registry / @itentialopensource/adapter-git / 1.0.7

@itentialopensource/adapter-git@1.0.7

Itential adapter to run git commands

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 41.4 KB of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-28json

2 "name": "@itentialopensource/adapter-git",

3 "version": "1.0.7",

4 "description": "Itential adapter to run git commands",

5 "main": "adapter.js",

6 "adapterType": "library",

7 "scripts": {

8 "preinstall": "node utils/setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "deinstall": "node utils/removeHooks.js",

10 "lint": "node --max_old_space_size=4096 ./node_modules/eslint/bin/eslint.js . --ext .json --ext .js",

11 "lint:errors": "node --max_old_space_size=4096 ./node_modules/eslint/bin/eslint.js . --ext .json --ext .js --quiet",

12 "test:unit": "mocha test/unit/adapterTestUnit.js --LOG=error",

13 "test:integration": "mocha test/integration/adapterTestIntegration.js --LOG=error",

14 "test": "npm run test:unit && npm run test:integration"

15 },

16 "keywords": [

17 "Itential",

18 "Itential Platform",

19 "Automation",

20 "Integration",

21 "Adapter",

22 "DevOps",

23 "NetOps",

24 "Git",

25 "Pre-Release"

26 ],

27 "license": "Apache-2.0",

28 "engines": {

test/unit/adapterTestUnit.jsView file

Lines 14-70javascript

14const winston = require('winston');

15const execute = require('child_process').execSync;

16const { expect } = require('chai');

17const { use }

adapter.jsView file

Lines 1-35javascript

1/* @copyright Itential, LLC 2019 (pre-modifications) */

3// Set globals

4/* global eventSystem log */

5/* eslint no-underscore-dangle: warn */

6/* eslint no-loop-func: warn */

7/* eslint no-cond-assign: warn */

8/* eslint no-unused-vars: warn */

9/* eslint consistent-return: warn */

10/* eslint import/no-dynamic-require: warn */

11/* eslint global-require: warn */

12/* eslint no-await-in-loop: warn */

utils/pre-commit.shView file

•path = utils/pre-commit.sh kind = build_helper sizeBytes = 689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utils/pre-commit.shView on unpkg

test/integration/adapterTestIntegration.jsView file

Lines 11-69javascript

11const mocha = require('mocha');

12const path = require('path');

13const winston = require('winston');

14const { expect }

utils/testRunner.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2/* @copyright Itential, LLC 2019 */

4const execute = require('child_process').exec;

5const fs = require('fs-extra');

6const rl = require(

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node utils/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

test/unit/adapterTestUnit.jsView file

34patternName = generic_password severity = medium line = 34 matchedText = const pa...rd';

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/adapterTestUnit.jsView on unpkg · L34

50patternName = generic_password severity = medium line = 50 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in test/unit/adapterTestUnit.js

test/unit/adapterTestUnit.jsView on unpkg · L50

adapter.jsView file

15/* Required libraries. */ L16: const fs = require('fs-extra'); L17: const builtInfs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

adapter.jsView on unpkg · L15

utils/pre-commit.shView file

•path = utils/pre-commit.sh kind = build_helper sizeBytes = 689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utils/pre-commit.shView on unpkg

test/integration/adapterTestIntegration.jsView file

31patternName = generic_password severity = medium line = 31 matchedText = const pa...rd';

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L31

49patternName = generic_password severity = medium line = 49 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L49

utils/testRunner.jsView file

19patternName = generic_password severity = medium line = 19 matchedText = let pass...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L19

29patternName = generic_password severity = medium line = 29 matchedText = const dp...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L29

89patternName = generic_password severity = medium line = 89 matchedText = intTest ...;`);

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L89

Findings

1 High10 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumSecret Patterntest/unit/adapterTestUnit.js

MediumDynamic Requireadapter.js

MediumShips Build Helperutils/pre-commit.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/unit/adapterTestUnit.js

MediumSecret Patterntest/integration/adapterTestIntegration.js

MediumSecret Patternutils/testRunner.js

LowScripts Present

LowFilesystem

Source & flagged code

10 flagged

package.jsonView file

Lines 1-28json

2 "name": "@itentialopensource/adapter-git",

3 "version": "1.0.7",

4 "description": "Itential adapter to run git commands",

5 "main": "adapter.js",

6 "adapterType": "library",

7 "scripts": {

8 "preinstall": "node utils/setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "deinstall": "node utils/removeHooks.js",

10 "lint": "node --max_old_space_size=4096 ./node_modules/eslint/bin/eslint.js . --ext .json --ext .js",

11 "lint:errors": "node --max_old_space_size=4096 ./node_modules/eslint/bin/eslint.js . --ext .json --ext .js --quiet",

12 "test:unit": "mocha test/unit/adapterTestUnit.js --LOG=error",

13 "test:integration": "mocha test/integration/adapterTestIntegration.js --LOG=error",

14 "test": "npm run test:unit && npm run test:integration"

15 },

16 "keywords": [

17 "Itential",

18 "Itential Platform",

19 "Automation",

20 "Integration",

21 "Adapter",

22 "DevOps",

23 "NetOps",

24 "Git",

25 "Pre-Release"

26 ],

27 "license": "Apache-2.0",

28 "engines": {

test/unit/adapterTestUnit.jsView file

Lines 14-70javascript

14const winston = require('winston');

15const execute = require('child_process').execSync;

16const { expect } = require('chai');

17const { use }

adapter.jsView file

Lines 1-35javascript

1/* @copyright Itential, LLC 2019 (pre-modifications) */

3// Set globals

4/* global eventSystem log */

5/* eslint no-underscore-dangle: warn */

6/* eslint no-loop-func: warn */

7/* eslint no-cond-assign: warn */

8/* eslint no-unused-vars: warn */

9/* eslint consistent-return: warn */

10/* eslint import/no-dynamic-require: warn */

11/* eslint global-require: warn */

12/* eslint no-await-in-loop: warn */

utils/pre-commit.shView file

•path = utils/pre-commit.sh kind = build_helper sizeBytes = 689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utils/pre-commit.shView on unpkg

test/integration/adapterTestIntegration.jsView file

Lines 11-69javascript

11const mocha = require('mocha');

12const path = require('path');

13const winston = require('winston');

14const { expect }

utils/testRunner.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2/* @copyright Itential, LLC 2019 */

4const execute = require('child_process').exec;

5const fs = require('fs-extra');

6const rl = require(