registry / @objectstack/verify / 11.6.0

@objectstack/verify@11.6.0

Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 46.0 KB of source, external domains: example.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 55-95javascript

55 "http-server"

56 );

57 const app = httpServer.getRawApp();

58 const ORIGIN = "http://localhost:3000";

59 const raw = (path, init) => app.request(`${ORIGIN}${path}`, init);

60 const api = (path, init) => raw(`${API_PREFIX}${path}`, init);

61 const admin = opts.admin ?? { email: DEFAULT_ADMIN_EMAIL, password: DEFAULT_ADMIN_PASSWORD };

62 const signIn = async (email = admin.email, password = admin.password) => {

63 const res = await api("/auth/sign-in/email", {

64 method: "POST",

65 headers: { "Content-Type": "application/json" },

66 body: JSON.stringify({ email, password })

67 });

68 if (!res.ok) {

69 throw new Error(`verify signIn failed: ${res.status} ${await res.text()}`);

70 }

71 const data = await res.json();

72 if (!data.token) throw new Error("verify signIn: no token in response");

73 return data.token;

74 };

75 const signUp = async (email, password = "Member-Pass-123", name) => {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L75

76 const res = await api("/auth/sign-up/email", {

77 method: "POST",

78 headers: { "Content-Type": "application/json" },

79 body: JSON.stringify({ email, password, name: name ?? email.split("@")[0] })

80 });

81 if (!res.ok) {

82 throw new Error(`verify signUp failed: ${res.status} ${await res.text()}`);

83 }

84 const data = await res.json();

85 if (!data.token) throw new Error("verify signUp: no token in response");

86 return data.token;

87 };

88 const apiAs = (token, method, path, body) => api(path, {

89 method,

90 headers: {

91 "Content-Type": "application/json",

92 Authorization: `Bearer ${token}`

93 },

94 ...body !== void 0 ? { body: JSON.stringify(body) } : {}

95 });

dist/index.cjsView file

Lines 98-138javascript

98 "http-server"

99 );

100 const app = httpServer.getRawApp();

101 const ORIGIN = "http://localhost:3000";

102 const raw = (path, init) =>

Source & flagged code

2 flagged · loading source

dist/index.jsView file

75patternName = generic_password severity = medium line = 75 matchedText = const si...=> {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L75

dist/index.cjsView file

118patternName = generic_password severity = medium line = 118 matchedText = const si...=> {

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L118

Findings

3 Medium3 Low

MediumSecret Patterndist/index.js

MediumEnvironment Vars

MediumSecret Patterndist/index.cjs

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 55-95javascript

55 "http-server"

56 );

57 const app = httpServer.getRawApp();

58 const ORIGIN = "http://localhost:3000";

59 const raw = (path, init) => app.request(`${ORIGIN}${path}`, init);

60 const api = (path, init) => raw(`${API_PREFIX}${path}`, init);

61 const admin = opts.admin ?? { email: DEFAULT_ADMIN_EMAIL, password: DEFAULT_ADMIN_PASSWORD };

62 const signIn = async (email = admin.email, password = admin.password) => {

63 const res = await api("/auth/sign-in/email", {

64 method: "POST",

65 headers: { "Content-Type": "application/json" },

66 body: JSON.stringify({ email, password })

67 });

68 if (!res.ok) {

69 throw new Error(`verify signIn failed: ${res.status} ${await res.text()}`);

70 }

71 const data = await res.json();

72 if (!data.token) throw new Error("verify signIn: no token in response");

73 return data.token;

74 };

75 const signUp = async (email, password = "Member-Pass-123", name) => {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L75

76 const res = await api("/auth/sign-up/email", {

77 method: "POST",

78 headers: { "Content-Type": "application/json" },

79 body: JSON.stringify({ email, password, name: name ?? email.split("@")[0] })

80 });

81 if (!res.ok) {

82 throw new Error(`verify signUp failed: ${res.status} ${await res.text()}`);

83 }

84 const data = await res.json();

85 if (!data.token) throw new Error("verify signUp: no token in response");

86 return data.token;

87 };

88 const apiAs = (token, method, path, body) => api(path, {

89 method,

90 headers: {

91 "Content-Type": "application/json",

92 Authorization: `Bearer ${token}`

93 },

94 ...body !== void 0 ? { body: JSON.stringify(body) } : {}

95 });

dist/index.cjsView file

Lines 98-138javascript

98 "http-server"

99 );

100 const app = httpServer.getRawApp();

101 const ORIGIN = "http://localhost:3000";

102 const raw = (path, init) =>