registry / @lukoweb/apitogo / 0.1.59

@lukoweb/apitogo@0.1.59

Framework for building high quality, interactive API documentation.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 458 file(s), 1.64 MB of source, external domains: api.example.com, api.github.com, api.zuploedge.com, apitogo.com, app.posthog.com, cdn.jsdelivr.net, cdn.simpleicons.org, cdn.zudoku.dev, chatgpt.com, claude.ai, code.visualstudio.com, deploy-server-dotnet2-b3fkcaaraydbckfe.canadacentral-01.azurewebsites.net, docs.apitogo.com, docs.cursor.com, docs.mcp.run, dp-example.azurecontainerapps.io, example.com, fonts.googleapis.com, github.com, help.openai.com, httpproblems.com, llmstxt.org, lucide.dev, modelcontextprotocol.io, securetoken.google.com, swagger.io, test.local, ui.shadcn.com, www.example.com, www.w3.org, zudoku.dev, zuplo.com

Source & flagged code

9 flagged

dist/cli/cli.jsView file

Lines 1-37javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/cli/common/package-json.ts

12import { readFileSync } from "node:fs";

13import path from "node:path";

14import { fileURLToPath } from "node:url";

15var getPackageJsonPath, getPackageJson, getZudokuPackageJson, getZudokuRootDir;

16var init_package_json = __esm({

17 "src/cli/common/package-json.ts"() {

18 getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll(

19 path.sep,

20 path.posix.sep

21 );

22 getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8"));

23 getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo"));

24 getZudokuRootDir = () => path.dirname(getPackageJsonPath("@lukoweb/apitogo"));

25 }

26});

28// src/cli/common/logger.ts

29import { createLogger } from "vite";

30var logger, loggerError, isExpectedWarning, wrapWarnFilter;

31var init_logger = __esm({

32 "src/cli/common/logger.ts"() {

33 logger = createLogger(

34 process.env.LOG_LEVEL ?? "info",

35 {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

36 prefix: "apitogo"

37 }

Lines 8575-8629javascript

8575 data: { _mdxExplicitJsx: true }

8576 });

8577 continue;

8578 }

8579 if (child.type === "paragraph" && child.children.every((c) => c.type === "text" && !c.value.trim

Lines 10086-10126javascript

10086 logger.error("\u274C Build failed");

10087 logger.error(message);

10088 process.exit(1);

10089 }

10090 if (argv.preview) {

10091 await preview({

10092 dir: argv.dir,

10093 port: typeof argv.preview ===

•matchType = previous_version_dangerous_delta matchedPackage = @lukoweb/apitogo@0.1.48 matchedIdentity = npm:QGx1a293ZWIvYXBpdG9nbw:0.1.48 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/cli.jsView on unpkg

dist/cli/worker.jsView file

Lines 97-137javascript

97 }

98 return val;

99};

100

101// src/config/validators/ProtectedRoutesSchema.ts

102var ProtectedRoutesInputSchema = z.optional(

103 z.union([

104 z.array(z.string()),

105 z.record(

dist/declarations/config/validators/ZudokuConfig.d.tsView file

Lines 295-335typescript

295 clerkPubKey: z.ZodCustom<`pk_test_${string}` | `pk_live_${string}`, `pk_test_${string}` | `pk_live_${string}`>;

296 jwtTemplateName: z.ZodDefault<z.ZodOptional<z.ZodString>>;

Source & flagged code

9 flagged · loading source

dist/cli/cli.jsView file

8595// src/vite/mdx/remark-last-modified.ts L8596: import { spawnSync } from "node:child_process"; L8597: import { stat as stat3 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/cli/cli.jsView on unpkg · L8595

10106native: "%windir%\\System32", L10107: mixed: "%windir%\\sysnative\\cmd.exe /c %windir%\\System32" L10108: };

High

Shell

Package source references shell execution.

dist/cli/cli.jsView on unpkg · L10106

8609if (!checkGitAvailable()) return false; L8610: const result = spawnSync("git", ["rev-parse", "--is-shallow-repository"], { L8611: encoding: "utf-8", ... L8618: hasWarnedShallowClone = true; L8619: if (process.env.VERCEL) { L8620: console.warn( ... L8624: console.warn( L8625: "The repository is shallow cloned, so the latest modified time may not be accurate. See https://github.com/actions/checkout#fetch-all-history-for-all-tags-and-branches to fetch all... L8626: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/cli.jsView on unpkg · L8609

17"src/cli/common/package-json.ts"() { L18: getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll( L19: path.sep, ... L21: ); L22: getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8")); L23: getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo")); ... L33: logger = createLogger( L34: process.env.LOG_LEVEL ?? "info", L35: { ... L584: import path2 from "node:path"; L585: function loadApitogoConfig(rootDir = process.cwd()) { L586: const configPath = path2.join(path2.resolve(rootDir), APITOGO_CONFIG_FILENAME);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/cli.jsView on unpkg

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

dist/cli/worker.jsView file

117var { template, distDir, serverConfigPath, entryServerPath, writeRedirects } = Piscina.workerData; L118: var server = await import(entryServerPath); L119: var rawConfig = await import(serverConfigPath).then(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/worker.jsView on unpkg · L117

dist/declarations/config/validators/ZudokuConfig.d.tsView file

315patternName = generic_password severity = medium line = 315 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/declarations/config/validators/ZudokuConfig.d.ts

dist/declarations/config/validators/ZudokuConfig.d.tsView on unpkg · L315

6736patternName = generic_password severity = medium line = 6736 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/declarations/config/validators/ZudokuConfig.d.ts

dist/declarations/config/validators/ZudokuConfig.d.tsView on unpkg · L6736

Findings

5 High7 Medium6 Low

HighChild Processdist/cli/cli.js

HighShelldist/cli/cli.js

HighSame File Env Network Executiondist/cli/cli.js

HighSandbox Evasion Gated Capabilitydist/cli/cli.js

HighPrevious Version Dangerous Deltadist/cli/cli.js

MediumDynamic Requiredist/cli/worker.js

MediumUnsafe Vm Contextdist/cli/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/declarations/config/validators/ZudokuConfig.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

dist/cli/cli.jsView file

Lines 1-37javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/cli/common/package-json.ts

12import { readFileSync } from "node:fs";

13import path from "node:path";

14import { fileURLToPath } from "node:url";

15var getPackageJsonPath, getPackageJson, getZudokuPackageJson, getZudokuRootDir;

16var init_package_json = __esm({

17 "src/cli/common/package-json.ts"() {

18 getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll(

19 path.sep,

20 path.posix.sep

21 );

22 getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8"));

23 getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo"));

24 getZudokuRootDir = () => path.dirname(getPackageJsonPath("@lukoweb/apitogo"));

25 }

26});

28// src/cli/common/logger.ts

29import { createLogger } from "vite";

30var logger, loggerError, isExpectedWarning, wrapWarnFilter;

31var init_logger = __esm({

32 "src/cli/common/logger.ts"() {

33 logger = createLogger(

34 process.env.LOG_LEVEL ?? "info",

35 {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

36 prefix: "apitogo"

37 }

Lines 8575-8629javascript

8575 data: { _mdxExplicitJsx: true }

8576 });

8577 continue;

8578 }

8579 if (child.type === "paragraph" && child.children.every((c) => c.type === "text" && !c.value.trim

Lines 10086-10126javascript

10086 logger.error("\u274C Build failed");

10087 logger.error(message);

10088 process.exit(1);

10089 }

10090 if (argv.preview) {

10091 await preview({

10092 dir: argv.dir,

10093 port: typeof argv.preview ===

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/cli.jsView on unpkg

dist/cli/worker.jsView file

Lines 97-137javascript

97 }

98 return val;

99};

100

101// src/config/validators/ProtectedRoutesSchema.ts

102var ProtectedRoutesInputSchema = z.optional(

103 z.union([

104 z.array(z.string()),

105 z.record(

dist/declarations/config/validators/ZudokuConfig.d.tsView file

Lines 295-335typescript

295 clerkPubKey: z.ZodCustom<`pk_test_${string}` | `pk_live_${string}`, `pk_test_${string}` | `pk_live_${string}`>;

296 jwtTemplateName: z.ZodDefault<z.ZodOptional<z.ZodString>>;