registry / @nubitio/eject / 0.8.0

@nubitio/eject@0.8.0

Eject explicit resource definitions from Hydra API docs

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI fetches API documentation and optionally writes generated source to a user-selected output path.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit nubit eject CLI invocation

Impact

Reads the selected documentation endpoint and optionally creates generated source files

Mechanism

User-invoked API-doc code generation

Rationale

Direct inspection shows a narrowly scoped, user-invoked code generator with no install-time execution or concrete malicious behavior. Static network and dynamic-import signals are package-aligned.

Evidence

package.jsonbin/nubit.mjsdist/index.mjsdist/index.cjs

Network endpoints1

localhost:8000/api/docs.jsonld

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
bin/nubit.mjs dynamically imports only local dist code, with a local development fallback.
dist/index.mjs fetches only the user-selected or default API documentation URL.
Generated files are written only when the user supplies --out.
No credential/env harvesting, shell execution, eval, persistence, or agent-control writes found.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 11.8 KB of source

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

30patternName = generic_password severity = medium line = 30 matchedText = password...ld",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

bin/nubit.mjsView file

15try { L16: return await import(pathToFileURL(resolve(distRoot, 'index.mjs')).href); L17: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nubit.mjsView on unpkg · L15

dist/index.mjsView file

29patternName = generic_password severity = medium line = 29 matchedText = password...ld",

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L29

Findings

4 Medium1 Low

MediumSecret Patterndist/index.cjs

MediumDynamic Requirebin/nubit.mjs

MediumNetwork

MediumSecret Patterndist/index.mjs

LowFilesystem

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 10-50javascript

10 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

11 const doc = await response.json();

12 const resourceMap = doc["@type"] === "ApiDocumentation" || doc["@type"] === "hydra:ApiDocumentation" ? (0, _nubitio_hydra.parseHydraDoc)(doc, {}) : (0, _nubitio_hydra.parseOpenApiDoc)(doc);

13 const normalizedInput = normalizeUrl(apiUrl);

14 const resourceSchema = Object.values(resourceMap).find((schema) => normalizeUrl(schema.apiUrl) === normalizedInput);

15 if (!resourceSchema) {

16 const known = Object.values(resourceMap).map((schema) => schema.apiUrl).join(", ");

17 throw new Error(`No schema found for ${apiUrl}. Known: ${known || "(none)"}`);

18 }

19 const fields = (0, _nubitio_hydra.mapHydraSchemaToFields)(resourceSchema, (className) => resourceMap[className]?.apiUrl, (className) => resourceMap[className]);

20 return {

21 apiUrl: resourceSchema.apiUrl,

22 className: resourceSchema.className,

23 fields

24 };

25}

26//#endregion

27//#region packages/eject/src/fieldToCode.ts

28const BUILDER_BY_TYPE = {

29 text: "textField",

30 password: "passwordField",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjsView on unpkg · L30

31 textarea: "textareaField",

32 date: "dateField",

33 datetime: "datetimeField",

34 number: "numberField",

35 currency: "currencyField",

36 select: "selectField",

37 enum: "enumField",

38 entity: "entityField",

39 radio: "radioField",

40 switch: "switchField",

41 checkbox: "checkboxField",

42 file: "fileField",

43 image: "imageField",

44 tags: "tagsField",

45 html: "htmlField",

46 none: "noneField"

47};

48function fieldToCodeLine(field) {

49 const builder = BUILDER_BY_TYPE[field.type] ?? "textField";

50 const parts = [];

bin/nubit.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Nubit eject CLI — generates explicit resource/page files from Hydra docs.

4 * Run from the monorepo root: node packages/eject/bin/nubit.mjs eject fields /api/products

5 */

6import process from 'node:process';

7import { writeFileSync } from 'node:fs';

8import { resolve, dirname } from 'node:path';

dist/index.mjsView file

Lines 9-49javascript

9 if (!response.ok) throw new Error(`Failed to fetch ${docsUrl}: ${response.status} ${response.statusText}`);

10 const doc = await response.json();

11 const resourceMap