registry / @opengis/fastify-table / 2.5.2

@opengis/fastify-table@2.5.2

core-plugins

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 353 file(s), 818 KB of source, external domains: accounts.google.com, cdn.softpro.ua, id.softpro.ua, nsdi.gov.ua, www.w3.org

Source & flagged code

3 flagged

dist/server/plugins/auth/funcs/verifyPassword.jsView file

Lines 7-33javascript

7export default async function verifyPassword({ pg, username, password, }) {

8 if (!config.pg)

9 return;

10 if (!username || username === "")

11 return { message: "not enough params: username" };

12 if (!password || password === "")

13 return { message: "not enough params: password" };

14 const query = "select * from admin.users where $1 in (login,email,phone) and enabled limit 1";

15 const json = await pg

16 .query(query, [username])

17 .then((el) => el.rows?.[0] || {});

18 if (!json)

19 return { message: "user not found" };

20 let hash = "";

21 for (let i = 0; i < 10; i += 1) {

22 hash = md5(password + hash + json.salt);

23 }

24 hash = crypt(hash, json.salt);

25 if (json.password === hash) {

26 if (username === "admin" && password === "admin") {

27 await pg.query("update admin.users set password='6Z4gu2mG8R' where uid=$1", [json.uid]);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/plugins/auth/funcs/verifyPassword.jsView on unpkg · L27

28 }

29 return { user: json };

30 }

31 return { message: "Wrong password" };

32}

dist/server/plugins/policy/xssInjection.jsView file

Lines 3-43javascript

3 'onkeypress=',

4 'onkeyup=',

5 'ondblclick=',

6 'onerror=',

7 'onmouseover=',

8 '<meta',

9 '<script',

10 'vascript:',

dist/functions.jsView file

Lines 163-203javascript

163 const { rowCount = 0 } = await client.query("delete from admin.cls where $1::text[] && array[name,parent]", [cls.filter((el) => el.update).map((el) => el.name)]);

164 console.log("fastify-table/hook old cls deleted", rowCount);

165

Source & flagged code

3 flagged · loading source

dist/server/plugins/auth/funcs/verifyPassword.jsView file

27patternName = generic_password severity = medium line = 27 matchedText = await pg...d]);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/plugins/auth/funcs/verifyPassword.jsView on unpkg · L27

dist/server/plugins/policy/xssInjection.jsView file

23'\\x', L24: 'eval(', L25: 'onmouseover=',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server/plugins/policy/xssInjection.jsView on unpkg · L23

dist/functions.jsView file

183return; L184: const { uid } = config?.auth?.disable || process.env.NODE_ENV !== "admin" L185: ? { uid: "1" } ... L233: format: row.format, L234: data: row.data, L235: })); ... L401: ...acc1, L402: ...JSON.parse(readFileSync(`locales/${curr.name}/${file.name}`, "utf-8").replace(/[\u200B-\u200D\uFEFF]/g, "")), L403: }), {});

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/functions.jsView on unpkg · L183

Findings

3 Medium7 Low

MediumSecret Patterndist/server/plugins/auth/funcs/verifyPassword.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/server/plugins/policy/xssInjection.js

LowWeak Cryptodist/functions.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/server/plugins/auth/funcs/verifyPassword.jsView file

Lines 7-33javascript

7export default async function verifyPassword({ pg, username, password, }) {

8 if (!config.pg)

9 return;

10 if (!username || username === "")

11 return { message: "not enough params: username" };

12 if (!password || password === "")

13 return { message: "not enough params: password" };

14 const query = "select * from admin.users where $1 in (login,email,phone) and enabled limit 1";

15 const json = await pg

16 .query(query, [username])

17 .then((el) => el.rows?.[0] || {});

18 if (!json)

19 return { message: "user not found" };

20 let hash = "";

21 for (let i = 0; i < 10; i += 1) {

22 hash = md5(password + hash + json.salt);

23 }

24 hash = crypt(hash, json.salt);

25 if (json.password === hash) {

26 if (username === "admin" && password === "admin") {

27 await pg.query("update admin.users set password='6Z4gu2mG8R' where uid=$1", [json.uid]);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/plugins/auth/funcs/verifyPassword.jsView on unpkg · L27

28 }

29 return { user: json };

30 }

31 return { message: "Wrong password" };

32}

dist/server/plugins/policy/xssInjection.jsView file

Lines 3-43javascript

3 'onkeypress=',

4 'onkeyup=',

5 'ondblclick=',

6 'onerror=',

7 'onmouseover=',

8 '<meta',

9 '<script',

10 'vascript:',

dist/functions.jsView file

Lines 163-203javascript

163 const { rowCount = 0 } = await client.query("delete from admin.cls where $1::text[] && array[name,parent]", [cls.filter((el) => el.update).map((el) => el.name)]);

164 console.log("fastify-table/hook old cls deleted", rowCount);

165