI Docs: ${MCP_SERVER_URL} | pnpm ai-docs search "query"`;

463var AI_HINT = `

464DjangoCFG Documentation is available via MCP server.

465

466To get help with DjangoCFG configuration:

4671. Use the MCP server: ${MCP_SERVER_URL}

4682. Or search directly: ${MCP_API_URL}?q=YOUR_QUERY&limit=5

469

470Example queries:

471- "How to configure PostgreSQL database?"

472- "What is DatabaseConfig?"

473- "How to setup Redis cache?"

474- "Email configuration with SMTP"

475`;

476

477// src/config/packages/installer.ts

478import chalk from "chalk";

479import { execSync, spawn } from "child_process";

480import Conf from "conf";

High

Child Process

Package source references child process execution.

dist/config/index.mjsView on unpkg · L478

481import consola2 from "consola";

482import { createInterface } from "readline";

483function createMemoryCache() {

484 const store = /* @__PURE__ */ new Map();

485 return {

486 get(key) {

487 return store.get(String(key));

488 },

489 set(key, value) {

490 store.set(String(key), value);

491 },

492 clear() {

493 store.clear();

494 }

495 };

496}

497function createInstallerCache() {

498 try {

Lines 634-674javascript

634 console.log(` ${chalk.red("\u2717")} ${text2 || currentText}`);

635 }

636 return this;

637 },

638 stop() {

639 if (interval) clearInterval(interval);

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config/index.mjsView on unpkg

src/config/plugins/devStartup.tsView file

Lines 70-110typescript

70 if (this.options.checkUpdates !== false) {

71 try {

72 await checkAndUpdatePackages({

73 autoUpdate: this.options.autoUpdate,

74 forceCheckWorkspace: this.options.forceCheckWorkspace,

75 force: true, // Force check ignoring cooldown

src/config/packages/updater.tsView file

Lines 317-357typescript

317}

318

319/**

320 * Update a single package with progress

321 */

322async function updateSinglePackage(

323 pkg: PackageVersion,

324 pm: 'pnpm' | 'yarn'