@opensaas/stack-cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 312 KB of source, external domains: github.com, stack.opensaas.au, www.prisma.io

Source & flagged code

5 flagged

dist/generator/lists.jsView file

Lines 1-39javascript

1import * as fs from 'fs';

2import * as path from 'path';

3/**

4 * Map a field type string to the TypeScript field-config type and the

5 * `@opensaas/stack-core` entry point it is exported from.

6 *

7 * Built-in field types and their config types live on the `/fields` entry

8 * point. Unknown field types (e.g. those contributed by plugins) fall back to

9 * the generic `BaseFieldConfig`, exported from the `/extend` authoring surface.

10 */

11function getFieldTypeImport(fieldType) {

12 const typeMap = {

13 text: 'TextField',

14 integer: 'IntegerField',

15 decimal: 'DecimalField',

16 checkbox: 'CheckboxField',

17 timestamp: 'TimestampField',

18 calendarDay: 'CalendarDayField',

19 password: 'PasswordField',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/generator/lists.jsView on unpkg · L19

20 select: 'SelectField',

21 relationship: 'RelationshipField',

22 json: 'JsonField',

23 virtual: 'VirtualField',

24 };

25 const typeName = typeMap[fieldType];

26 if (typeName) {

27 return { module: '@opensaas/stack-core/fields', typeName };

28 }

29 return { module: '@opensaas/stack-core/extend', typeName: 'BaseFieldConfig' };

30}

31/**

32 * Generate Lists namespace with TypeInfo for each list

33 * This provides strongly-typed hooks with Prisma input types

34 *

35 * @example

36 * ```typescript

37 * // Generated output:

38 * export declare namespace Lists {

39 * export type Post = import('@opensaas/stack-core').ListConfig<Lists.Post.TypeInfo>

dist/generator/node-build.jsView file

Lines 1-34javascript

1import * as path from 'path';

2import * as fs from 'fs';

3import { execFileSync } from 'child_process';

dist/commands/init.jsView file

Lines 1-32javascript

1import { spawn } from 'child_process';

2import chalk from 'chalk';

3/**

4 * Initialize a new OpenSaas Stack project.

5 *

6 * This command delegates to create-opensaas-app for the actual scaffolding.

7 * It's kept here for backwards compatibility with `opensaas init`.

dist/commands/generate.jsView file

Lines 139-179javascript

139 if (modifiedFiles.context !== generatedFiles.context) {

140 fs.writeFileSync(contextPath, modifiedFiles.context);

141 }

142 // Write any additional files plugins generated

143 for (const [filename, content]

Source & flagged code

5 flagged · loading source

dist/generator/lists.jsView file

@opensaas/stack-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

dist/generator/lists.jsView file

Lines 1-39javascript

1import * as fs from 'fs';

2import * as path from 'path';

3/**

4 * Map a field type string to the TypeScript field-config type and the

5 * `@opensaas/stack-core` entry point it is exported from.

6 *

7 * Built-in field types and their config types live on the `/fields` entry

8 * point. Unknown field types (e.g. those contributed by plugins) fall back to

9 * the generic `BaseFieldConfig`, exported from the `/extend` authoring surface.

10 */

11function getFieldTypeImport(fieldType) {

12 const typeMap = {

13 text: 'TextField',

14 integer: 'IntegerField',

15 decimal: 'DecimalField',

16 checkbox: 'CheckboxField',

17 timestamp: 'TimestampField',

18 calendarDay: 'CalendarDayField',

19 password: 'PasswordField',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/generator/lists.jsView on unpkg · L19

20 select: 'SelectField',

21 relationship: 'RelationshipField',

22 json: 'JsonField',

23 virtual: 'VirtualField',

24 };

25 const typeName = typeMap[fieldType];

26 if (typeName) {

27 return { module: '@opensaas/stack-core/fields', typeName };

28 }

29 return { module: '@opensaas/stack-core/extend', typeName: 'BaseFieldConfig' };

30}

31/**

32 * Generate Lists namespace with TypeInfo for each list

33 * This provides strongly-typed hooks with Prisma input types

34 *

35 * @example

36 * ```typescript

37 * // Generated output:

38 * export declare namespace Lists {

39 * export type Post = import('@opensaas/stack-core').ListConfig<Lists.Post.TypeInfo>

dist/generator/node-build.jsView file

Lines 1-34javascript

1import * as path from 'path';

2import * as fs from 'fs';

3import { execFileSync } from 'child_process';

dist/commands/init.jsView file

Lines 1-32javascript

1import { spawn } from 'child_process';

2import chalk from 'chalk';

3/**

4 * Initialize a new OpenSaas Stack project.

5 *

6 * This command delegates to create-opensaas-app for the actual scaffolding.

7 * It's kept here for backwards compatibility with `opensaas init`.

dist/commands/generate.jsView file

Lines 139-179javascript

139 if (modifiedFiles.context !== generatedFiles.context) {

140 fs.writeFileSync(contextPath, modifiedFiles.context);

141 }

142 // Write any additional files plugins generated

143 for (const [filename, content]

@opensaas/stack-cli@0.29.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code