@hed-hog/core@0.0.386: Suspicious npm security report (Warn)

Loading npm security reports…

@hed-hog/core@0.0.386: Suspicious npm security report (Warn) | LPM Firewall

dist/pdf/pdf.service.jsView file

Lines 111-151javascript

111 const port = (_a = this.configService.get('PORT')) !== null && _a !== void 0 ? _a : 3100;

112 const baseUrl = (_b = this.configService.get('API_URL')) !== null && _b !== void 0 ? _b : `http://localhost:${port}`;

113 return (baseUrl.replace(/\/$/, '') +

114 (url.startsWith('/') ? url : '/' + url));

115 }

116 // ── HTML → PDF ────────────────────────────────────────────────────────────

117 /**

118 * Renders an HTML string to a PDF buffer using Playwright/Chromium.

119 *

120 * Uses dynamic `import()` via `new Function` to remain compatible with

121 * CommonJS bundle output (same pattern as operations.service.ts).

122 */

123 async generatePdfFromHtml(html, options = {}) {

124 var _a, _b, _c, _d, _e, _f, _g;

125 const executablePath = this.configService.get('CHROMIUM_EXECUTABLE_PATH');

126 const noSandbox = this.configService.get('CHROMIUM_NO_SANDBOX') === 'true';

127 const launchArgs = noSandbox

128 ? ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage']

129 : [];

130 let browser = null;

131 try {

132 const importPlaywright = new Function('moduleName', 'return import(moduleName);');

133 const playwright = await importPlaywright('playwright');

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pdf/pdf.service.jsView on unpkg · L131

134 browser = await playwright.chromium.launch(Object.assign(Object.assign({ headless: true }, (executablePath ? { executablePath } : {})), { args: launchArgs }));

135 const page = await browser.newPage();

136 // Viewport must match the requested PDF page size (`width`/`height`),

137 // otherwise CSS vw/vh units in the HTML are computed against the wrong

138 // box and everything laid out with them (e.g. certificate fields) ends

139 // up misaligned once Chromium scales the page to the paper size. Falls

140 // back to the A4 default (96dpi 210x297mm) when no explicit size is given.

141 await page.setViewportSize({

142 width: parsePxSize(options.width, 794),

143 height: parsePxSize(options.height, 1123),

144 });

145 await page.setContent(html, { waitUntil: 'networkidle' });

146 const pdfBuffer = await page.pdf(options.width && options.height

147 ? {

148 width: options.width,

149 height: options.height,

150 printBackground: (_a = options.printBackground) !== null && _a !== void 0 ? _a : true,

151 margin: (_b = options.margin) !== null && _b !== void 0 ? _b : { top: '0', right: '0', bottom: '0', left: '0' },

src/user/user.service.spec.tsView file

Lines 178-220typescript

178 });

179

180 it('não registra mudança quando nome igual', async () => {

181 const { service, deps } = makeService();

182 deps.prismaService.user.findUnique.mockResolvedValue({ id: 1, name: 'Same' });

183 deps.prismaService.user.update.mockResolvedValue({ id: 1, name: 'Same' });

184 await service.update('en', 1, { name: 'Same' } as any);

185 expect(deps.prismaService.user_change_log.create).not.toHaveBeenCalled();

186 });

187 });

188

189 describe('resetPassword', () => {

190 it('cria credencial quando nenhuma existe (count 0)', async () => {

191 const { service, deps } = makeService();

192 deps.prismaService.user.findUnique.mockResolvedValue({ id: 1 });

193 deps.prismaService.user_credential.updateMany.mockResolvedValue({ count: 0 });

194 deps.prismaService.user_credential.create.mockResolvedValue({ id: 1 });

195 deps.prismaService.user_activity.create.mockResolvedValue({ id: 1 });

196 deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });

197

198 const result = await service.resetPassword('en', 1, { password: 'MyPass1!' } as any);

Medium

Secret Pattern

Hardcoded password in src/user/user.service.spec.ts

src/user/user.service.spec.tsView on unpkg · L198

199 expect(deps.prismaService.user_credential.create).toHaveBeenCalled();

200 expect(result).toEqual({ password: 'MyPass1!', requiresReset: true });

Medium

Secret Pattern

Hardcoded password in src/user/user.service.spec.ts

src/user/user.service.spec.tsView on unpkg · L200

201 });

202

203 it('gera senha aleatória quando não informada', async () => {

204 const { service, deps } = makeService();

205 deps.prismaService.user.findUnique.mockResolvedValue({ id: 1 });

206 deps.prismaService.user_credential.updateMany.mockResolvedValue({ count: 1 });

207 deps.prismaService.user_activity.create.mockResolvedValue({ id: 1 });

208 deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });

209

210 const result = await service.resetPassword('en', 1, {} as any);

211 expect(result.password).toHaveLength(16);

212 expect(result.requiresReset).toBe(true);

213 });

214 });

215

216 describe('recordUserChange', () => {

217 it('serializa before/after e trata undefined como null', async () => {

218 const { service, deps } = makeService();

219 deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });

220 await (service as any).recordUserChange({

@hed-hog/core@0.0.386

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code