registry / @mountainpass/addressr / 2.6.26

@mountainpass/addressr@2.6.26

Australian Address Validation, Search and Autocomplete

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 181 KB of source, external domains: addressr.io, addressr.p.rapidapi.com, api.addressr.io, data.gov.au, github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 5-60json

5 "author": {

6 "name": "Mountain Pass",

7 "url": "https://mountain-pass.com.au"

8 },

9 "contributors": [

10 "Tom Howard <tom@mountain-pass.com.au>"

11 ],

12 "publishConfig": {

13 "access": "public"

14 },

15 "engines": {

16 "node": ">=22"

17 },

18 "packageManager": "npm@10.9.4",

19 "config": {

20 "localport": "6060",

21 "SEARCH_IMAGE": "opensearchproject/opensearch:2.19.5",

22 "SEARCH_IMAGE_1_3_20": "opensearchproject/opensearch:1.3.20",

23 "SEARCH_IMAGE_2_19": "opensearchproject/opensearch:2.19.5"

24 },

25 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L25

26 "gen-install-cmd": "echo \"#!/bin/sh\n\nnpm install -g ${npm_package_name}@${npm_package_version}\" > install.sh",

27 "deploy:prod": "deploy/deploy.sh",

28 "deploy:test": "deploy/deploy.sh",

29 "turbo:build": "turbo run build",

30 "turbo:ci:version": "turbo run ci:version",

31 "turbo:ci:publish": "turbo run ci:publish",

32 "pull:open-search": "docker pull ${npm_package_config_SEARCH_IMAGE}",

33 "start:open-search": "docker run -p 9200:9200 -p 9300:9300 -e \"ES_JAVA_OPTS=-Xms1g -Xmx1g\" -e \"discovery.type=single-node\" -e \"plugins.security.disabled=true\" -e \"DISABLE_INSTALL_DEMO_CONFIG=true\" \"${npm_package_config_SEARCH_IMAGE}\"",

34 "pull:open-search:1.3.20": "docker pull ${npm_package_config_SEARCH_IMAGE_1_3_20}",

35 "start:open-search:1.3.20": "docker run -p 9200:9200 -p 9300:9300 -e \"ES_JAVA_OPTS=-Xms1g -Xmx1g\" -e \"discovery.type=single-node\" -e \"plugins.security.disabled=true\" -e \"DISABLE_INSTALL_DEMO_CONFIG=true\" \"${npm_package_config_SEARCH_IMAGE_1_3_20}\"",

36 "pull:open-search:2.19": "docker pull ${npm_package_config_SEARCH_IMAGE_2_19}",

37 "start:open-search:2.19": "docker run -p 9200:9200 -p 9300:9300 -e \"ES_JAVA_OPTS=-Xms1g -Xmx1g\" -e \"discovery.type=single-node\" -e \"plugins.security.disabled=true\" -e \"DISABLE_INSTALL_DEMO_CONFIG=true\" \"${npm_package_config_SEARCH_IMAGE_2_19}\"",

38 "hmm": "echo mountainpass-addressr-${npm_package_version}.tgz",

39 "requirements-check": "scripts/check-version.js",

40 "postinstall": "npm run requirements-check",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prestart:loader:babel:OT": "npm run build && cp -r target lib/.",

42 "start:loader:babel:OT": "ES_INDEX_NAME=ot COVERED_STATES=OT DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport node lib/loader.js",

43 "start:loader:packaged:OT": "npm pack && npm install -g mountainpass-addressr-${npm_package_version}.tgz && ES_INDEX_NAME=ot COVERED_STATES=OT addressr-loader",

44 "start:loader:prepackaged": "npm install -g mountainpass-addressr-${npm_package_version}.tgz && addressr-loader",

45 "start:loader:packaged": "npm pack && npm install -g mountainpass-addressr-${npm_package_version}.tgz && addressr-loader",

46 "start:loader:packaged:geo": "npm pack && npm install -g mountainpass-addressr-${npm_package_version}.tgz && ADDRESSR_ENABLE_GEO=1 DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 addressr-loader",

47 "start:loader:OT": "ES_INDEX_NAME=ot COVERED_STATES=OT DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport babel-node loader.js",

48 "start:loader:OT:geo": "ADDRESSR_ENABLE_GEO=1 ES_INDEX_NAME=ot COVERED_STATES=OT DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

49 "start:loader:VIC:geo": "ADDRESSR_ENABLE_GEO=1 ES_INDEX_NAME=ot COVERED_STATES=VIC DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js",

50 "start:loader": "DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport babel-node loader.js",

51 "start:loader:geo": "ADDRESSR_ENABLE_GEO=1 DEBUG=error,api,express:*,swagger-tools*,test,es PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

52 "start:loader:geo:prod": ". .env && PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

53 "start:loader:geo:prod:clear": ". ./.env && ES_CLEAR_INDEX=1 PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

54 "start:loader:geo:ACT:prod": ". ./.env && COVERED_STATES=ACT PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

55 "start:loader:geo:NSW:prod": ". ./.env && COVERED_STATES=NSW PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

56 "start:loader:geo:NT:prod": ". ./.env && COVERED_STATES=NT PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

57 "start:loader:geo:QLD:prod": ". ./.env && COVERED_STATES=QLD PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

58 "start:loader:geo:OT:prod": ". ./.env && COVERED_STATES=OT PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

59 "start:loader:geo:SA:prod": ". ./.env && COVERED_STATES=SA PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

60 "start:loader:geo:TAS:prod": ". ./.env && COVERED_STATES=TAS PORT=$npm_package_config_localport NODE_OPTIONS=--max_old_space_size=8196 babel-node loader.js ",

20160226-eula-open-g-naf.pdfView file

•path = 20160226-eula-open-g-naf.pdf kind = high_entropy_blob sizeBytes = 235236 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

20160226-eula-open-g-naf.pdfView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = npm run requirements-check

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run requirements-check

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

20160226-eula-open-g-naf.pdfView file

•path = 20160226-eula-open-g-naf.pdf kind = high_entropy_blob sizeBytes = 235236 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

20160226-eula-open-g-naf.pdfView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blob20160226-eula-open-g-naf.pdf

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings