registry / @gadmin2n/schematics / 0.0.171
@gadmin2n/schematics@0.0.171
Gadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package entry point exports library functionality, and its application schematic writes templates only when requested. The generated sample app includes configurable OpenTelemetry reporting; its default Compose configuration uses development mode, and the endpoint setting can be removed to disable tracing.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package exposes its exports; template files are written when a user runs a schematic. The sample app starts tracing in non-development mode when its endpoint is configured.
Impact
The sample app may transmit host and database metadata to its APM endpoint. The package itself shows no automatic install-time or import-time collection.
Mechanism
The generated sample app uses OpenTelemetry instrumentation and exports traces to its configured endpoint. The setting is visible in the sample environment file and can be removed to skip tracing.
AI rationale
The package entry point exports library functionality, and its application schematic writes templates only when requested. The generated sample app includes configurable OpenTelemetry reporting; its default Compose configuration uses development mode, and the endpoint setting can be removed to disable tracing.
Evidence
dist/index.jsdist/lib/application/application.factory.jsdist/lib/application/files/gadmin2-game-angle-demo/server/.envdist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/tracing.tsdist/lib/application/files/gadmin2-game-angle-demo/docker-compose.ymldist/lib/application/files/gadmin2-game-angle-demo/Dockerfile.codegen
Network endpoints2
pl.ap-singapore.apm.tencentcs.com:4319mirrors.cloud.tencent.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install hook; its prepublishOnly script scrubs generated distribution files.
- The main entry re-exports utilities and defaults rather than starting background work.
- The application schematic generates the selected template when invoked.
- The sample app initializes tracing only when an OTLP endpoint is configured; its sample .env uses the placeholder token `xxxx`.
- Docker Compose defaults the sample server to development, where tracing initialization is skipped.
- The sample Dockerfile uses a Tencent npm mirror to install the CLI and dependencies.
Evidence against
- In non-development deployments, the sample tracing code can send the host name and database connection metadata to its configured APM endpoint.
- The sample .env points to a fixed Tencent APM endpoint, though the setting is visible and can be removed to disable tracing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
6 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical1 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts
LowFilesystem
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.171.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.171 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.