registry / @nocobase/test / 2.1.15

@nocobase/test@2.1.15

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 1.76 MB of source, external domains: 127.0.0.1, example.com, frightening-antling.info, loremflickr.com

Source & flagged code

4 flagged

perf/scenarios/blog/setup.jsView file

Lines 1-17javascript

1const http = require('k6/http');

2const { check } = require('k6');

4export function setup() {

5 // 在测试开始前执行一次

6 let res = http.post(`${__ENV.TARGET_ORIGIN}/api/auth:signIn`, {

7 account: 'nocobase',

8 password: 'admin123',

Medium

Secret Pattern

Package contains a possible secret pattern.

perf/scenarios/blog/setup.jsView on unpkg · L8

9 });

11 check(res, { 'login succeeded': (r) => r.status === 200 });

13 // 假设返回里有 token

14 let data = res.json('data');

15 return { token: data.token };

16}

client.jsView file

Lines 1-2javascript

1module.exports = require('./lib/client');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

client.jsView on unpkg · L1

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

perf/scenarios/import/setup.jsView file

Lines 1-17javascript

1const http = require('k6/http');

2const { check } = require('k6');

4export function setup() {

5 // 在测试开始前执行一次

6 let res

Source & flagged code

4 flagged · loading source

perf/scenarios/blog/setup.jsView file

8patternName = generic_password severity = medium line = 8 matchedText = password...23',

Medium

Secret Pattern

Package contains a possible secret pattern.

perf/scenarios/blog/setup.jsView on unpkg · L8

client.jsView file

1module.exports = require('./lib/client');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

client.jsView on unpkg · L1

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

perf/scenarios/import/setup.jsView file

8patternName = generic_password severity = medium line = 8 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in perf/scenarios/import/setup.js

perf/scenarios/import/setup.jsView on unpkg · L8

Findings

1 Critical5 Medium3 Low

CriticalManifest Confusionpackage.json

MediumSecret Patternperf/scenarios/blog/setup.js

MediumDynamic Requireclient.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternperf/scenarios/import/setup.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

perf/scenarios/blog/setup.jsView file

Lines 1-17javascript

1const http = require('k6/http');

2const { check } = require('k6');

4export function setup() {

5 // 在测试开始前执行一次

6 let res = http.post(`${__ENV.TARGET_ORIGIN}/api/auth:signIn`, {

7 account: 'nocobase',

8 password: 'admin123',

Medium

Secret Pattern

Package contains a possible secret pattern.

perf/scenarios/blog/setup.jsView on unpkg · L8

9 });

11 check(res, { 'login succeeded': (r) => r.status === 200 });

13 // 假设返回里有 token

14 let data = res.json('data');

15 return { token: data.token };

16}

client.jsView file

Lines 1-2javascript

1module.exports = require('./lib/client');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

client.jsView on unpkg · L1

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

perf/scenarios/import/setup.jsView file

Lines 1-17javascript

1const http = require('k6/http');

2const { check } = require('k6');

4export function setup() {

5 // 在测试开始前执行一次

6 let res