registry / @plumbus/core / 0.6.3

@plumbus/core@0.6.3

Plumbus framework core — types, SDK, runtime, CLI, test utilities

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 941 KB of source, external domains: api.anthropic.com, api.openai.com, biomejs.dev, github.com, schemas.microsoft.com, schemas.xmlsoap.org, www.w3.org

Source & flagged code

4 flagged

dist/config/loader.jsView file

Lines 10-50javascript

10 env.NODE_ENV ??

11 'development');

12 return {

13 environment,

14 database: loadDatabaseConfig(env, environment),

15 queue: loadQueueConfig(env, environment),

16 ai: loadAIConfig(env),

17 aiProviders: loadMultiProviderConfig(env),

18 auth: loadAuthConfig(env, environment),

19 complianceProfiles: loadComplianceProfiles(env),

20 };

21}

22// ── Database Config ──

23function loadDatabaseConfig(env, environment) {

24 const defaults = environment === 'development'

25 ? {

26 host: 'localhost',

27 port: 5432,

28 database: 'plumbus_dev',

29 user: 'postgres',

30 password: 'postgres',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config/loader.jsView on unpkg · L30

31 }

32 : { host: 'localhost', port: 5432, database: 'plumbus', user: 'plumbus', password: '' };

33 return {

34 host: env.DATABASE_HOST ?? env.DB_HOST ?? env.PGHOST ?? defaults.host,

35 port: parseInt(env.DATABASE_PORT ?? env.DB_PORT ?? env.PGPORT ?? String(defaults.port), 10),

36 database: env.DATABASE_NAME ?? env.DB_NAME ?? env.PGDATABASE ?? defaults.database,

37 user: env.DATABASE_USER ?? env.DB_USER ?? env.PGUSER ?? defaults.user,

38 password: env.DATABASE_PASSWORD ?? env.DB_PASSWORD ?? env.PGPASSWORD ?? defaults.password,

39 ssl: env.DATABASE_SSL === 'true' || environment === 'production',

40 poolSize: parseInt(env.DATABASE_POOL_SIZE ?? (environment === 'production' ? '20' : '5'), 10),

41 };

42}

43// ── Queue Config ──

44function loadQueueConfig(env, environment) {

45 return {

46 host: env.QUEUE_HOST ?? env.REDIS_HOST ?? 'localhost',

47 port: parseInt(env.QUEUE_PORT ?? env.REDIS_PORT ?? '6379', 10),

48 password: env.QUEUE_PASSWORD ?? env.REDIS_PASSWORD ?? undefined,

49 prefix: env.QUEUE_PREFIX ?? `plumbus:${environment}`,

50 };

dist/cli/commands/test.jsView file

Lines 1-24javascript

1// ── plumbus test ──

2// Wraps vitest so consumer apps don't need a direct vitest dependency.

3// All arguments are forwarded to vitest.

4// Use --all to run both unit and e2e tests.

5import { execFileSync } from 'node:child_process';

6import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

dist/cli/commands/test.jsView on unpkg · L4

7import

dist/runtime/load-extensions.jsView file

Lines 1-28javascript

1import * as fs from 'node:fs';

2import { createRequire } from 'node:module';

3import * as path from 'node:path';

4import { pathToFileURL } from 'node:url';

5/** Load optional hooks from app/server.ts or app/server.js. */

dist/cli/commands/e2e.jsView file

Lines 68-108javascript

68 const port = options.port ?? '3001';

69 const baseUrl = options.baseUrl ?? `http://localhost:${port}`;

70 const frontendDir = resolve(cwd, options.frontendDir ?? 'frontend'

Source & flagged code

4 flagged · loading source

dist/config/loader.jsView file

30patternName = generic_password severity = medium line = 30 matchedText = password...es',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config/loader.jsView on unpkg · L30

dist/cli/commands/test.jsView file

4// Use --all to run both unit and e2e tests. L5: import { execFileSync } from 'node:child_process'; L6: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

dist/cli/commands/test.jsView on unpkg · L4

dist/runtime/load-extensions.jsView file

8try { L9: const req = createRequire(import.meta.url); L10: const tsxPath = req.resolve('tsx/esm/api');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/load-extensions.jsView on unpkg · L8

dist/cli/commands/e2e.jsView file

88info(`Starting frontend dev server on port ${port}...`); L89: serverProcess = spawn('npx', ['next', 'dev', '--port', port], { L90: cwd: frontendDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/e2e.jsView on unpkg · L88

Findings

3 High5 Medium5 Low

HighChild Processdist/cli/commands/test.js

HighShell

HighRuntime Package Installdist/cli/commands/e2e.js

MediumSecret Patterndist/config/loader.js

MediumDynamic Requiredist/runtime/load-extensions.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/config/loader.jsView file

Lines 10-50javascript

10 env.NODE_ENV ??

11 'development');

12 return {

13 environment,

14 database: loadDatabaseConfig(env, environment),

15 queue: loadQueueConfig(env, environment),

16 ai: loadAIConfig(env),

17 aiProviders: loadMultiProviderConfig(env),

18 auth: loadAuthConfig(env, environment),

19 complianceProfiles: loadComplianceProfiles(env),

20 };

21}

22// ── Database Config ──

23function loadDatabaseConfig(env, environment) {

24 const defaults = environment === 'development'

25 ? {

26 host: 'localhost',

27 port: 5432,

28 database: 'plumbus_dev',

29 user: 'postgres',

30 password: 'postgres',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config/loader.jsView on unpkg · L30

31 }

32 : { host: 'localhost', port: 5432, database: 'plumbus', user: 'plumbus', password: '' };

33 return {

34 host: env.DATABASE_HOST ?? env.DB_HOST ?? env.PGHOST ?? defaults.host,

35 port: parseInt(env.DATABASE_PORT ?? env.DB_PORT ?? env.PGPORT ?? String(defaults.port), 10),

36 database: env.DATABASE_NAME ?? env.DB_NAME ?? env.PGDATABASE ?? defaults.database,

37 user: env.DATABASE_USER ?? env.DB_USER ?? env.PGUSER ?? defaults.user,

38 password: env.DATABASE_PASSWORD ?? env.DB_PASSWORD ?? env.PGPASSWORD ?? defaults.password,

39 ssl: env.DATABASE_SSL === 'true' || environment === 'production',

40 poolSize: parseInt(env.DATABASE_POOL_SIZE ?? (environment === 'production' ? '20' : '5'), 10),

41 };

42}

43// ── Queue Config ──

44function loadQueueConfig(env, environment) {

45 return {

46 host: env.QUEUE_HOST ?? env.REDIS_HOST ?? 'localhost',

47 port: parseInt(env.QUEUE_PORT ?? env.REDIS_PORT ?? '6379', 10),

48 password: env.QUEUE_PASSWORD ?? env.REDIS_PASSWORD ?? undefined,

49 prefix: env.QUEUE_PREFIX ?? `plumbus:${environment}`,

50 };

dist/cli/commands/test.jsView file

Lines 1-24javascript

1// ── plumbus test ──

2// Wraps vitest so consumer apps don't need a direct vitest dependency.

3// All arguments are forwarded to vitest.

4// Use --all to run both unit and e2e tests.

5import { execFileSync } from 'node:child_process';

6import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

dist/cli/commands/test.jsView on unpkg · L4

7import

dist/runtime/load-extensions.jsView file

Lines 1-28javascript

1import * as fs from 'node:fs';

2import { createRequire } from 'node:module';

3import * as path from 'node:path';

4import { pathToFileURL } from 'node:url';

5/** Load optional hooks from app/server.ts or app/server.js. */

dist/cli/commands/e2e.jsView file

Lines 68-108javascript

68 const port = options.port ?? '3001';

69 const baseUrl = options.baseUrl ?? `http://localhost:${port}`;

70 const frontendDir = resolve(cwd, options.frontendDir ?? 'frontend'