registry  /  @malloy-publisher/server  /  0.0.218

@malloy-publisher/server@0.0.218

⚠ Under review

Malloy Publisher Server

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 35 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 220 file(s), 6.42 MB of source, external domains: 127.0.0.1, account.blob.core.windows.net, api.example.com, docs.malloydata.dev, example.com, github.com, mui.com, org.data.example.com, react.dev, s3.custom-endpoint.com, storage.googleapis.com, vega.github.io, www.markdownguide.org, www.w3.org
Oversized source lightweight scan
dist/app/assets/index-DxRKma36.js2.33 MB file, sampled 256 KB
ChildProcessCryptoHighEntropyStringsMinifiedUrlStringsdocs.malloydata.devgithub.com
dist/app/assets/index.umd-o-yUIEtS.js3.25 MB file, sampled 256 KB
ChildProcessHighEntropyStringsUrlStringsvega.github.iowww.w3.org
dist/instrumentation.mjs4.78 MB file, sampled 256 KB
FilesystemEnvironmentVarsHighEntropyStringsUrlStringsgithub.com
dist/server.mjs11.3 MB file, sampled 256 KB
EnvironmentVarsHighEntropyStrings

Source & flagged code

24 flagged · loading source
src/service/connection_config.tsView file
50patternName = private_key_rsa severity = critical line = 50 matchedText = beginMar...--",
Critical
Critical Secret

Package contains a critical-looking secret pattern.

src/service/connection_config.tsView on unpkg · L50
50patternName = private_key_rsa severity = critical line = 50 matchedText = beginMar...--",
Critical
Secret Pattern

RSA private key in src/service/connection_config.ts

src/service/connection_config.tsView on unpkg · L50
56patternName = private_key_rsa severity = critical line = 56 matchedText = beginMar...--",
Critical
Secret Pattern

RSA private key in src/service/connection_config.ts

src/service/connection_config.tsView on unpkg · L56
tests/integration/watch-mode/watch_mode.integration.spec.tsView file
3import { afterAll, beforeAll, describe, expect, it } from "bun:test"; L4: import { type ChildProcess, spawn } from "child_process"; L5: import fs from "fs";
High
Child Process

Package source references child process execution.

tests/integration/watch-mode/watch_mode.integration.spec.tsView on unpkg · L3
123agentMcpPort = await getFreePort(); L124: const baseUrl = `http://127.0.0.1:${port}`; L125: L126: const env: NodeJS.ProcessEnv = { L127: ...process.env, L128: SERVER_ROOT: serverRoot, ... L137: // the server itself. L138: const proc: ChildProcess = spawn("bun", ["src/server.ts"], { L139: cwd: SERVER_DIR,
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

tests/integration/watch-mode/watch_mode.integration.spec.tsView on unpkg · L123
dist/package_load_worker.mjsView file
46var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L47: var __require = /* @__PURE__ */ createRequire(import.meta.url); L48:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/package_load_worker.mjsView on unpkg · L46
dist/app/assets/index--xJ1pzL-.jsView file
432contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},HTe=e=>{switch(e){case"ArrowUp":return 1;case"ArrowDown":return-1;case
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/app/assets/index--xJ1pzL-.jsView on unpkg · L432
dist/cpufeatures-1yrn0vtw.nodeView file
•path = dist/cpufeatures-1yrn0vtw.node kind = native_binary sizeBytes = 60704 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

dist/cpufeatures-1yrn0vtw.nodeView on unpkg
k6-tests/scripts/run-with-otel.shView file
•path = k6-tests/scripts/run-with-otel.sh kind = build_helper sizeBytes = 1779 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

k6-tests/scripts/run-with-otel.shView on unpkg
malloy_mcp.dxtView file
•path = malloy_mcp.dxt kind = compressed_blob sizeBytes = 3891 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

malloy_mcp.dxtView on unpkg
•path = malloy_mcp.dxt kind = nested_archive_needs_inspection sizeBytes = 3891 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

malloy_mcp.dxtView on unpkg
dist/instrumentation.mjsView file
•path = dist/instrumentation.mjs kind = oversized_source_file sizeBytes = 5010880 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/instrumentation.mjsView on unpkg
dist/server.mjsView file
•path = dist/server.mjs kind = oversized_cli_entrypoint sizeBytes = 11850192 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.mjsView on unpkg
src/dto/connection.dto.spec.tsView file
87patternName = private_key_rsa severity = critical line = 87 matchedText = "-----BE...--",
Critical
Secret Pattern

RSA private key in src/dto/connection.dto.spec.ts

src/dto/connection.dto.spec.tsView on unpkg · L87
src/service/connection_service.spec.tsView file
466patternName = generic_password severity = medium line = 466 matchedText = password...ss",
Medium
Secret Pattern

Hardcoded password in src/service/connection_service.spec.ts

src/service/connection_service.spec.tsView on unpkg · L466
504patternName = generic_password severity = medium line = 504 matchedText = password...ss",
Medium
Secret Pattern

Hardcoded password in src/service/connection_service.spec.ts

src/service/connection_service.spec.tsView on unpkg · L504
src/service/connection.spec.tsView file
1445patternName = private_key_rsa severity = critical line = 1445 matchedText = "-----BE...--",
Critical
Secret Pattern

RSA private key in src/service/connection.spec.ts

src/service/connection.spec.tsView on unpkg · L1445
1736patternName = generic_password severity = medium line = 1736 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in src/service/connection.spec.ts

src/service/connection.spec.tsView on unpkg · L1736
src/service/environment_store.spec.tsView file
770patternName = generic_password severity = medium line = 770 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in src/service/environment_store.spec.ts

src/service/environment_store.spec.tsView on unpkg · L770
src/service/connection_config.spec.tsView file
146patternName = private_key_rsa severity = critical line = 146 matchedText = expect(r...-");
Critical
Secret Pattern

RSA private key in src/service/connection_config.spec.ts

src/service/connection_config.spec.tsView on unpkg · L146
152patternName = private_key_rsa severity = critical line = 152 matchedText = expect(r...-");
Critical
Secret Pattern

RSA private key in src/service/connection_config.spec.ts

src/service/connection_config.spec.tsView on unpkg · L152
160patternName = private_key_rsa severity = critical line = 160 matchedText = expect(r...-");
Critical
Secret Pattern

RSA private key in src/service/connection_config.spec.ts

src/service/connection_config.spec.tsView on unpkg · L160
167patternName = private_key_rsa severity = critical line = 167 matchedText = expect(r...ue);
Critical
Secret Pattern

RSA private key in src/service/connection_config.spec.ts

src/service/connection_config.spec.tsView on unpkg · L167
370patternName = private_key_openssh severity = critical line = 370 matchedText = "-----BE...--",
Critical
Secret Pattern

OpenSSH private key in src/service/connection_config.spec.ts

src/service/connection_config.spec.tsView on unpkg · L370

Findings

11 Critical4 High12 Medium8 Low
CriticalCritical Secretsrc/service/connection_config.ts
CriticalTrojan Source Unicodedist/app/assets/index--xJ1pzL-.js
CriticalSecret Patternsrc/dto/connection.dto.spec.ts
CriticalSecret Patternsrc/service/connection_config.ts
CriticalSecret Patternsrc/service/connection_config.ts
CriticalSecret Patternsrc/service/connection.spec.ts
CriticalSecret Patternsrc/service/connection_config.spec.ts
CriticalSecret Patternsrc/service/connection_config.spec.ts
CriticalSecret Patternsrc/service/connection_config.spec.ts
CriticalSecret Patternsrc/service/connection_config.spec.ts
CriticalSecret Patternsrc/service/connection_config.spec.ts
HighChild Processtests/integration/watch-mode/watch_mode.integration.spec.ts
HighShell
HighSame File Env Network Executiontests/integration/watch-mode/watch_mode.integration.spec.ts
HighOversized Source Filedist/instrumentation.mjs
MediumDynamic Requiredist/package_load_worker.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/cpufeatures-1yrn0vtw.node
MediumShips Build Helperk6-tests/scripts/run-with-otel.sh
MediumShips Compressed Blobmalloy_mcp.dxt
MediumOversized Cli Entrypointdist/server.mjs
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/service/connection_service.spec.ts
MediumSecret Patternsrc/service/connection_service.spec.ts
MediumSecret Patternsrc/service/connection.spec.ts
MediumSecret Patternsrc/service/environment_store.spec.ts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNested Archive Needs Inspectionmalloy_mcp.dxt
LowNo License