registry / @nubitio/eject / 0.8.1

@nubitio/eject@0.8.1

Eject explicit resource definitions from Hydra API docs

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI intentionally fetches API documentation and can write generated source to a user-selected output path.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `nubit eject fields` or `nubit eject page`.

Impact

Reads the selected documentation endpoint and optionally creates the requested generated source file.

Mechanism

User-invoked API-doc code generation.

Rationale

Static hints map to normal CLI behavior: dynamic module loading selects the packaged entrypoint, fetch reads explicit API documentation, and file output requires `--out`. Source inspection found no install-time execution, exfiltration, remote payload execution, destructive behavior, or persistence.

Evidence

package.jsonbin/nubit.mjsdist/index.mjsdist/index.cjsdist/index.d.mtsdist/index.d.cts

Network endpoints1

localhost:8000/api/docs.jsonld

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no lifecycle scripts; install does not execute package code.
`bin/nubit.mjs` only runs after the user invokes the `nubit` CLI.
`dist/index.mjs` fetches only the user-selected `--docs` URL, defaulting to localhost.
`dist/index.mjs` writes generated source only when the user supplies `--out`.
No environment/credential reads, subprocesses, eval/vm, persistence, or agent-control writes found.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 11.8 KB of source

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

30patternName = generic_password severity = medium line = 30 matchedText = password...ld",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

bin/nubit.mjsView file

15try { L16: return await import(pathToFileURL(resolve(distRoot, 'index.mjs')).href); L17: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nubit.mjsView on unpkg · L15

dist/index.mjsView file

29patternName = generic_password severity = medium line = 29 matchedText = password...ld",

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L29

Findings

4 Medium1 Low

MediumSecret Patterndist/index.cjs

MediumDynamic Requirebin/nubit.mjs

MediumNetwork

MediumSecret Patterndist/index.mjs

LowFilesystem

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap