Loading npm security reports…

@hed-hog/core@0.0.373: Suspicious npm security report (Warn) | LPM Firewall

registry / @hed-hog/core / 0.0.373

@hed-hog/core@0.0.373

```markdown # @hed-hog/core

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 624 file(s), 2.93 MB of source, external domains: accounts.google.com, api.github.com, api.openai.com, coinbitclub.vip, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, ip-api.com, login.microsoftonline.com, oauth2.googleapis.com, people.googleapis.com, www.facebook.com, www.googleapis.com, www.w3.org

Source & flagged code

4 flagged

dist/install/dto/install.dto.jsView file

Lines 2-42javascript

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.InstallDTO = void 0;

13const api_locale_1 = require("@hed-hog/api-locale");

14const class_validator_1 = require("class-validator");

15const is_email_with_settings_validator_1 = require("../../validators/is-email-with-settings.validator");

16class InstallDTO {

17 constructor() {

18 this.appName = 'HedHog';

19 this.slogan = 'Administration Panel';

20 this.userName = 'Root User';

21 this.email = 'root@hedhog.com';

22 this.password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/install/dto/install.dto.jsView on unpkg · L22

23 this.adminUrl = 'http://localhost:3200';

24 this.apiUrl = 'http://localhost:3100';

25 }

26}

27exports.InstallDTO = InstallDTO;

28__decorate([

29 (0, class_validator_1.IsOptional)(),

30 (0, class_validator_1.IsString)({ message: 'Nome da aplicação obrigatório' }),

31 (0, class_validator_1.MinLength)(1, { message: 'Nome da aplicação obrigatório' }),

32 __metadata("design:type", String)

33], InstallDTO.prototype, "appName", void 0);

34__decorate([

35 (0, class_validator_1.IsOptional)(),

36 (0, class_validator_1.IsString)({ message: 'Slogan obrigatório' }),

37 (0, class_validator_1.MinLength)(1, { message: 'Slogan obrigatório' }),

38 __metadata("design:type", String)

39], InstallDTO.prototype, "slogan", void 0);

40__decorate([

41 (0, class_validator_1.IsOptional)(),

42 (0, class_validator_1.IsString)({ message: 'Nome de usuário obrigatório' }),

dist/pdf/pdf.service.jsView file

Lines 101-141javascript

101 const port = (_a = this.configService.get('PORT')) !== null && _a !== void 0 ? _a

dist/dto/update-ids.dto.jsView file

Lines 1-28javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var

src/user/user.service.tsView file

Lines 54-94typescript

54 'updated_at',

55] as const;

57const USER_SEARCH_FIELDS = ['name'] as const;

59type

Source & flagged code

4 flagged · loading source

dist/install/dto/install.dto.jsView file

22patternName = generic_password severity = medium line = 22 matchedText = this.pas...me';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/install/dto/install.dto.jsView on unpkg · L22

dist/pdf/pdf.service.jsView file

121try { L122: const importPlaywright = new Function('moduleName', 'return import(moduleName);'); L123: const playwright = await importPlaywright('playwright');

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pdf/pdf.service.jsView on unpkg · L121

dist/dto/update-ids.dto.jsView file

12exports.UpdateIdsDTO = void 0; L13: const api_locale_1 = require("@hed-hog/api-locale"); L14: const class_validator_1 = require("class-validator");

Findings

5 Medium6 Low

MediumSecret Patterndist/install/dto/install.dto.js

MediumDynamic Requiredist/dto/update-ids.dto.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowEvaldist/pdf/pdf.service.js

LowWeak Cryptosrc/user/user.service.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/install/dto/install.dto.jsView file

Lines 2-42javascript

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.InstallDTO = void 0;

13const api_locale_1 = require("@hed-hog/api-locale");

14const class_validator_1 = require("class-validator");

15const is_email_with_settings_validator_1 = require("../../validators/is-email-with-settings.validator");

16class InstallDTO {

17 constructor() {

18 this.appName = 'HedHog';

19 this.slogan = 'Administration Panel';

20 this.userName = 'Root User';

21 this.email = 'root@hedhog.com';

22 this.password = 'changeme';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/install/dto/install.dto.jsView on unpkg · L22

23 this.adminUrl = 'http://localhost:3200';

24 this.apiUrl = 'http://localhost:3100';

25 }

26}

27exports.InstallDTO = InstallDTO;

28__decorate([

29 (0, class_validator_1.IsOptional)(),

30 (0, class_validator_1.IsString)({ message: 'Nome da aplicação obrigatório' }),

31 (0, class_validator_1.MinLength)(1, { message: 'Nome da aplicação obrigatório' }),

32 __metadata("design:type", String)

33], InstallDTO.prototype, "appName", void 0);

34__decorate([

35 (0, class_validator_1.IsOptional)(),

36 (0, class_validator_1.IsString)({ message: 'Slogan obrigatório' }),

37 (0, class_validator_1.MinLength)(1, { message: 'Slogan obrigatório' }),

38 __metadata("design:type", String)

39], InstallDTO.prototype, "slogan", void 0);

40__decorate([

41 (0, class_validator_1.IsOptional)(),

42 (0, class_validator_1.IsString)({ message: 'Nome de usuário obrigatório' }),

dist/pdf/pdf.service.jsView file

Lines 101-141javascript

101 const port = (_a = this.configService.get('PORT')) !== null && _a !== void 0 ? _a

dist/dto/update-ids.dto.jsView file

Lines 1-28javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var

src/user/user.service.tsView file

Lines 54-94typescript

54 'updated_at',

55] as const;

57const USER_SEARCH_FIELDS = ['name'] as const;

59type