registry / @hasna/shortlinks / 0.2.1

@hasna/shortlinks@0.2.1

Shortlink manager for custom domains and click tracking, with local SQLite or self-hosted cloud (/v1 API + bearer key) storage and Cloudflare setup helpers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.32 MB of source, external domains: api.cloudflare.com, github.com, registry.npmjs.org, shortlinks.example.com, truststore.pki.rds.amazonaws.com, www.postgresql.org

Source & flagged code

3 flagged

infra/aws-ec2-user-data.shView file

Lines 30-70shell

30set -euo pipefail

32export AWS_REGION="${AWS_REGION:-us-east-1}"

33export HOME="/var/lib/shortlinks"

34export PATH="/var/lib/shortlinks/.bun/bin:/usr/local/bin:/usr/bin:/bin"

35export HASNA_SHORTLINKS_STORE="postgres"

36export HASNA_SHORTLINKS_DATABASE_SSL="${HASNA_SHORTLINKS_DATABASE_SSL:-true}"

38secret_json="$(aws secretsmanager get-secret-value \

39 --region "${AWS_REGION}" \

40 --secret-id "${SHORTLINKS_DATABASE_SECRET_ID:-hasna/xyz/opensource/shortlinks/prod/postgres}" \

41 --query SecretString \

42 --output text)"

44connection_url="$(jq -r '(.connectionString // .connection_string // .url // .database_url // empty)' <<<"${secret_json}")"

45if [[ -z "${connection_url}" ]]; then

46 db_host="$(jq -r '.host // empty' <<<"${secret_json}")"

47 db_port="$(jq -r '.port // 5432' <<<"${secret_json}")"

48 db_name="$(jq -r '.database // .dbname // "shortlinks"' <<<"${secret_json}")"

49 db_user="$(jq -r '.username // .user // empty' <<<"${secret_json}")"

50 db_password="$(jq -r '.password // empty' <<<"${secret_json}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

infra/aws-ec2-user-data.shView on unpkg · L50

51 if [[ -z "${db_host}" || -z "${db_user}" || -z "${db_password}" ]]; then

52 echo "Shortlinks database secret must include connectionString/url or host, username, and password." >&2

53 exit 1

54 fi

55 db_user_encoded="$(jq -nr --arg value "${db_user}" '$value|@uri')"

56 db_password_encoded="$(jq -nr --arg value "${db_password}" '$value|@uri')"

57 connection_url="postgres://${db_user_encoded}:${db_password_encoded}@${db_host}:${db_port}/${db_name}"

58fi

60export HASNA_SHORTLINKS_DATABASE_URL="${connection_url}"

62exec "$@"

63RUNNER

64chmod 750 /usr/local/bin/shortlinks-env-exec

65chown root:shortlinks /usr/local/bin/shortlinks-env-exec

67su -s /bin/bash shortlinks -c 'PATH=/var/lib/shortlinks/.bun/bin:$PATH shortlinks --version'

69caddy_version="$(curl -fsSL https://api.github.com/repos/caddyserver/caddy/releases/latest | jq -r '.tag_name // "v2.10.2"' | sed 's/^v//')"

70case "$(uname -m)" in

•path = infra/aws-ec2-user-data.sh kind = build_helper sizeBytes = 4901 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

infra/aws-ec2-user-data.shView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hasna/shortlinks@0.2.0 matchedIdentity = npm:QGhhc25hL3Nob3J0bGlua3M:0.2.0 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

infra/aws-ec2-user-data.shView file

50patternName = generic_password severity = medium line = 50 matchedText = db_passw...}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

infra/aws-ec2-user-data.shView on unpkg · L50

•path = infra/aws-ec2-user-data.sh kind = build_helper sizeBytes = 4901 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

infra/aws-ec2-user-data.shView on unpkg

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterninfra/aws-ec2-user-data.sh

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinfra/aws-ec2-user-data.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

infra/aws-ec2-user-data.shView file

Lines 30-70shell

30set -euo pipefail

32export AWS_REGION="${AWS_REGION:-us-east-1}"

33export HOME="/var/lib/shortlinks"

34export PATH="/var/lib/shortlinks/.bun/bin:/usr/local/bin:/usr/bin:/bin"

35export HASNA_SHORTLINKS_STORE="postgres"

36export HASNA_SHORTLINKS_DATABASE_SSL="${HASNA_SHORTLINKS_DATABASE_SSL:-true}"

38secret_json="$(aws secretsmanager get-secret-value \

39 --region "${AWS_REGION}" \

40 --secret-id "${SHORTLINKS_DATABASE_SECRET_ID:-hasna/xyz/opensource/shortlinks/prod/postgres}" \

41 --query SecretString \

42 --output text)"

44connection_url="$(jq -r '(.connectionString // .connection_string // .url // .database_url // empty)' <<<"${secret_json}")"

45if [[ -z "${connection_url}" ]]; then

46 db_host="$(jq -r '.host // empty' <<<"${secret_json}")"

47 db_port="$(jq -r '.port // 5432' <<<"${secret_json}")"

48 db_name="$(jq -r '.database // .dbname // "shortlinks"' <<<"${secret_json}")"

49 db_user="$(jq -r '.username // .user // empty' <<<"${secret_json}")"

50 db_password="$(jq -r '.password // empty' <<<"${secret_json}")"

Medium

Secret Pattern

Package contains a possible secret pattern.

infra/aws-ec2-user-data.shView on unpkg · L50

51 if [[ -z "${db_host}" || -z "${db_user}" || -z "${db_password}" ]]; then

52 echo "Shortlinks database secret must include connectionString/url or host, username, and password." >&2

53 exit 1

54 fi

55 db_user_encoded="$(jq -nr --arg value "${db_user}" '$value|@uri')"

56 db_password_encoded="$(jq -nr --arg value "${db_password}" '$value|@uri')"

57 connection_url="postgres://${db_user_encoded}:${db_password_encoded}@${db_host}:${db_port}/${db_name}"

58fi

60export HASNA_SHORTLINKS_DATABASE_URL="${connection_url}"

62exec "$@"

63RUNNER

64chmod 750 /usr/local/bin/shortlinks-env-exec

65chown root:shortlinks /usr/local/bin/shortlinks-env-exec

67su -s /bin/bash shortlinks -c 'PATH=/var/lib/shortlinks/.bun/bin:$PATH shortlinks --version'

69caddy_version="$(curl -fsSL https://api.github.com/repos/caddyserver/caddy/releases/latest | jq -r '.tag_name // "v2.10.2"' | sed 's/^v//')"

70case "$(uname -m)" in

•path = infra/aws-ec2-user-data.sh kind = build_helper sizeBytes = 4901 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

infra/aws-ec2-user-data.shView on unpkg

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg