registry / @nubitio/eject / 0.7.1

@nubitio/eject@0.7.1

Eject explicit resource definitions from Hydra API docs

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Nubit codegen CLI/library that fetches API docs and optionally writes generated resource/page files when explicitly invoked.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs nubit eject fields/page or calls exported ejectFieldsFromDocs/runCli

Impact

User-requested output file creation; no source evidence of exfiltration or install-time mutation

Mechanism

API-docs-to-code generation

Rationale

The suspicious primitives are package-aligned: fetching API documentation and writing generated files only under explicit CLI use. Source inspection found no lifecycle execution, credential theft, remote payload execution, persistence, destructive behavior, or AI-agent control-surface mutation.

Evidence

package.jsonbin/nubit.mjsdist/index.mjsdist/index.cjsdist/index.d.mtsdist/index.d.ctsuser-supplied --out path

Network endpoints1

localhost:8000/api/docs.jsonld

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.mjs fetches a user/default docs URL and can write generated code to --out
fieldToCodeLine interpolates some doc-derived values into generated code strings

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts
bin/nubit.mjs only loads local dist/index.mjs or dev fallback ../src/runCli.ts
No child_process, eval, credential/env harvesting, persistence, or agent config mutation found
Network use is CLI/imported function behavior for fetching API documentation, aligned with codegen purpose
Writes occur only when user invokes CLI with --out

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 11.8 KB of source

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

30patternName = generic_password severity = medium line = 30 matchedText = password...ld",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

bin/nubit.mjsView file

15try { L16: return await import(pathToFileURL(resolve(distRoot, 'index.mjs')).href); L17: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nubit.mjsView on unpkg · L15

dist/index.mjsView file

29patternName = generic_password severity = medium line = 29 matchedText = password...ld",

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L29

Findings

4 Medium1 Low

MediumSecret Patterndist/index.cjs

MediumDynamic Requirebin/nubit.mjs

MediumNetwork

MediumSecret Patterndist/index.mjs

LowFilesystem

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap