@gadmin2n/schematics@0.0.172
Gadmin - modern, fast, powerful node.js web framework (@schematics)
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package itself is a Nest schematic and has no install hook, but its generated server template defaults to runtime telemetry directed at a preset endpoint and includes database identifiers in traces. That undisclosed, identifying telemetry warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
A generated application starts outside development mode with the template endpoint configured.
Impact
The monitoring service receives traces and identifying database connection metadata without clear disclosure in the template.
Mechanism
OpenTelemetry exports traces to pl.ap-singapore.apm.tencentcs.com and adds database host, port, and name to PostgreSQL span attributes.
AI rationale
The package itself is a Nest schematic and has no install hook, but its generated server template defaults to runtime telemetry directed at a preset endpoint and includes database identifiers in traces. That undisclosed, identifying telemetry warrants a warning.
Evidence
dist/lib/application/files/gadmin2-game-angle-demo/server/.envdist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/tracing.ts
Network endpoints1
pl.ap-singapore.apm.tencentcs.com:4319
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The generated server template configures an OpenTelemetry trace endpoint at pl.ap-singapore.apm.tencentcs.com.
- Tracing reads DATABASE_URL and adds database host, port, and name to PostgreSQL span attributes.
- The generated server initializes tracing automatically outside development mode.
- The package is a Nest application schematic; its main entry exports utility modules, and its prepublishOnly hook scrubs local environment files.
Evidence against
- The apparent secret in the template .env is the literal placeholder `secret`; the OTEL token is `xxxx`.
- Tracing is a normal application monitoring feature, and the template exposes its endpoint and token through environment variables.
- The package manifest has no install, preinstall, or postinstall hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
6 flaggeddist/lib/application/files/gadmin2-game-angle-demo/server/.envView file
26patternName = blocked_file
severity = critical
blockedFile = [redacted]-game-angle-demo/server/.env
redactedSecretContext =
secretLikeLines = 2
L26: EXTERNAL_PAGE_SECRET=<redacted:6 value>
L29: OTEL_RESOURCE_ATTRIBUTES_TOKEN=<redacted:4 value>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib/application/files/gadmin2-game-angle-demo/server/.envView on unpkg · L26dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxView file
113// eslint-disable-next-line @typescript-eslint/no-implied-eval
L114: const fn = new Function(...scopeKeys, compiled);
L115: return fn(...scopeValues) as React.ComponentType;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsxFindings
1 Critical1 High5 Medium7 Low
CriticalCritical Secretdist/lib/application/files/gadmin2-game-angle-demo/server/.env
HighSemantic Analysis Limiteddist/lib/class/files/js/__name__.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/lib/application/files/gadmin2-game-angle-demo/compose-ctl.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/lib/application/files/gadmin2-game-angle-demo/web/src/routes/canvas/LivePreview.tsx
LowWeak Cryptodist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts
LowFilesystem
Affected versions and remediation
This report applies to @gadmin2n/schematics@0.0.172.
See all versions of @gadmin2n/schematics for other recorded verdicts.
- Review the evidence and your use of @gadmin2n/schematics@0.0.172 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.