registry / @gravity-ui/nodekit / 2.15.0

@gravity-ui/nodekit@2.15.0

Simple toolkit for your Node.js apps and scripts

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 52.0 KB of source, external domains: 127.0.0.1

Source & flagged code

2 flagged

dist/lib/telemetry/clickhouse.jsView file

Lines 94-134javascript

94 const query = `INSERT INTO ${dbName}.${tableName} (${tableColumns.join(',')}) Values ${insertValues}`;

95 if (process.env.APP_DEBUG_TELEMETRY_CH) {

96 ctx.log('[debug] NodeKit Telemetry: query prepared', { query });

97 }

98 return axiosInstance.post(`https://${config.appTelemetryChHost}:${port}`, query, {

99 params: {

100 query: '',

101 user,

102 password,

103 },

104 });

105 };

106 }

107 const queues = {};

108 Object.keys(tables).forEach((tableName) => {

109 queues[tableName] = (0, batch_1.prepareBatchedQueue)({

110 fn: sendBatchToClickhouseTable(tableName),

111 logError: (message, error, extra) => {

112 var _a, _b;

113 if ((_b = (_a = error === null || error === void 0 ? void 0 : error.config) === null || _a === void 0 ? void 0 : _a.params) === null

114 error.config.params.password = '[REDACTED]';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/telemetry/clickhouse.jsView on unpkg · L114

115 }

116 ctx.logError(message, error, extra);

117 },

118 tickInterval,

119 backlogSize,

120 batchSize,

121 });

122 });

123 function sendStats(inputTableName, inputData) {

124 let tableName;

125 let data;

126 if (inputData) {

127 tableName = inputTableName;

128 data = inputData;

129 }

130 else {

131 tableName = DEFAULT_TABLE_NAME;

132 data = inputTableName;

133 }

134 const dataToPush = Object.keys(DEFAULT_TABLES).includes(tableName)

dist/types.jsView file

Lines 1-7javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SpanKind = void 0;

4const consts_1 = require("./lib/consts");

5var api_1 =

Source & flagged code

2 flagged · loading source

dist/lib/telemetry/clickhouse.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = error.co...D]';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/telemetry/clickhouse.jsView on unpkg · L114

dist/types.jsView file

3exports.SpanKind = void 0; L4: const consts_1 = require("./lib/consts"); L5: var api_1 = require("@opentelemetry/api");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types.jsView on unpkg · L3

Findings

4 Medium4 Low

MediumSecret Patterndist/lib/telemetry/clickhouse.js

MediumDynamic Requiredist/types.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/lib/telemetry/clickhouse.jsView file

Lines 94-134javascript

94 const query = `INSERT INTO ${dbName}.${tableName} (${tableColumns.join(',')}) Values ${insertValues}`;

95 if (process.env.APP_DEBUG_TELEMETRY_CH) {

96 ctx.log('[debug] NodeKit Telemetry: query prepared', { query });

97 }

98 return axiosInstance.post(`https://${config.appTelemetryChHost}:${port}`, query, {

99 params: {

100 query: '',

101 user,

102 password,

103 },

104 });

105 };

106 }

107 const queues = {};

108 Object.keys(tables).forEach((tableName) => {

109 queues[tableName] = (0, batch_1.prepareBatchedQueue)({

110 fn: sendBatchToClickhouseTable(tableName),

111 logError: (message, error, extra) => {

112 var _a, _b;

113 if ((_b = (_a = error === null || error === void 0 ? void 0 : error.config) === null || _a === void 0 ? void 0 : _a.params) === null

114 error.config.params.password = '[REDACTED]';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/telemetry/clickhouse.jsView on unpkg · L114

115 }

116 ctx.logError(message, error, extra);

117 },

118 tickInterval,

119 backlogSize,

120 batchSize,

121 });

122 });

123 function sendStats(inputTableName, inputData) {

124 let tableName;

125 let data;

126 if (inputData) {

127 tableName = inputTableName;

128 data = inputData;

129 }

130 else {

131 tableName = DEFAULT_TABLE_NAME;

132 data = inputTableName;

133 }

134 const dataToPush = Object.keys(DEFAULT_TABLES).includes(tableName)

dist/types.jsView file

Lines 1-7javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SpanKind = void 0;

4const consts_1 = require("./lib/consts");

5var api_1 =