registry / @geek-fun/serverlessinsight / 0.8.2

@geek-fun/serverlessinsight@0.8.2

Full life cycle cross providers serverless application management for your fast-growing business.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 183 file(s), 1.08 MB of source, external domains: oss.console.aliyun.com, serverlessinsight.geekfun.club

Source & flagged code

5 flagged

samples/aliyun-poc-rds.ymlView file

Lines 1-24yaml

1version: 0.1.0

3provider:

4 name: aliyun

5 region: cn-chengdu

7app: insight-poc

8service: insight-rds-poc

Source & flagged code

5 flagged · loading source

samples/aliyun-poc-rds.ymlView file

21patternName = generic_password severity = medium line = 21 matchedText = password...qFg'

Medium

Secret Pattern

Package contains a possible secret pattern.

samples/aliyun-poc-rds.ymlView on unpkg · L21

dist/src/stack/localStack/functionRunner.jsView file

58// which would replace import() with require() that breaks with file:// URLs L59: const importModule = new Function('specifier', 'return import(specifier)'); L60: const fileUrl = (0, node_url_1.pathToFileURL)(handlerPath + '.js').href;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/stack/localStack/functionRunner.jsView on unpkg · L58

dist/src/types/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./domains/resolvable"), exports); L18: __exportStar(require("./domains/database"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/types/index.jsView on unpkg · L16

samples/aliyun-poc-es.ymlView file

24patternName = generic_password severity = medium line = 24 matchedText = password...qFg'

Medium

Secret Pattern

Hardcoded password in samples/aliyun-poc-es.yml

samples/aliyun-poc-es.ymlView on unpkg · L24

32patternName = generic_password severity = medium line = 32 matchedText = password...qFg'

Medium

Secret Pattern

Hardcoded password in samples/aliyun-poc-es.yml

samples/aliyun-poc-es.ymlView on unpkg · L32

Findings

7 Medium6 Low

MediumSecret Patternsamples/aliyun-poc-rds.yml

MediumDynamic Requiredist/src/types/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsamples/aliyun-poc-es.yml

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/src/stack/localStack/functionRunner.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/src/stack/localStack/functionRunner.jsView file

Lines 38-78javascript

38const node_path_1 = __importStar(require("node:path"));

39const node_url_1 = require("node:url");

40const node_worker_threads_1 = require("node:worker_threads");

41// ============================================================================

42// Worker Thread Code (runs in worker context)

43// ============================================================================

44const parseHandler = (handler) => {

45 const [handlerFile, handlerMethod] = handler.split('.');

46 return [handlerFile, handlerMethod];

47};

48const resolveHandlerPath = (codeDir, servicePath, handlerFile) => servicePath

49 ? node_path_1.default.resolve(servicePath, codeDir, handlerFile)

50 : node_path_1.default.resolve(codeDir, handlerFile);

51const loadHandlerModule = async (handlerPath) => {

52 try {

53 // eslint-disable-next-line @typescript-eslint/no-require-imports

54 return require(handlerPath);

55 }

56 catch {

57 // Dynamic import — use Function constructor to prevent TypeScript CJS transform

58 // which would replace import() with require() that breaks with file:// URLs

59 const importModule = new Function('specifier', 'return import(specifier)');

60 const fileUrl = (0, node_url_1.pathToFileURL)(handlerPath + '.js').href;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/stack/localStack/functionRunner.jsView on unpkg · L58

61 return importModule(fileUrl);

62 }

63};

64const getHandlerFunction = (handlerModule, handlerMethod, handlerPath) => {

65 const handlerFn = handlerModule[handlerMethod];

66 if (typeof handlerFn !== 'function') {

67 throw new Error(`Handler "${handlerMethod}" not found or is not a function in ${handlerPath}`);

68 }

69 return handlerFn;

70};

71const invokeHandler = (handlerFn, event, context) => new Promise((resolve, reject) => {

72 // Callback-style handler (3+ parameters)

73 if (handlerFn.length >= 3) {

74 try {

75 handlerFn(event, context, (error, result) => {

76 return error ? reject(error) : resolve(result);

77 });

78 }

dist/src/types/index.jsView file

Lines 1-30javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

3 if (k2 === undefined) k2 = k;

4 var desc = Object.getOwnPropertyDescriptor(m, k);

5 if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {

6 desc = { enumerable: true, get: function() { return m[k]; } };

7 }

8 Object.defineProperty(o, k2, desc);

9}) : (function(o, m, k, k2) {

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __exportStar = (this && this.__exportStar) || function(m, exports) {

14 for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);

15};

16Object.defineProperty(exports, "__esModule", { value: true });

17__exportStar(require("./domains/resolvable"), exports);

18__exportStar(require("./domains/database"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/types/index.jsView on unpkg · L16

19__exportStar(require("./domains/event"), exports);

20__exportStar(require("./domains/function"), exports);

21__exportStar(require("./domains/tag"), exports);

22__exportStar(require("./domains/vars"), exports);

23__exportStar(require("./domains/context"), exports);

24__exportStar(require("./domains/bucket"), exports);

25__exportStar(require("./domains/table"), exports);

26__exportStar(require("./domains/state"), exports);

27__exportStar(require("./domains/lock"), exports);

28__exportStar(require("./domains/backend"), exports);

29__exportStar(require("./assets"), exports);

samples/aliyun-poc-es.ymlView file

Lines 4-33yaml

4 name: aliyun

5 region: cn-hangzhou

7app: insight-poc

8service: insight-db-poc

10tags:

11 owner: geek-fun

13databases:

14 insight_poc_es:

15 name: insight-poc-es

16 type: ELASTICSEARCH_SERVERLESS

17 version: ES_SEARCH_7.10

18 cu:

19 min: 3

20 max: 4

21 security:

22 basic_auth:

23 master_user: admin

24 password: 'U34I6InQ8elseTgqTWT2t2oFXpoqFg'

Medium

Secret Pattern

Hardcoded password in samples/aliyun-poc-es.yml

samples/aliyun-poc-es.ymlView on unpkg · L24

25 insight_poc_rds:

26 name: insight-poc-rds

27 type: RDS_PGSQL_SERVERLESS

28 version: PGSQL_16

29 security:

30 basic_auth:

31 master_user: admin

32 password: 'U34I6InQ8elseTgqTWT2t2oFXpoqFg'

Medium

Secret Pattern

Hardcoded password in samples/aliyun-poc-es.yml

samples/aliyun-poc-es.ymlView on unpkg · L32