@gadmin2n/schematics@0.0.169
Gadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package contains a generated startup script with a shell command injection risk when run against crafted environment-file input. This is a user-triggered local execution risk, not evidence of an install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the generated startup script with a crafted project environment file.
Impact
Commands could run with the privileges of the user starting the generated server.
Mechanism
The script builds a shell assignment using an environment-file key and evaluates it, allowing shell syntax in the key to be interpreted as commands.
AI rationale
The package contains a generated startup script with a shell command injection risk when run against crafted environment-file input. This is a user-triggered local execution risk, not evidence of an install-time attack.
Evidence
dist/lib/application/files/gadmin2-game-angle-demo/server/start-prod.shdist/lib/application/files/gadmin2-game-angle-demo/server/.env
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest shows a publish-only scrub hook; the reviewed source does not show this script running during installation.
- The generated server startup script reads keys from a project environment file and interpolates each key into shell evaluation, so a crafted key can inject shell commands when the script is run.
- The bundled environment file contains ordinary configuration entries; the risk depends on someone running the generated script with crafted input.
Evidence against
- This behavior is in a generated application template and requires a user to run its startup script; the inspected manifest does not show it running as an install hook.
- The inspected source shows no network transfer associated with this behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical2 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
HighPrevious Version Dangerous Deltadist/lib/application/files/gadmin2-game-angle-demo/server/start-prod.sh
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
LowWeak Crypto
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.169.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.169 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.