registry / @gadmin2n/schematics / 0.0.168
@gadmin2n/schematics@0.0.168
⚠ Under reviewGadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected manifest and entry point fit a schematic package, and the reviewed dynamic execution belongs to a demo preview. The broad generated corpus and unresolved flagged source behavior leave insufficient verified coverage for a clean verdict, while the inspected evidence does not support a concrete attack finding.
Static reason
One or more suspicious static signals were detected.
Trigger
Using the exported schematic package or running the generated demo can activate its respective code.
Impact
The available excerpts do not establish harmful impact; unresolved source coverage prevents a clean determination.
Mechanism
The reviewed entry point re-exports package modules; the demo preview dynamically executes compiled JSX supplied to it.
AI rationale
The inspected manifest and entry point fit a schematic package, and the reviewed dynamic execution belongs to a demo preview. The broad generated corpus and unresolved flagged source behavior leave insufficient verified coverage for a clean verdict, while the inspected evidence does not support a concrete attack finding.
Decision evidence
public snapshotAI called this Manual Review at 52.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest publishes dist files and sets dist/index.js as the package entry point.
- The entry point re-exports utilities and defaults; the package also contains a demo preview that compiles and runs supplied JSX.
- The inspected demo environment excerpt contains development configuration and a localhost callback.
Evidence against
- These excerpts do not establish credential theft, unintended network transfer, or install-time execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical1 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts
LowFilesystem
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.168.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.168 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.