registry / @gadmin2n/schematics / 0.0.125

@gadmin2n/schematics@0.0.125

Gadmin - modern, fast, powerful node.js web framework (@schematics)

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Risky primitives are inside generated demo/application template code and are activated only when a user generates and runs that app.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

explicit schematic generation followed by running generated demo/app services

Impact

package-aligned generated app behavior; no install-time compromise or covert exfiltration found

Mechanism

user-invoked project template with local dev helpers and workflow code execution features

Rationale

Static source inspection shows a schematics package that copies/generates a substantial demo app; the scanner hits are package-aligned generated files, local development helpers, or user-configured workflow execution features. There is no install-time execution, covert persistence, credential harvesting, or exfiltration path in the package entrypoints or lifecycle scripts.

Evidence

package.jsondist/index.jsdist/collection.jsondist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh../web/.vite-restart

Network endpoints6

127.0.0.1:${NEST_PORT}/api/health/livelocalhost:3000localhost:8000localhost:8080localhost:7233postgresql://kavenma:kavenma@127.0.0.1:5432/gadmin_demo?schema=public

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.

Evidence for block

Generated template includes VM/new Function execution in dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.ts and outbox-poller.ts.
Generated template ships local compose helper and default demo database URL in dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh and temporal/worker/.env.
notify-dev-servers.js writes ../web/.vite-restart and polls 127.0.0.1 health endpoint when invoked by gadmin2 CLI.

Evidence against

package.json has no install/postinstall/prepare hook; prepublishOnly only scrubs dist .env local files before publishing.
dist/index.js only re-exports schematic utilities and has no import-time network, shell, or filesystem action.
dist/collection.json exposes Angular schematics factories for explicit user-invoked code generation.
Network endpoints observed are local/dev or documented template URLs, not exfiltration infrastructure.
No credential/env/file harvesting or outbound secret upload found in inspected hot files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 530 file(s), 2.09 MB of source, external domains: 127.0.0.1, accounts.google.com, analytics.example.com, api.com, api.example.com, api.wecom.example.com, dayu.woa.com, dev.example.com, docs.example.com, example.com, github.com, oit-erp-gtdr.woa.com, oit-erp.woa.com, rhrc.woa.com, servicenow.example.com, wiki.example.com, www.w3.org

Source & flagged code

7 flagged

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

Lines 356-383typescript

356 if (!pattern) return false;

357 if (pattern === actual) return true;

358 if (pattern === "*") return true;

359

360 const [patTable, patOp] = pattern.split(".");

361 const [actTable, actOp] = actual.split(".");

362

363 const tableMatch = patTable === "*" || patTable === actTable;

364 const opMatch = !patOp || patOp === "*" || patOp === actOp;

365

366 return tableMatch && opMatch;

367}

368

369/**

370 * 简单的 filter 表达式求值。

371 */

372function evaluateFilter(

373 expression: string,

374 payload: Record<string, any>,

375): boolean {

376 try {

377 const fn = new Function("data", `return ${expression}`);

378 return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

379 } catch {

380 return true;

381 }

382}

383

dist/index.jsView file

Lines 1-21javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

Lines 1-21typescript

1export interface CodeExecuteInput {

2 script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

3 mode?: 'runOnceForAll' | 'runOnceForEach'

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

Lines 1-27typescript

1const crypto = require('crypto');

2const CryptoJS = require('crypto-js');

4export function md5(text: string) {

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gadmin2n/schematics@0.0.121 matchedIdentity = npm:QGdhZG1pbjJuL3NjaGVtYXRpY3M:0.0.121 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

376try { L377: const fn = new Function("data", `return ${expression}`); L378: return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

dist/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./utils"), exports); L18: __exportStar(require("./utils/dependencies.utils"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

1export interface CodeExecuteInput { L2: script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

7L8: // https://segmentfault.com/a/1190000039192480 L9: /** ... L12: * @param secretKey {string} 密钥，43位随机大小写与数字 L13: * @returns {string} 加密后的密文，Base64格式 L14: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg

Findings

2 Critical6 Medium7 Low

CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env

CriticalPrevious Version Dangerous Deltadist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.js

MediumDynamic Requiredist/index.js

MediumUnsafe Vm Contextdist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.ts

LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView file

7patternName = blocked_file severity = critical matchedText = [redacted]-game-angle-demo/temporal/worker/.env redactedSecretContext = secretLikeLines = 1 L7: DATABASE_URL=<redacted:69 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.envView on unpkg · L7

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView file

Lines 356-383typescript

356 if (!pattern) return false;

357 if (pattern === actual) return true;

358 if (pattern === "*") return true;

359

360 const [patTable, patOp] = pattern.split(".");

361 const [actTable, actOp] = actual.split(".");

362

363 const tableMatch = patTable === "*" || patTable === actTable;

364 const opMatch = !patOp || patOp === "*" || patOp === actOp;

365

366 return tableMatch && opMatch;

367}

368

369/**

370 * 简单的 filter 表达式求值。

371 */

372function evaluateFilter(

373 expression: string,

374 payload: Record<string, any>,

375): boolean {

376 try {

377 const fn = new Function("data", `return ${expression}`);

378 return !!fn(payload);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/outbox-poller.tsView on unpkg · L376

379 } catch {

380 return true;

381 }

382}

383

dist/index.jsView file

Lines 1-21javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView file

Lines 1-21typescript

1export interface CodeExecuteInput {

2 script: string;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/src/activities/code-execute.tsView on unpkg · L1

3 mode?: 'runOnceForAll' | 'runOnceForEach'

dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.tsView file

Lines 1-27typescript

1const crypto = require('crypto');

2const CryptoJS = require('crypto-js');

4export function md5(text: string) {

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView file

•path = [redacted]-game-angle-demo/compose-ctl.sh kind = build_helper sizeBytes = 10061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.shView on unpkg

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.jsView on unpkg