@gadmin2n/schematics@0.0.167
Gadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package entrypoint and publish configuration indicate a schematics package, while the unresolved risk is in a generated demo server that automatically exports telemetry to a preset endpoint outside development. The available source does not establish recipient ownership or consent, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generated application starts outside the development environment with the bundled telemetry endpoint configured.
Impact
Application and infrastructure metadata may be disclosed to the preset collector.
Mechanism
OpenTelemetry instrumentation collects HTTP, PostgreSQL, and Prisma traces and sends them through an OTLP exporter to the configured endpoint.
AI rationale
The package entrypoint and publish configuration indicate a schematics package, while the unresolved risk is in a generated demo server that automatically exports telemetry to a preset endpoint outside development. The available source does not establish recipient ownership or consent, so this warrants a warning rather than a block.
Evidence
dist/lib/application/files/gadmin2-game-angle-demo/server/.envdist/lib/application/files/gadmin2-game-angle-demo/server/src/main.tsdist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/tracing.ts
Network endpoints1
pl.ap-singapore.apm.tencentcs.com:4319
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package publishes its distribution files and points its main entry to the package entrypoint; the telemetry code is part of a generated demo application.
- The demo application's environment file sets an OTLP trace endpoint at pl.ap-singapore.apm.tencentcs.com.
- The generated server imports tracing at startup and initializes it whenever the environment is not development.
- Tracing sends service, environment, and host metadata with HTTP, PostgreSQL, and Prisma instrumentation to the configured endpoint. The source does not establish who controls the default recipient or that generated-app users affirmatively chose it.
Evidence against
- The telemetry code is in the generated demo application, not an install hook; the server startup code skips tracing in development.
- The endpoint is read from configuration, and the inspected source does not show service credentials being sent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
7 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical2 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
HighPrevious Version Dangerous Deltadist/lib/application/files/gadmin2-game-angle-demo/server/scripts/check-swc-watch-leak.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
Low
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.167.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.167 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.