registry / @gadmin2n/schematics / 0.0.131

@gadmin2n/schematics@0.0.131

Gadmin - modern, fast, powerful node.js web framework (@schematics)

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 534 file(s), 2.10 MB of source, external domains: 127.0.0.1, accounts.google.com, analytics.example.com, api.com, api.example.com, api.wecom.example.com, dayu.woa.com, dev.example.com, docs.example.com, example.com, github.com, oit-erp-gtdr.woa.com, oit-erp.woa.com, rhrc.woa.com, servicenow.example.com, wiki.example.com, www.w3.org

Source & flagged code

7 flagged

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

Lines 356-383typescript

356 if (!pattern) return false;

357 if (pattern === actual) return true;

358 if (pattern === "*") return true;

359

360 const [patTable, patOp] = pattern.split(".");

361 const [actTable, actOp] = actual.split(".");

362

363 const tableMatch = patTable === "*" || patTable === actTable;

364 const opMatch = !patOp || patOp === "*" || patOp === actOp;

365

366 return tableMatch && opMatch;

367}

368

369/**

370 * 简单的 filter 表达式求值。

371 */

372function evaluateFilter(

373 expression: string,

374 payload: Record<string, any>,

375): boolean {

376 try {

377 const fn = new Function("data", `return ${expression}`);

378 return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

379 } catch {

380 return true;

381 }

382}

383

dist/index.jsView file

Lines 1-21javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

Lines 1-21typescript

1export interface CodeExecuteInput {

2 script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

3 mode?: 'runOnceForAll' | 'runOnceForEach'

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

Lines 1-27typescript

1const crypto = require('crypto');

2const CryptoJS = require('crypto-js');

4export function md5(text: string) {

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gadmin2n/schematics@0.0.130 matchedIdentity = npm:QGdhZG1pbjJuL3NjaGVtYXRpY3M:0.0.130 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

376try { L377: const fn = new Function("data", `return ${expression}`); L378: return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

dist/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./utils"), exports); L18: __exportStar(require("./utils/dependencies.utils"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

1export interface CodeExecuteInput { L2: script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

7L8: // https://segmentfault.com/a/1190000039192480 L9: /** ... L12: * @param secretKey {string} 密钥，43位随机大小写与数字 L13: * @returns {string} 加密后的密文，Base64格式 L14: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg

Findings

1 Critical1 High6 Medium7 Low

CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env

HighPrevious Version Dangerous Deltadist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.js

MediumDynamic Requiredist/index.js

MediumUnsafe Vm Contextdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.ts

LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

Lines 356-383typescript

356 if (!pattern) return false;

357 if (pattern === actual) return true;

358 if (pattern === "*") return true;

359

360 const [patTable, patOp] = pattern.split(".");

361 const [actTable, actOp] = actual.split(".");

362

363 const tableMatch = patTable === "*" || patTable === actTable;

364 const opMatch = !patOp || patOp === "*" || patOp === actOp;

365

366 return tableMatch && opMatch;

367}

368

369/**

370 * 简单的 filter 表达式求值。

371 */

372function evaluateFilter(

373 expression: string,

374 payload: Record<string, any>,

375): boolean {

376 try {

377 const fn = new Function("data", `return ${expression}`);

378 return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

379 } catch {

380 return true;

381 }

382}

383

dist/index.jsView file

Lines 1-21javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

Lines 1-21typescript

1export interface CodeExecuteInput {

2 script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

3 mode?: 'runOnceForAll' | 'runOnceForEach'

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

Lines 1-27typescript

1const crypto = require('crypto');

2const CryptoJS = require('crypto-js');

4export function md5(text: string) {

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg