registry / @futdevpro/nts-dynamo / 1.15.88

@futdevpro/nts-dynamo@1.15.88

Dynamic NodeTS (NodeJS-Typescript), MongoDB Backend System Framework by Future Development Program Ltd.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 625 file(s), 3.45 MB of source, external domains: api.example.com, app.clickup.com, attacker.com, discord.com, evil.com, example.com, oauth2.example.com, organizer.futdevpro.hu, test.example.com, test.organizer.futdevpro.hu

Source & flagged code

5 flagged

scripts/run-coverage-tests.jsView file

Lines 1-29javascript

1const { execSync } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

scripts/run-coverage-tests.jsView on unpkg · L1

4const configPath = path.join(__dirname, '../spec/support/jasmine.coverage.json');

5const tsNodeRegister = require.resolve('ts-node/register/transpile-only');

6const tsNodeHelper = path.join(__dirname, '../spec/support/helpers/ts-node-helper.js');

7const specReporterLoader = path.join(__dirname, '../spec/support/helpers/spec-reporter-loader.js');

9const env = {

10 ...process.env,

11 // Egyedi spec reporter kikommentezve - aktiválni: kommentezd ki az alábbi sort és kommentezd be a specReporterLoader-t tartalmazó sort

12 NODE_OPTIONS: `--require ${tsNodeRegister} --require ${tsNodeHelper}`

13 // NODE_OPTIONS: `--require ${tsNodeRegister} --require ${tsNodeHelper} --require ${specReporterLoader}`

14};

16try {

17 execSync(`npx jasmine --config="${configPath}"`, {

18 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-coverage-tests.jsView on unpkg · L16

19 cwd: path.join(__dirname, '..'),

20 shell: true,

21 env: env

22 });

23} catch (error) {

24 // Exit with the same status code as jasmine (3 = test failures, 1 = other errors)

25 // This allows c8 to still generate coverage reports even if tests fail

26 process.exit(error.status || 1);

27}

BuildPackage.batView file

•path = BuildPackage.bat kind = build_helper sizeBytes = 20 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

BuildPackage.batView on unpkg

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView file

Lines 278-318typescript

278 client_secret: 'secret-123',

279 };

280 mockResponse.json = jasmine.createSpy('json');

281

282 await service.handleTokenRequest(mockRequest as Request, mockResponse as Response);

283

Source & flagged code

5 flagged · loading source

scripts/run-coverage-tests.jsView file

1const { execSync } = require('child_process'); L2: const path = require('path');

High

Child Process

Package source references child process execution.

scripts/run-coverage-tests.jsView on unpkg · L1

16try { L17: execSync(`npx jasmine --config="${configPath}"`, { L18: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-coverage-tests.jsView on unpkg · L16

BuildPackage.batView file

•path = BuildPackage.bat kind = build_helper sizeBytes = 20 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

BuildPackage.batView on unpkg

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView file

298patternName = generic_password severity = medium line = 298 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in src/_modules/oauth2/_services/oauth2.control-service.spec.ts

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView on unpkg · L298

404patternName = generic_password severity = medium line = 404 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/_modules/oauth2/_services/oauth2.control-service.spec.ts

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView on unpkg · L404

Findings

2 High6 Medium5 Low

HighChild Processscripts/run-coverage-tests.js

HighRuntime Package Installscripts/run-coverage-tests.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperBuildPackage.bat

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/_modules/oauth2/_services/oauth2.control-service.spec.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

scripts/run-coverage-tests.jsView file

Lines 1-29javascript

1const { execSync } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

scripts/run-coverage-tests.jsView on unpkg · L1

4const configPath = path.join(__dirname, '../spec/support/jasmine.coverage.json');

5const tsNodeRegister = require.resolve('ts-node/register/transpile-only');

6const tsNodeHelper = path.join(__dirname, '../spec/support/helpers/ts-node-helper.js');

7const specReporterLoader = path.join(__dirname, '../spec/support/helpers/spec-reporter-loader.js');

9const env = {

10 ...process.env,

11 // Egyedi spec reporter kikommentezve - aktiválni: kommentezd ki az alábbi sort és kommentezd be a specReporterLoader-t tartalmazó sort

12 NODE_OPTIONS: `--require ${tsNodeRegister} --require ${tsNodeHelper}`

13 // NODE_OPTIONS: `--require ${tsNodeRegister} --require ${tsNodeHelper} --require ${specReporterLoader}`

14};

16try {

17 execSync(`npx jasmine --config="${configPath}"`, {

18 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-coverage-tests.jsView on unpkg · L16

19 cwd: path.join(__dirname, '..'),

20 shell: true,

21 env: env

22 });

23} catch (error) {

24 // Exit with the same status code as jasmine (3 = test failures, 1 = other errors)

25 // This allows c8 to still generate coverage reports even if tests fail

26 process.exit(error.status || 1);

27}

BuildPackage.batView file

•path = BuildPackage.bat kind = build_helper sizeBytes = 20 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

BuildPackage.batView on unpkg

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView file

Lines 278-318typescript

278 client_secret: 'secret-123',

279 };

280 mockResponse.json = jasmine.createSpy('json');

281

282 await service.handleTokenRequest(mockRequest as Request, mockResponse as Response);

283

Lines 384-424typescript

384

385 it('| should throw error when username or password is missing', async () => {

386 mockRequest.body = {

387 grant_type: 'password',

388 client_id: 'client-123',

389 client_secret: 'secret-123',

390 // Missing username and password

391 };

392

393 await expectAsync(

394 service.handleTokenRequest(mockRequest as Request, mockResponse as Response)

395 ).toBeRejected();

396 });

397

398 it('| should throw error when user credentials are invalid', async () => {

399 mockRequest.body = {

400 grant_type: 'password',

401 client_id: 'client-123',

402 client_secret: 'secret-123',

403 username: 'user-123',

404 password: 'wrong-password',

Medium

Secret Pattern

Hardcoded password in src/_modules/oauth2/_services/oauth2.control-service.spec.ts

src/_modules/oauth2/_services/oauth2.control-service.spec.tsView on unpkg · L404

405 };

406

407 await expectAsync(

408 service.handleTokenRequest(mockRequest as Request, mockResponse as Response)

409 ).toBeRejected();

410 });

411

412 it('| should throw error when grant_type is unsupported', async () => {

413 mockRequest.body = {

414 grant_type: 'unsupported',

415 client_id: 'client-123',

416 client_secret: 'secret-123',

417 };

418

419 await expectAsync(

420 service.handleTokenRequest(mockRequest as Request, mockResponse as Response)

421 ).toBeRejected();

422 });

423 });

424