registry / @gadmin2n/schematics / 0.0.170
@gadmin2n/schematics@0.0.170
Gadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package entry point exports schematic utilities, and the flagged files are project templates with placeholder secrets and a dependency registry mirror. The generated tracing code sends only to a configured endpoint and skips tracing when that endpoint is unset.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package loads its exported modules; the application template is written only when a user invokes the schematic.
Impact
No evidence of automatic credential disclosure or unrelated data collection in the reviewed source.
Mechanism
The package entry point re-exports local utilities and defaults. The Tencent endpoint is configured as the sample Docker build's npm registry, while optional generated-app tracing uses a user-configured endpoint and is skipped if none is set.
AI rationale
The package entry point exports schematic utilities, and the flagged files are project templates with placeholder secrets and a dependency registry mirror. The generated tracing code sends only to a configured endpoint and skips tracing when that endpoint is unset.
Evidence
dist/index.jsdist/lib/application/application.factory.jsdist/lib/application/files/gadmin2-game-angle-demo/Dockerfile.codegendist/lib/application/files/gadmin2-game-angle-demo/server/.envdist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/tracing.ts
Network endpoints1
mirrors.cloud.tencent.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point exports utilities and defaults; its application schematic generates files into the project tree when invoked.
- The flagged .env template contains commented token examples and placeholder values such as `secret` and `xxxx`, not usable credentials.
- The flagged Dockerfile sets Tencent Cloud as an npm registry mirror for installing build dependencies; it does not send package or host data there.
- Generated-app tracing requires an endpoint supplied through `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` and skips initialization when it is unset.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical1 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts
LowFilesystem
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.170.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.170 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.