registry / @mohasinac/appkit / 3.1.2

@mohasinac/appkit@3.1.2

Internal component library and server toolkit for the LetItRip collectibles marketplace.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,999 file(s), 7.42 MB of source, external domains: accounts.google.com, adnetwork.example, api.razorpay.com, api.twilio.com, apiv2.shiprocket.in, beyblade.takaratomy.co.jp, brand.com, cdn.example-ads.com, chat.whatsapp.com, en.bushiroad.com, example.com, facebook.com, github.com, graph.facebook.com, images.unsplash.com, images.ygoprodeck.com, img.youtube.com, instagram.com, kaibacorp.jp, kaiyodo.co.jp, letitrip.in, linkedin.com, maps.google.com, maps.googleapis.com, mcfarlane.com, open.tiktokapis.com, picsum.photos, pinterest.com, pokemonpalace.in, schema.org, search.google.com, shiprocket.co, storage.googleapis.com, tamashiinations.com, tokyotoys.in, twitter.com, upload.wikimedia.org, wa.me, www.bandai.co.jp, www.bandaispirits.co.jp, www.beckett.com, www.deviantart.com, www.facebook.com, www.funko.com, www.goodsmile.info, www.hasbro.com, www.instagram.com, www.konami.com, www.kotobukiya.co.jp, www.letitrip.in

Source & flagged code

5 flagged

package.jsonView file

Lines 128-168json

128 "scripts/dedupe-peer-deps.mjs",

129 "scripts/copy-assets.mjs",

130 "scripts/bundle-css.mjs"

131 ],

132 "bin": {

133 "appkit-sieve-audit": "./scripts/sieve-audit.mjs",

134 "appkit-audit": "./scripts/audit-violations.mjs",

135 "appkit-verify-entries": "./scripts/verify-entries.mjs",

136 "appkit-verify-css": "./scripts/verify-css-build.mjs",

137 "appkit-smoke-ssr": "./scripts/smoke-ssr.mjs",

138 "appkit-smoke-bundle": "./scripts/smoke-bundle.mjs",

139 "appkit-smoke-theme": "./scripts/smoke-theme.mjs",

140 "appkit-init-config": "./scripts/init-config.mjs",

141 "appkit-labels-extract": "./scripts/labels-extract.mjs",

142 "appkit-seed": "./scripts/seed-cli.mjs",

143 "appkit-seed-add": "./scripts/seed-cli.mjs",

144 "appkit-seed-remove": "./scripts/seed-cli.mjs",

145 "appkit-seed-status": "./scripts/seed-cli.mjs"

146 },

147 "scripts": {

148 "postinstall": "node scripts/dedupe-peer-deps.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L148

149 "build": "node scripts/dedupe-peer-deps.mjs && node -e \"const fs=require('fs');try{fs.rmSync('tsconfig.build.tsbuildinfo')}catch(e){}\" && tsc -p tsconfig.build.json && node scripts/copy-assets.mjs && tailwindcss -i src/tailwind-input.css -o dist/tailwind-utilities.css --minify && node scripts/bundle-css.mjs && node scripts/verify-css-build.mjs",

150 "prepublishOnly": "npm run build",

151 "watch": "concurrently --kill-others --restart-tries 0 --names \"ts,css\" \"tsc -p tsconfig.build.json --watch\" \"npm run watch:css\"",

152 "watch:css": "tailwindcss -i src/tailwind-input.css -o dist/tailwind-utilities.css --watch",

153 "audit": "node scripts/audit-violations.mjs",

154 "audit:listing-indices": "node scripts/audit-listing-indices.mjs",

155 "audit:listing-type-reads": "node scripts/audit-listing-type-reads.mjs",

156 "audit:create-with-id": "node scripts/audit-create-with-id.mjs",

157 "audit:css-imports": "node scripts/audit-css-imports.mjs",

158 "audit:appkit-reexports": "node scripts/audit-appkit-reexports.mjs",

159 "audit:action-confirmation": "node scripts/audit-action-confirmation.mjs",

160 "audit:route-strings": "node scripts/audit-route-strings.mjs",

161 "audit:paginated-select": "node scripts/audit-paginated-select.mjs",

162 "audit:sieve-views": "node scripts/audit-sieve-constants-views.mjs",

163 "check:types": "tsc -p tsconfig.build.json --noEmit",

164 "check:audits": "node scripts/audit-violations.mjs && node scripts/verify-entries.mjs && node scripts/verify-css-build.mjs && node scripts/audit-use-client.mjs && node scripts/audit-double-navigation.mjs && node scripts/audit-repository-fields.mjs && node scripts/audit-query-provider.mjs && node scripts/audit-export-paths.mjs && node scripts/audit-listing-indices.mjs && node scripts/audit-listing-type-reads.mjs && node scripts/audit-create-with-id.mjs && node scripts/audit-css-imports.mjs && node scripts/audit-appkit-reexports.mjs && node scripts/audit-action-confirmation.mjs && node scrip ...

165 "test": "vitest run --passWithNoTests",

166 "test:watch": "vitest",

167 "check": "npm run check:types && npm run check:audits"

168 },

Long lines were clipped for display.

dist/features/auth/auth-helpers.jsView file

Lines 6-46javascript

6 moderator: 2,

7 admin: 3,

8};

9export function hasRole(userRole, requiredRole) {

10 return ROLE_HIERARCHY[userRole] >= ROLE_HIERARCHY[requiredRole];

dist/cli/index.jsView file

Lines 96-136javascript

96 blog: "blog",

97 reviews: "reviews",

98 faq: "faq",

99 search: "search",

100 homepage: "home",

101 admin: "admin",

dist/security/settings-encryption.jsView file

Lines 1-21javascript

1// crypto is a Node.js built-in. Use require() to keep it out of the static

2// import graph so Next.js Edge bundler does not warn about this file.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/security/settings-encryption.jsView on unpkg · L1

3function nodeCrypto() { return require("crypto"); }

4const ALGORITHM = "aes-256-gcm";

5const

scripts/seed-cli.mjsView file

Lines 417-457javascript

417 } catch (e) { if (e?.code !== "auth/user-not-found") throw e; }

418 }

419}

420

421async function loadUsers(seed, stats) {

422 for (const u

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/dedupe-peer-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/features/auth/auth-helpers.jsView file

26patternName = generic_password severity = medium line = 26 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/features/auth/auth-helpers.jsView on unpkg · L26

dist/cli/index.jsView file

116// Opaque dynamic import — prevents bundlers from statically analysing the path L117: const _dynamicImport = new Function("modulePath", "return import(modulePath)"); L118: function deepMerge(a, b) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/index.jsView on unpkg · L116

dist/security/settings-encryption.jsView file

1// crypto is a Node.js built-in. Use require() to keep it out of the static L2: // import graph so Next.js Edge bundler does not warn about this file.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/security/settings-encryption.jsView on unpkg · L1

scripts/seed-cli.mjsView file

437patternName = generic_password severity = medium line = 437 matchedText = await au... });

Medium

Secret Pattern

Hardcoded password in scripts/seed-cli.mjs

scripts/seed-cli.mjsView on unpkg · L437

Findings

1 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumSecret Patterndist/features/auth/auth-helpers.js

MediumDynamic Requiredist/security/settings-encryption.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternscripts/seed-cli.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli/index.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings