Loading npm security reports…

@lightdash/common@0.3411.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @lightdash/common / 0.3411.0

@lightdash/common@0.3411.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,614 file(s), 11.2 MB of source, external domains: anything.bad-example.com, api.githubcopilot.com, app.example.com, app.lightdash.cloud, attacker.invalid, docs.lightdash.com, evil.example.com, example.com, github.com, google.com, json-schema.org, malicious.com, placehold.co, registry.npmjs.org, schemas.getdbt.com, schemas.lightdash.com, www.lightdash.com, www.w3.org

Source & flagged code

13 flagged

dist/types/index.jsView file

Lines 280-376javascript

280}

281// Seeds

282export const SEED_ORG_1 = {

283 organization_uuid: '172a2270-000f-42be-9c68-c4752c23ae51',

284 organization_name: 'Jaffle Shop',

285};

286export const SEED_ORG_1_ADMIN = {

287 user_uuid: 'b264d83a-9000-426a-85ec-3f9c20f368ce',

288 first_name: 'David',

289 last_name: 'Attenborough',

290 is_marketing_opted_in: true,

291 is_tracking_anonymized: false,

292 is_setup_complete: true,

293 is_active: true,

294};

295export const SEED_ORG_1_ADMIN_EMAIL = {

296 email: 'demo@lightdash.com',

297 is_primary: true,

298};

299export const SEED_ORG_1_ADMIN_PASSWORD = {

300 password: 'demo_password!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/types/index.jsView on unpkg · L300

301};

302export const SEED_ORG_1_ADMIN_ROLE = OrganizationMemberRole.ADMIN;

303export const SEED_ORG_1_EDITOR = {

304 user_uuid: '80fb8b59-d6b7-4ed6-b969-9849310f3e53',

305 first_name: 'Editor',

306 last_name: 'User',

307 is_marketing_opted_in: true,

308 is_tracking_anonymized: false,

309 is_setup_complete: true,

310 is_active: true,

311};

312export const SEED_ORG_1_EDITOR_EMAIL = {

313 email: 'demo2@lightdash.com',

314 is_primary: true,

315};

316export const SEED_ORG_1_EDITOR_PASSWORD = {

317 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L317

318};

319export const SEED_ORG_1_EDITOR_ROLE = OrganizationMemberRole.EDITOR;

320export const SEED_ORG_1_VIEWER = {

321 user_uuid: 'e0dd2003-c291-4e14-b977-7a03b7edc842',

322 first_name: 'Viewer',

323 last_name: 'User',

324 is_marketing_opted_in: true,

325 is_tracking_anonymized: false,

326 is_setup_complete: true,

327 is_active: true,

328};

329export const SEED_ORG_1_VIEWER_EMAIL = {

330 email: 'demo3@lightdash.com',

331 is_primary: true,

332};

333export const SEED_ORG_1_VIEWER_PASSWORD = {

334 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L334

335};

336export const SEED_ORG_1_VIEWER_ROLE = OrganizationMemberRole.VIEWER;

337// Another user

338export const SEED_ORG_2 = {

339 organization_uuid: '42339eef-359e-4ec4-b810-54ef0b4e3446',

340 organization_name: 'Another Shop',

341};

342export const SEED_ORG_2_ADMIN = {

343 user_uuid: '57cd4548-cbe3-42b3-aa13-97821713e307',

344 first_name: 'Another',

345 last_name: 'User',

346 is_marketing_opted_in: true,

347 is_tracking_anonymized: false,

348 is_setup_complete: true,

349 is_active: true,

350};

351export const SEED_ORG_2_ADMIN_EMAIL = {

352 email: 'another@lightdash.com',

353 is_primary: true,

354};

355export const SEED_ORG_2_ADMIN_PASSWORD = {

356 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L356

357};

358export const SEED_ORG_2_ADMIN_ROLE = OrganizationMemberRole.ADMIN;

359export const SEED_EMBED_SECRET = 'zU3h50saDOO20czNFNRok';

360// Deterministic PAT for dev environment

361// Use with: Authorization: ApiKey ldpat_deadbeefdeadbeefdeadbeefdeadbeef

362export const SEED_PAT = {

363 token: 'ldpat_deadbeefdeadbeefdeadbeefdeadbeef',

364 description: 'Dev seed PAT',

365};

366export const SEED_PROJECT = {

367 project_uuid: '3675b69e-8324-4110-bdca-059031aa8da3',

368 name: 'Jaffle shop',

369 project_type: ProjectType.DEFAULT,

370 dbt_connection_type: DbtProjectType.DBT,

371 dbt_connection: null,

372 copied_from_project_uuid: null,

373 organization_warehouse_credentials_uuid: null,

374};

375export const SEED_SPACE = {

376 name: SEED_PROJECT.name,

dist/types/dbt/validation.csp.test.jsView file

Lines 8-33javascript

8 * property directly: importing the module must not generate code at all.

9 */

10describe('CSP: dbt/validation must not generate code at import (#21276)', () => {

dist/esm/index.jsView file

Lines 280-354javascript

280}

281// Seeds

282export const SEED_ORG_1 = {

283 organization_uuid: '172a2270-000f-42be-9c68-c4752c23ae51',

284 organization_name: 'Jaffle Shop',

285};

286export

dist/cjs/index.jsView file

367patternName = generic_password severity = medium line = 367 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L367

384patternName = generic_password severity = medium line = 384 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L384

401patternName = generic_password severity = medium line = 401 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L401

423patternName = generic_password severity = medium line = 423 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L423

Source & flagged code

13 flagged · loading source

dist/types/index.jsView file

300patternName = generic_password severity = medium line = 300 matchedText = password...d!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/types/index.jsView on unpkg · L300

317patternName = generic_password severity = medium line = 317 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L317

334patternName = generic_password severity = medium line = 334 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L334

356patternName = generic_password severity = medium line = 356 matchedText = password...d!',

Medium

Findings

14 Medium4 Low

MediumSecret Patterndist/types/index.js

MediumDynamic Requiredist/types/dbt/validation.csp.test.js

MediumEnvironment Vars

MediumSecret Patterndist/types/index.js

MediumSecret Patterndist/esm/index.js

MediumSecret Patterndist/cjs/index.js

Source & flagged code

13 flagged

dist/types/index.jsView file

Lines 280-376javascript

280}

281// Seeds

282export const SEED_ORG_1 = {

283 organization_uuid: '172a2270-000f-42be-9c68-c4752c23ae51',

284 organization_name: 'Jaffle Shop',

285};

286export const SEED_ORG_1_ADMIN = {

287 user_uuid: 'b264d83a-9000-426a-85ec-3f9c20f368ce',

288 first_name: 'David',

289 last_name: 'Attenborough',

290 is_marketing_opted_in: true,

291 is_tracking_anonymized: false,

292 is_setup_complete: true,

293 is_active: true,

294};

295export const SEED_ORG_1_ADMIN_EMAIL = {

296 email: 'demo@lightdash.com',

297 is_primary: true,

298};

299export const SEED_ORG_1_ADMIN_PASSWORD = {

300 password: 'demo_password!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/types/index.jsView on unpkg · L300

301};

302export const SEED_ORG_1_ADMIN_ROLE = OrganizationMemberRole.ADMIN;

303export const SEED_ORG_1_EDITOR = {

304 user_uuid: '80fb8b59-d6b7-4ed6-b969-9849310f3e53',

305 first_name: 'Editor',

306 last_name: 'User',

307 is_marketing_opted_in: true,

308 is_tracking_anonymized: false,

309 is_setup_complete: true,

310 is_active: true,

311};

312export const SEED_ORG_1_EDITOR_EMAIL = {

313 email: 'demo2@lightdash.com',

314 is_primary: true,

315};

316export const SEED_ORG_1_EDITOR_PASSWORD = {

317 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L317

318};

319export const SEED_ORG_1_EDITOR_ROLE = OrganizationMemberRole.EDITOR;

320export const SEED_ORG_1_VIEWER = {

321 user_uuid: 'e0dd2003-c291-4e14-b977-7a03b7edc842',

322 first_name: 'Viewer',

323 last_name: 'User',

324 is_marketing_opted_in: true,

325 is_tracking_anonymized: false,

326 is_setup_complete: true,

327 is_active: true,

328};

329export const SEED_ORG_1_VIEWER_EMAIL = {

330 email: 'demo3@lightdash.com',

331 is_primary: true,

332};

333export const SEED_ORG_1_VIEWER_PASSWORD = {

334 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L334

335};

336export const SEED_ORG_1_VIEWER_ROLE = OrganizationMemberRole.VIEWER;

337// Another user

338export const SEED_ORG_2 = {

339 organization_uuid: '42339eef-359e-4ec4-b810-54ef0b4e3446',

340 organization_name: 'Another Shop',

341};

342export const SEED_ORG_2_ADMIN = {

343 user_uuid: '57cd4548-cbe3-42b3-aa13-97821713e307',

344 first_name: 'Another',

345 last_name: 'User',

346 is_marketing_opted_in: true,

347 is_tracking_anonymized: false,

348 is_setup_complete: true,

349 is_active: true,

350};

351export const SEED_ORG_2_ADMIN_EMAIL = {

352 email: 'another@lightdash.com',

353 is_primary: true,

354};

355export const SEED_ORG_2_ADMIN_PASSWORD = {

356 password: 'demo_password!',

Medium

Secret Pattern

Hardcoded password in dist/types/index.js

dist/types/index.jsView on unpkg · L356

357};

358export const SEED_ORG_2_ADMIN_ROLE = OrganizationMemberRole.ADMIN;

359export const SEED_EMBED_SECRET = 'zU3h50saDOO20czNFNRok';

360// Deterministic PAT for dev environment

361// Use with: Authorization: ApiKey ldpat_deadbeefdeadbeefdeadbeefdeadbeef

362export const SEED_PAT = {

363 token: 'ldpat_deadbeefdeadbeefdeadbeefdeadbeef',

364 description: 'Dev seed PAT',

365};

366export const SEED_PROJECT = {

367 project_uuid: '3675b69e-8324-4110-bdca-059031aa8da3',

368 name: 'Jaffle shop',

369 project_type: ProjectType.DEFAULT,

370 dbt_connection_type: DbtProjectType.DBT,

371 dbt_connection: null,

372 copied_from_project_uuid: null,

373 organization_warehouse_credentials_uuid: null,

374};

375export const SEED_SPACE = {

376 name: SEED_PROJECT.name,

dist/types/dbt/validation.csp.test.jsView file

Lines 8-33javascript

8 * property directly: importing the module must not generate code at all.

9 */

10describe('CSP: dbt/validation must not generate code at import (#21276)', () => {

dist/esm/index.jsView file

Lines 280-354javascript

280}

281// Seeds

282export const SEED_ORG_1 = {

283 organization_uuid: '172a2270-000f-42be-9c68-c4752c23ae51',

284 organization_name: 'Jaffle Shop',

285};

286export

dist/cjs/index.jsView file

367patternName = generic_password severity = medium line = 367 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L367

384patternName = generic_password severity = medium line = 384 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L384

401patternName = generic_password severity = medium line = 401 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L401

423patternName = generic_password severity = medium line = 423 matchedText = password...d!',

Medium

Secret Pattern

Hardcoded password in dist/cjs/index.js

dist/cjs/index.jsView on unpkg · L423