registry / @krvinay/express_api / 2.2.0

@krvinay/express_api@2.2.0

Node API Application server

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 144 KB of source, external domains: db.test.in, expressjs.com, github.com, sequelize.org, www.npmjs.com, www.w3.org

Source & flagged code

5 flagged

install/constants.jsView file

Lines 201-241javascript

201 console.log('mysql_error', err.stack);

202 } else if (err) {

203 console.log('error', err.stack);

204 }

205 };

206

207

208 /**

209 * Alias for threaded or asynchronous logging use cases

210 */

211 req.thread_response_logger = req.response_logger;

212};

213`;

214

215const database = `/** ===Define Database Connections=== */

216module.exports = {

217 default: {

218 /** Connection credentials */

219 host: 'localhost',

220 username: 'database_user',

221 password: 'password',

Medium

Secret Pattern

Package contains a possible secret pattern.

install/constants.jsView on unpkg · L221

222 database: 'database_name',

223

224 /** Optional proxy database configuration */

225 // token: '<authentication token of proxy database server>',

226 // host: '<proxy host URI>', // Example: https://db.test.in

227

228 connectTimeout: 60 * 1000,

229 pool: { min: 2, max: 20, idle: 30000, acquire: 30000, evict: 1000 },

230 logging: mysql_log

231 }

232};

233

234/** === MySQL Logger === */

235function mysql_log(sql, benchmark) {

236 console.log('sql', \`\${benchmark}::\${sql}\`);

237}`;

238

239const hi = `module.exports = {

240 notFoundMessage: \`ए पी आई "?" नहीं मिला।\`,

241 MYSQL_ERROR: \`हमें कुछ तकनीकी कठिनाइयों का सामना करना पड़ रहा है, कृपया बाद में प्रयास करें।\`,

util.jsView file

Lines 1-13javascript

1/*!

2 * express api

4 * MIT Licensed

5 */

7'use strict';

9/**

10 * Expose `util`.

11 */

12exports

lib/util/index.jsView file

Lines 321-361javascript

321 }

322 }

323 if (all) {

324 roots = [{

325 id: 0,

326 parent_id: -1,

327 name: 'All',

lib/database/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/database/index.js#virtual:normalized:round1View on unpkg

install/constants-ts.jsView file

Lines 126-166javascript

126 if (err && err.name && err.name.includes("Sequelize")) {

127 console.log('mysql_error', err.stack);

128 } else if (err) {

129 console.log

Source & flagged code

5 flagged · loading source

install/constants.jsView file

221patternName = generic_password severity = medium line = 221

Medium

Secret Pattern

Package contains a possible secret pattern.

install/constants.jsView on unpkg · L221

util.jsView file

11*/ L12: exports = module.exports = require("./lib/util");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

util.jsView on unpkg · L11

lib/util/index.jsView file

341hash.update((str || '').toString()); L342: hash.end(); L343: return hash.read().toString('hex');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

Findings

1 High5 Medium5 Low

HighSemantic Analysis Limitedlib/database/index.js#virtual:normalized:round1

MediumSecret Patterninstall/constants.js

MediumDynamic Requireutil.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterninstall/constants-ts.js

LowScripts Present

LowWeak Cryptolib/util/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @krvinay/express_api@2.2.0.

See all versions of @krvinay/express_api for other recorded verdicts.

Review the evidence and your use of @krvinay/express_api@2.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 00:12:42.054Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.