registry / @hed-hog/cli / 0.0.143

@hed-hog/cli@0.0.143

HedHog CLI tool

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 573 KB of source, external domains: chocolatey.org, community.chocolatey.org, docs.docker.com, github.com, hedhog.com, nodejs.org, npm.hedhog.com, pnpm.io, registry.npmjs.org, www.docker.com

Source & flagged code

2 flagged

dist/src/modules/database/database.service.jsView file

Lines 287-327javascript

287 async generateEnvFileIfNotExists(appPath, dockerComposeFilePath) {

288 const envFilePath = (0, path_1.resolve)(`${appPath}/.env`);

289 const envExamplePath = (0, path_1.resolve)(`${appPath}/.env.example`);

290 let envContent = '';

291 try {

292 envContent = await (0, promises_1.readFile)(envFilePath, 'utf8');

293 }

294 catch {

295 try {

296 envContent = await (0, promises_1.readFile)(envExamplePath, 'utf8');

297 }

298 catch {

299 envContent = '';

300 }

301 }

302 const dockerComposeContent = await (0, promises_1.readFile)(dockerComposeFilePath, 'utf8');

303 const dbServiceMatch = dockerComposeContent.match(/(\w+):\s*image:\s*(postgres|mysql)/);

304 if (dbServiceMatch) {

305 const dbType = dbServiceMatch[2];

306 let user = 'hedhog';

307 let password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/modules/database/database.service.jsView on unpkg · L307

308 let db = 'hedhog';

309 let port = dbType === 'postgres' ? '5432' : '3306';

310 const portMatch = dockerComposeContent.match(/ports:\s*\r?\n\s*-\s*["']?(\d+):(5432|3306)["']?/);

311 if (portMatch) {

312 port = portMatch[1];

313 }

314 if (dbType === 'postgres') {

315 user =

316 dockerComposeContent.match(/POSTGRES_USER:\s*(\w+)/)?.[1] || user;

317 password =

318 dockerComposeContent.match(/POSTGRES_PASSWORD:\s*(\w+)/)?.[1] ||

319 password;

320 db = dockerComposeContent.match(/POSTGRES_DB:\s*(\w+)/)?.[1] || db;

321 const newEnv = `DATABASE_URL="postgresql://${user}:${password}@localhost:${port}/${db}"`;

322 envContent = this.upsertEnvVariable(envContent, 'DATABASE_URL', newEnv);

323 }

324 else if (dbType === 'mysql') {

325 user = dockerComposeContent.match(/MYSQL_USER:\s*(\w+)/)?.[1] || user;

326 password =

327 dockerComposeContent.match(/MYSQL_PASSWORD:\s*(\w+)/)?.[1] ||

dist/scripts/deploy.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const child_process_1 = require("child_process");

4/**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/deploy.jsView on unpkg · L2

5 * Runs the given command and throws an error if it fails.

Source & flagged code

2 flagged · loading source

dist/src/modules/database/database.service.jsView file

307patternName = generic_password severity = medium line = 307 matchedText = let pass...me';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/modules/database/database.service.jsView on unpkg · L307

dist/scripts/deploy.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const child_process_1 = require("child_process"); L4: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/deploy.jsView on unpkg · L2

Findings

4 Medium4 Low

MediumSecret Patterndist/src/modules/database/database.service.js

MediumDynamic Requiredist/scripts/deploy.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/src/modules/database/database.service.jsView file

Lines 287-327javascript

287 async generateEnvFileIfNotExists(appPath, dockerComposeFilePath) {

288 const envFilePath = (0, path_1.resolve)(`${appPath}/.env`);

289 const envExamplePath = (0, path_1.resolve)(`${appPath}/.env.example`);

290 let envContent = '';

291 try {

292 envContent = await (0, promises_1.readFile)(envFilePath, 'utf8');

293 }

294 catch {

295 try {

296 envContent = await (0, promises_1.readFile)(envExamplePath, 'utf8');

297 }

298 catch {

299 envContent = '';

300 }

301 }

302 const dockerComposeContent = await (0, promises_1.readFile)(dockerComposeFilePath, 'utf8');

303 const dbServiceMatch = dockerComposeContent.match(/(\w+):\s*image:\s*(postgres|mysql)/);

304 if (dbServiceMatch) {

305 const dbType = dbServiceMatch[2];

306 let user = 'hedhog';

307 let password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/modules/database/database.service.jsView on unpkg · L307

308 let db = 'hedhog';

309 let port = dbType === 'postgres' ? '5432' : '3306';

310 const portMatch = dockerComposeContent.match(/ports:\s*\r?\n\s*-\s*["']?(\d+):(5432|3306)["']?/);

311 if (portMatch) {

312 port = portMatch[1];

313 }

314 if (dbType === 'postgres') {

315 user =

316 dockerComposeContent.match(/POSTGRES_USER:\s*(\w+)/)?.[1] || user;

317 password =

318 dockerComposeContent.match(/POSTGRES_PASSWORD:\s*(\w+)/)?.[1] ||

319 password;

320 db = dockerComposeContent.match(/POSTGRES_DB:\s*(\w+)/)?.[1] || db;

321 const newEnv = `DATABASE_URL="postgresql://${user}:${password}@localhost:${port}/${db}"`;

322 envContent = this.upsertEnvVariable(envContent, 'DATABASE_URL', newEnv);

323 }

324 else if (dbType === 'mysql') {

325 user = dockerComposeContent.match(/MYSQL_USER:\s*(\w+)/)?.[1] || user;

326 password =

327 dockerComposeContent.match(/MYSQL_PASSWORD:\s*(\w+)/)?.[1] ||

dist/scripts/deploy.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const child_process_1 = require("child_process");

4/**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/deploy.jsView on unpkg · L2

5 * Runs the given command and throws an error if it fails.