Loading npm security reports…

@hed-hog/core: Suspicious npm security report (Warn) | LPM Firewall

registry / @hed-hog/core / 0.0.386

@hed-hog/core@0.0.386

> **License**: MIT (Open Source) — Core is the only Open Source module of the HedHog Framework; the other modules are Enterprise and require a commercial license. See [LICENSE.md](./LICENSE.md).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 681 file(s), 3.33 MB of source, external domains: 127.0.0.1, accounts.google.com, admin.com, admin.example.com, api.example.com, api.github.com, api.linkedin.com, api.openai.com, app.com, app.example.com, appleid.apple.com, coinbitclub.vip, default.com, env.example.com, evil.example.com, first.example.com, fonts.googleapis.com, fonts.gstatic.com, gcjdclnalkkapoajodppjbcmifnadgok.chromiumapp.org, generativelanguage.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, ip-api.com, login.microsoftonline.com, oauth2.googleapis.com, people.googleapis.com, second.example.com, train.com, training.example.com, unknown.example.com, valid.example.com, www.facebook.com, www.googleapis.com, www.linkedin.com, www.w3.org, x.com

Source & flagged code

6 flagged

dist/install/dto/install.dto.jsView file

Lines 2-42javascript

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.InstallDTO = void 0;

13const api_locale_1 = require("@hed-hog/api-locale");

14const class_validator_1 = require("class-validator");

15const is_email_with_settings_validator_1 = require("../../validators/is-email-with-settings.validator");

16class InstallDTO {

17 constructor() {

18 this.appName = 'HedHog';

19 this.slogan = 'Administration Panel';

20 this.userName = 'Root User';

21 this.email = 'root@hedhog.com';

22 this.password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/install/dto/install.dto.jsView on unpkg · L22

23 this.adminUrl = 'http://localhost:3200';

24 this.apiUrl = 'http://localhost:3100';

25 }

26}

27exports.InstallDTO = InstallDTO;

28__decorate([

29 (0, class_validator_1.IsOptional)(),

30 (0, class_validator_1.IsString)({ message: 'Nome da aplicação obrigatório' }),

31 (0, class_validator_1.MinLength)(1, { message: 'Nome da aplicação obrigatório' }),

32 __metadata("design:type", String)

33], InstallDTO.prototype, "appName", void 0);

34__decorate([

35 (0, class_validator_1.IsOptional)(),

36 (0, class_validator_1.IsString)({ message: 'Slogan obrigatório' }),

37 (0, class_validator_1.MinLength)(1, { message: 'Slogan obrigatório' }),

38 __metadata("design:type", String)

39], InstallDTO.prototype, "slogan", void 0);

40__decorate([

41 (0, class_validator_1.IsOptional)(),

42 (0, class_validator_1.IsString)({ message: 'Nome de usuário obrigatório' }),

dist/pdf/pdf.service.jsView file

Lines 111-151javascript

111 const port = (_a = this.configService.get('PORT')) !== null && _a !== void 0 ? _a

dist/dto/update-ids.dto.jsView file

Lines 1-28javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var

src/user/user.service.tsView file

Lines 54-94typescript

54 'updated_at',

55] as const;

57const USER_SEARCH_FIELDS = ['name'] as const;

59type

src/user/user.service.spec.tsView file

Lines 178-220typescript

178 });

179

180 it('não registra mudança quando nome igual', async () => {

181 const { service, deps } = makeService();

182 deps.prismaService.user.findUnique.

Source & flagged code

6 flagged

dist/install/dto/install.dto.jsView file

Lines 2-42javascript

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.InstallDTO = void 0;

13const api_locale_1 = require("@hed-hog/api-locale");

14const class_validator_1 = require("class-validator");

15const is_email_with_settings_validator_1 = require("../../validators/is-email-with-settings.validator");

16class InstallDTO {

17 constructor() {

18 this.appName = 'HedHog';

19 this.slogan = 'Administration Panel';

20 this.userName = 'Root User';

21 this.email = 'root@hedhog.com';

22 this.password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/install/dto/install.dto.jsView on unpkg · L22

23 this.adminUrl = 'http://localhost:3200';

24 this.apiUrl = 'http://localhost:3100';

25 }

26}

27exports.InstallDTO = InstallDTO;

28__decorate([

29 (0, class_validator_1.IsOptional)(),

30 (0, class_validator_1.IsString)({ message: 'Nome da aplicação obrigatório' }),

31 (0, class_validator_1.MinLength)(1, { message: 'Nome da aplicação obrigatório' }),

32 __metadata("design:type", String)

33], InstallDTO.prototype, "appName", void 0);

34__decorate([

35 (0, class_validator_1.IsOptional)(),

36 (0, class_validator_1.IsString)({ message: 'Slogan obrigatório' }),

37 (0, class_validator_1.MinLength)(1, { message: 'Slogan obrigatório' }),

38 __metadata("design:type", String)

39], InstallDTO.prototype, "slogan", void 0);

40__decorate([

41 (0, class_validator_1.IsOptional)(),

42 (0, class_validator_1.IsString)({ message: 'Nome de usuário obrigatório' }),

dist/pdf/pdf.service.jsView file

Lines 111-151javascript

111 const port = (_a = this.configService.get('PORT')) !== null && _a !== void 0 ? _a

dist/dto/update-ids.dto.jsView file

Lines 1-28javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var

src/user/user.service.tsView file

Lines 54-94typescript

54 'updated_at',

55] as const;

57const USER_SEARCH_FIELDS = ['name'] as const;

59type

src/user/user.service.spec.tsView file

Lines 178-220typescript

178 });

179

180 it('não registra mudança quando nome igual', async () => {

181 const { service, deps } = makeService();

182 deps.prismaService.user.findUnique.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code