registry / @madgex/fert / 7.6.2

@madgex/fert@7.6.2

Tool to help build the V6 branding

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependencyNoLicense

scanned 60 file(s), 136 KB of source, external domains: asset-relay.job.madgexhosting.net, asset-store-api.job.madgexhosting.net, asset-store.job.madgexhosting.net, fonts.googleapis.com, github.com, property-identification-api.cs.madgexhosting.net

Source & flagged code

2 flagged

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView file

Lines 29-69javascript

29 return undefined;

30 },

31 load(id) {

32 // replace string with empty const, we don't need/want `ServerRender`, we just want `default.args` object

33 if (id === '\0server-render-stub') return 'export const ServerRender = null;';

34 return undefined;

35 },

36 },

37 ],

38 build: {

39 lib: { entry: storyFile, formats: ['cjs'] },

40 write: false,

41 rollupOptions: { output: { sourcemap: false, manualChunks: undefined } }, // all in 1 "file" output

42 },

43 logLevel: 'silent',

44 });

46 /** Evaluate the CJS bundle to extract the default export's args */

47 const code = response[0].output[0].code;

48 const moduleExports = {};

49 const moduleObj = { exports: moduleExports };

50 new Function('exports', 'module', code)(moduleExports, moduleObj);

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView on unpkg · L49

52 const args = moduleObj.exports.default.args;

54 args.serviceName = result.service.serviceConfig.serviceName;

55 args.locale = 'en';

57 const rootDir = path.resolve(result.service.dir, 'templates');

58 const relEntryFilePath = path.relative(themeDir, entryFilePath);

59 const argsJson = JSON.stringify(args, null, 4);

60 fs.writeFileSync(

61 path.join(rootDir, `${type}.njk`),

62 `{% set params = ${argsJson} %}

64{% include templatePath + './custom-${type}/${relEntryFilePath}'%}

65`,

66 { encoding: 'utf-8' },

67 );

68}

bin/utils/index.jsView file

Lines 131-171javascript

131 const dir = path.resolve(rootDir, path.dirname(filePath));

132 const serviceConfig = await loadConfigFromFile({

133 dir,

134 filename: FERT_SERVICE_CONFIG_FILENAME,

135 });

136 serviceConfigs.push

Source & flagged code

2 flagged · loading source

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView file

49const moduleObj = { exports: moduleExports }; L50: new Function('exports', 'module', code)(moduleExports, moduleObj); L51:

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView on unpkg · L49

bin/utils/index.jsView file

151try { L152: const { default: fertConfig } = await import(pathToFileURL(configPath)); L153:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/utils/index.jsView on unpkg · L151

Findings

5 Medium7 Low

MediumDynamic Requirebin/utils/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbin/commands/init-template-tasks/generate-entry-nunjucks-file.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView file

Lines 29-69javascript

29 return undefined;

30 },

31 load(id) {

32 // replace string with empty const, we don't need/want `ServerRender`, we just want `default.args` object

33 if (id === '\0server-render-stub') return 'export const ServerRender = null;';

34 return undefined;

35 },

36 },

37 ],

38 build: {

39 lib: { entry: storyFile, formats: ['cjs'] },

40 write: false,

41 rollupOptions: { output: { sourcemap: false, manualChunks: undefined } }, // all in 1 "file" output

42 },

43 logLevel: 'silent',

44 });

46 /** Evaluate the CJS bundle to extract the default export's args */

47 const code = response[0].output[0].code;

48 const moduleExports = {};

49 const moduleObj = { exports: moduleExports };

50 new Function('exports', 'module', code)(moduleExports, moduleObj);

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/commands/init-template-tasks/generate-entry-nunjucks-file.jsView on unpkg · L49

52 const args = moduleObj.exports.default.args;

54 args.serviceName = result.service.serviceConfig.serviceName;

55 args.locale = 'en';

57 const rootDir = path.resolve(result.service.dir, 'templates');

58 const relEntryFilePath = path.relative(themeDir, entryFilePath);

59 const argsJson = JSON.stringify(args, null, 4);

60 fs.writeFileSync(

61 path.join(rootDir, `${type}.njk`),

62 `{% set params = ${argsJson} %}

64{% include templatePath + './custom-${type}/${relEntryFilePath}'%}

65`,

66 { encoding: 'utf-8' },

67 );

68}

bin/utils/index.jsView file

Lines 131-171javascript

131 const dir = path.resolve(rootDir, path.dirname(filePath));

132 const serviceConfig = await loadConfigFromFile({

133 dir,

134 filename: FERT_SERVICE_CONFIG_FILENAME,

135 });

136 serviceConfigs.push