registry / @nodeweaver/loom / 0.1.6

@nodeweaver/loom@0.1.6

Loom — declarative NestJS admin: resources, RBAC, tenancy, media, and JSON API (Handlebars + Tailwind + Alpine).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 5.12 MB of source, external domains: alpinejs.dev, cdn.redoc.ly, redoc.ly, redocly.com, stackoverflow.com, www.w3.org

Source & flagged code

7 flagged

dist/assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/assets/redoc/redoc.standalone.jsView on unpkg · L2

dist/core/relations.jsView file

Lines 5-45javascript

5exports.isMultiRelation = isMultiRelation;

6exports.isRelationConfig = isRelationConfig;

7exports.relationConfigForField =

Source & flagged code

7 flagged · loading source

dist/assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/assets/redoc/redoc.standalone.jsView on unpkg · L2

dist/core/relations.jsView file

25exports.getByPath = getByPath; L26: const display_name_js_1 = require("./display-name.js"); L27: const deprecation_js_1 = require("./deprecation.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/relations.jsView on unpkg · L25

dist/assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in dist/assets/swagger-ui/swagger-ui-bundle.js

dist/assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

README.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L93

703patternName = generic_password severity = medium line = 703 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L703

assets/redoc/redoc.standalone.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...>ma`

Medium

Secret Pattern

Hardcoded password in assets/redoc/redoc.standalone.js

assets/redoc/redoc.standalone.jsView on unpkg · L2

assets/swagger-ui/swagger-ui-bundle.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...)));

Medium

Secret Pattern

Hardcoded password in assets/swagger-ui/swagger-ui-bundle.js

assets/swagger-ui/swagger-ui-bundle.jsView on unpkg · L2

Findings

10 Medium6 Low

MediumSecret Patterndist/assets/redoc/redoc.standalone.js

MediumDynamic Requiredist/core/relations.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/assets/swagger-ui/swagger-ui-bundle.js

MediumSecret PatternREADME.md

MediumSecret Patternassets/redoc/redoc.standalone.js

MediumSecret Patternassets/swagger-ui/swagger-ui-bundle.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

README.mdView file

Lines 73-113markdown

73import { LoomModule } from '@nodeweaver/loom';

74import { CompanyResourceBase } from '@nodeweaver/loom/base';

75import { Company } from './database/company.entity.js';

77export class CompanyResource extends CompanyResourceBase {

78 static override model = Company;

79}

81@Module({

82 imports: [

83 LoomModule.forRoot({

84 orm: 'typeorm',

85 dataSource: appDataSource,

86 resources: [CompanyResource],

87 basePath: '/admin',

88 branding: { brandName: 'My App Admin' },

89 auth: {

90 secret: process.env.LOOM_AUTH_SECRET!,

91 seedAdmin: {

92 email: 'admin@example.com',

93 password: 'password',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L93

94 name: 'Admin',

95 },

96 },

97 }),

98 ],

99})

100export class AppModule {}

101```

102

103- Panel: `/admin`

104- Resource list: `/admin/companies`

105- Login: `/login` (when `auth.secret` is set; legacy `/admin/login` redirects here)

106

107### Async registration

108

109```typescript

110LoomModule.forRootAsync({

111 inject: [DataSource],

112 useFactory: (dataSource: DataSource) => ({

113 orm: 'typeorm',

Lines 683-723markdown

683Default CSP allows same-origin assets (including vendored Alpine at `{basePath}/assets/alpine.min.js`), the inline theme boot script, and `'unsafe-eval'` because Alpine evaluates `x-*` expressions via `Function`. For a stricter CSP without `unsafe-eval`, migrate templates to Alpine's CSP build (`@alpinejs/csp`) and pass a custom `contentSecurityPolicy`.

684

685Deprecated APIs log one-time `[Loom deprecation]` warnings at boot or first use. Set `LOOM_DEPRECATION_WARNINGS=0` to silence them in tests.

686

687### Soft deletes

688

689```typescript

690export