registry / @nodeweaver/loom / 0.1.6

@nodeweaver/loom@0.1.6

Loom — declarative NestJS admin: resources, RBAC, tenancy, media, and JSON API (Handlebars + Tailwind + Alpine).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 5.12 MB of source, external domains: alpinejs.dev, cdn.redoc.ly, redoc.ly, redocly.com, stackoverflow.com, www.w3.org

Source & flagged code

7 flagged

dist/assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/assets/redoc/redoc.standalone.jsView on unpkg · L2

dist/core/relations.jsView file

Lines 5-45javascript

5exports.isMultiRelation = isMultiRelation;

6exports.isRelationConfig = isRelationConfig;

7exports.relationConfigForField = relationConfigForField;

8exports.relationConfigForColumn = relationConfigForColumn;

9exports.relationFields = relationFields;

10exports.many2OneFields = many2OneFields;

11exports.multiRelationFields = multiRelationFields;

12exports.relationColumns = relationColumns;

13exports.many2OneColumns = many2OneColumns;

14exports.relationForeignKey = relationForeignKey;

15exports.relationIdsFromValue = relationIdsFromValue;

16exports.relationLabel = relationLabel;

17exports.searchRelationOptions = searchRelationOptions;

18exports.relationQuickCreate = relationQuickCreate;

19exports.relationRecordSummary = relationRecordSummary;

20exports.buildRelationFieldContexts = buildRelationFieldContexts;

21exports.buildRelationOptions = buildRelationOptions;

22exports.shouldPreloadRelation = shouldPreloadRelation;

23exports.buildRelationOptionsForForm = buildRelationOptionsForForm;

24exports.buildRelationLabelMap = buildRelationLabelMap;

25exports.getByPath = getByPath;

26const display_name_js_1 = require("./display-name.js");

27const deprecation_js_1 = require("./deprecation.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/relations.jsView on unpkg · L25

28const adapter_js_1 = require("../adapters/adapter.js");

29const RELATION_OPTIONS_LIMIT = 250;

30const RELATION_SEARCH_LIMIT = 15;

31function isMany2OneRelation(relation) {

32 return relation?.kind === 'many2one';

33}

34function isMultiRelation(relation) {

35 return relation?.kind === 'many2many' || relation?.kind === 'one2many';

36}

37function isRelationConfig(relation) {

38 return Boolean(relation?.kind && relation.resource);

39}

40function relationConfigForField(field) {

41 return isRelationConfig(field.relation) ? field.relation : undefined;

42}

43function relationConfigForColumn(meta, column) {

44 if (isRelationConfig(column.relation) && column.relation.resource) {

45 return column.relation;

dist/assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in dist/assets/swagger-ui/swagger-ui-bundle.js

dist/assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

README.mdView file

Lines 73-113markdown

73import { LoomModule } from '@nodeweaver/loom';

74import { CompanyResourceBase } from '@nodeweaver/loom/base';

75import { Company } from './database/company.entity.js';

77export class CompanyResource extends CompanyResourceBase {

78 static override model = Company;

79}

81@Module({

82 imports: [

83 LoomModule.forRoot({

84 orm: 'typeorm',

85 dataSource: appDataSource,

assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Hardcoded password in assets/redoc/redoc.standalone.js

assets/redoc/redoc.standalone.jsView on unpkg · L2

assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in assets/swagger-ui/swagger-ui-bundle.js

assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

Source & flagged code

7 flagged · loading source

dist/assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/assets/redoc/redoc.standalone.jsView on unpkg · L2

dist/core/relations.jsView file

25exports.getByPath = getByPath; L26: const display_name_js_1 = require("./display-name.js"); L27: const deprecation_js_1 = require("./deprecation.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/relations.jsView on unpkg · L25

dist/assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in dist/assets/swagger-ui/swagger-ui-bundle.js

dist/assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

README.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L93

703patternName = generic_password severity = medium line = 703 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L703

assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Hardcoded password in assets/redoc/redoc.standalone.js

assets/redoc/redoc.standalone.jsView on unpkg · L2

assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in assets/swagger-ui/swagger-ui-bundle.js

assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

Findings

10 Medium6 Low

MediumSecret Patterndist/assets/redoc/redoc.standalone.js

MediumDynamic Requiredist/core/relations.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/assets/swagger-ui/swagger-ui-bundle.js

MediumSecret PatternREADME.md

MediumSecret Patternassets/redoc/redoc.standalone.js

MediumSecret Patternassets/swagger-ui/swagger-ui-bundle.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/assets/redoc/redoc.standalone.jsView on unpkg · L2

dist/core/relations.jsView file

Lines 5-45javascript

5exports.isMultiRelation = isMultiRelation;

6exports.isRelationConfig = isRelationConfig;

7exports.relationConfigForField = relationConfigForField;

8exports.relationConfigForColumn = relationConfigForColumn;

9exports.relationFields = relationFields;

10exports.many2OneFields = many2OneFields;

11exports.multiRelationFields = multiRelationFields;

12exports.relationColumns = relationColumns;

13exports.many2OneColumns = many2OneColumns;

14exports.relationForeignKey = relationForeignKey;

15exports.relationIdsFromValue = relationIdsFromValue;

16exports.relationLabel = relationLabel;

17exports.searchRelationOptions = searchRelationOptions;

18exports.relationQuickCreate = relationQuickCreate;

19exports.relationRecordSummary = relationRecordSummary;

20exports.buildRelationFieldContexts = buildRelationFieldContexts;

21exports.buildRelationOptions = buildRelationOptions;

22exports.shouldPreloadRelation = shouldPreloadRelation;

23exports.buildRelationOptionsForForm = buildRelationOptionsForForm;

24exports.buildRelationLabelMap = buildRelationLabelMap;

25exports.getByPath = getByPath;

26const display_name_js_1 = require("./display-name.js");

27const deprecation_js_1 = require("./deprecation.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/relations.jsView on unpkg · L25

28const adapter_js_1 = require("../adapters/adapter.js");

29const RELATION_OPTIONS_LIMIT = 250;

30const RELATION_SEARCH_LIMIT = 15;

31function isMany2OneRelation(relation) {

32 return relation?.kind === 'many2one';

33}

34function isMultiRelation(relation) {

35 return relation?.kind === 'many2many' || relation?.kind === 'one2many';

36}

37function isRelationConfig(relation) {

38 return Boolean(relation?.kind && relation.resource);

39}

40function relationConfigForField(field) {

41 return isRelationConfig(field.relation) ? field.relation : undefined;

42}

43function relationConfigForColumn(meta, column) {

44 if (isRelationConfig(column.relation) && column.relation.resource) {

45 return column.relation;

dist/assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in dist/assets/swagger-ui/swagger-ui-bundle.js

dist/assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

README.mdView file

Lines 73-113markdown

73import { LoomModule } from '@nodeweaver/loom';

74import { CompanyResourceBase } from '@nodeweaver/loom/base';

75import { Company } from './database/company.entity.js';

77export class CompanyResource extends CompanyResourceBase {

78 static override model = Company;

79}

81@Module({

82 imports: [

83 LoomModule.forRoot({

84 orm: 'typeorm',

85 dataSource: appDataSource,

assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Hardcoded password in assets/redoc/redoc.standalone.js

assets/redoc/redoc.standalone.jsView on unpkg · L2

assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in assets/swagger-ui/swagger-ui-bundle.js

assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

Lines 683-723markdown

683Default CSP allows same-origin assets (including vendored Alpine at `{basePath}/assets/alpine.min.js`), the inline theme boot script, and `'unsafe-eval'` because Alpine evaluates `x-*` expressions via `Function`. For a stricter CSP without `unsafe-eval`, migrate templates to Alpine's CSP build (`@alpinejs/csp`) and pass a custom `contentSecurityPolicy`.

684

685Deprecated APIs log one-time `[Loom deprecation]` warnings at boot or first use. Set `LOOM_DEPRECATION_WARNINGS=0` to silence them in tests.

686

687### Soft deletes

688

689```typescript

690export class DealResource extends Resource {

691 static override softDelete = true; // stamps `deletedAt`

692 // or: static softDelete = { field: 'removedAt' };

693}

694```

695

696List excludes trashed rows by default. Use `?trashed=1` (or Trash in the toolbar) and **Restore**. Combobox relation fields no longer preload up to 250 options (search-only); checkboxList / relationTable still preload unless `relation.preload` overrides.

697

698### `seedAdmin`

699

700```typescript

701seedAdmin: {

702 email: 'admin@example.com',

703 password: 'password',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L703

704 name: 'Admin',

705 role: 'admin', // role slug to assign (default admin)

706}

707```

708

709### Sessions & passwords

710

711- Cookie: HttpOnly, SameSite=Lax, Path `/`, HMAC-SHA256 payload `{ sub, exp }`.

712- Passwords stored as `scrypt$N$r$p$salt$hash` via `hashPassword` / `verifyPassword`.

713- Plaintext passwords are accepted once, then upgraded on successful login.

714- Admin create/update also hashes password fields.

715

716### Public paths

717

718Login, logout, and `{basePath}/assets/*` are public. Everything else under the admin prefix requires a session when auth is enabled.

719

720### Runtime helpers

721

722```typescript

723import { currentLoomUser, runWithLoomAuth } from '@nodeweaver/loom';