registry / @qaecy/cue-cli / 0.0.50

@qaecy/cue-cli@0.0.50

Cue CLI for QAECY platform

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 530 KB of source, external domains: 10.0.3.120, 4dx.embl.de, a9.com, abs.270a.info, academic-meta-tool.xyz, accessors-api-gateway-ueyeemwf2a-oa.a.run.app, activitypods.org, advene.org, aers.data2semantics.org, agrinepaldata.com, aims.fao.org, akonadi-project.org, aksw.org, aleth.io, animaldiversity.org, annotation.semanticweb.org, api.bloomberg.com, api.hyprdia.com, api.ohdsi.org, app.korfin.de, archaeology.link, archdesc.info, archivo.dbpedia.org, art.uniroma2.it, assemblee-virtuelle.github.io, atomowl.org, auto.schema.org, automotive.eurecom.fr, awesemantic-geo.link, awslabs.github.io, babelnet.org, bag.basisregistraties.overheid.nl, bag2.basisregistraties.overheid.nl, bblfish.net, beer.com, betalinkeddata.cbs.nl, bg.dbpedia.org, bgt.basisregistraties.overheid.nl, bibliograph.net, biglinkeddata.com, bihap.kb.gov.tr, bing.com, bio2rdf.org, bioentity.io, biohackathon.org, bioinformatics.ua.pt, bioportal.bioontology.org, bioschemas.org, bis.270a.info, blogs.yandex.ru

Source & flagged code

5 flagged

main.jsView file

Lines 384-424javascript

384var EMULATOR_AUTH_PORT = process.env.CUE_EMULATOR_AUTH_PORT ?? "9099";

385var EMULATOR_AUTH_HOST = `localhost:${EMULATOR_AUTH_PORT}`;

386var EMULATOR_STORAGE_PORT = parseInt(process.env.CUE_EMULATOR_STORAGE_PORT ?? "9199", 10);

387var EMULATOR_FIRESTORE_PORT = parseInt(process.env.CUE_EMULATOR_FIRESTORE_PORT ?? "8080", 10);

388var getEmulatorEndpoints = () => ({

389 gatewayUrl: EMULATOR_API_GATEWAY_BASE,

390 tokenUrl: TOKEN_ENDPOINT_EMULATOR,

391 authEmulatorUrl: `http://${EMULATOR_AUTH_HOST}`,

392 storageEmulatorHost: "localhost",

393 storageEmulatorPort: EMULATOR_STORAGE_PORT,

394 firestoreEmulatorHost: "localhost",

395 firestoreEmulatorPort: EMULATOR_FIRESTORE_PORT

396});

397var EMULATOR_QLEVER_PORT = process.env.CUE_QLEVER_PORT ?? "8102";

398var QLEVER_QUERY_ENDPOINT_EMULATOR = process.env.CUE_QLEVER_ENDPOINT ? `${process.env.CUE_QLEVER_ENDPOINT}/query` : `http://localhost:${EMULATOR_QLEVER_PORT}/query`;

399var QLEVER_UPDATE_ENDPOINT_EMULATOR = process.env.CUE_QLEVER_ENDPOINT ? `${process.env.CUE_QLEVER_ENDPOINT}/update` : `http://localhost:${EMULATOR_QLEVER_PORT}/update`;

400var SPARQL_ENDPOINT_EMULATOR = `${EMULATOR_API_GATEWAY_BASE}/triplestore/query`;

401var SPARQL_ENDPOINT = "https://accessors-api-gateway-ueyeemwf2a-oa.a.run.app/triplestore/query";

402var HASH_WORKER_PATH = (0, import_path.join)(__dirname, "hash-worker.js");

403var FIREBASE_CONFIG = (useEmulator = false) => ({

404 apiKey: "AIzaSyCLhz5Wa3ZCERQZVurSt9bqupPeREALFLk",

High

High Secret

Package contains a high-severity secret pattern.

main.jsView on unpkg · L404

High

Secret Pattern

Google API key in main.js

main.jsView on unpkg · L404

405 appId: "1:151132927589:web:d11c64cc55bdc0f13ab88c",

406 measurementId: "G-Z0FEE58EXY",

407 useEmulator

408});

409var IGNORED_LOCAL = {

410 dirs: ["node_modules", ".git", ".hg", ".svn", ".DS_Store", ".Trash", ".Trashes", "$RECYCLE.BIN", "System Volume Information"],

411 suffix: [".tmp", ".part", ".crdownload", ".zip", ".tar", ".gz"]

412};

413

414// libs/js/sync-tools/src/lib/compare-local-remote.ts

415function compareLocalRemote(localFiles, remoteFiles) {

416 return new Promise((resolve2) => {

417 const localByContentUUID = /* @__PURE__ */ new Map();

418 const localBylocationUUID = /* @__PURE__ */ new Map();

419 for (const lf of localFiles) {

420 if (!localByContentUUID.has(lf.contentUUID)) {

421 localByContentUUID.set(lf.contentUUID, []);

422 }

423 localByContentUUID.get(lf.contentUUID)?.push(lf);

424 localBylocationUUID.set(lf.locationUUID, lf);

Lines 5092-5132javascript

5092 if (dirty) {

5093 cached = compute();

5094 dirty = false;

5095 }

5096 return cached;

5097 },

5098 subscribe(fn) {

5099 listeners.add(fn);

5100 return () =>

hash-worker.jsView file

Lines 1-21javascript

1// apps/desktop/cue-cli/src/hash-worker.js

2var { parentPort } = require("worker_threads");

3var { createReadStream } = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hash-worker.jsView on unpkg · L1

4var SparkMD5 = require("spark-md5");

assets/wasm/dir_scanner_wasm_bg.wasmView file

•path = assets/wasm/dir_scanner_wasm_bg.wasm kind = wasm_module sizeBytes = 380698 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/wasm/dir_scanner_wasm_bg.wasmView on unpkg

Source & flagged code

5 flagged · loading source

main.jsView file

404patternName = google_api_key severity = high line = 404 matchedText = apiKey: ...Lk",

High

High Secret

Package contains a high-severity secret pattern.

main.jsView on unpkg · L404

404patternName = google_api_key severity = high line = 404 matchedText = apiKey: ...Lk",

High

Secret Pattern

Google API key in main.js

main.jsView on unpkg · L404

5112patternName = google_api_key severity = high line = 5112 matchedText = apiKey: ...l0",

High

Secret Pattern

Google API key in main.js

main.jsView on unpkg · L5112

hash-worker.jsView file

1// apps/desktop/cue-cli/src/hash-worker.js L2: var { parentPort } = require("worker_threads"); L3: var { createReadStream } = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hash-worker.jsView on unpkg · L1

assets/wasm/dir_scanner_wasm_bg.wasmView file

•path = assets/wasm/dir_scanner_wasm_bg.wasm kind = wasm_module sizeBytes = 380698 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/wasm/dir_scanner_wasm_bg.wasmView on unpkg

Findings

3 High5 Medium4 Low

HighHigh Secretmain.js

HighSecret Patternmain.js

MediumDynamic Requirehash-worker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleassets/wasm/dir_scanner_wasm_bg.wasm

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

main.jsView file

Lines 384-424javascript

384var EMULATOR_AUTH_PORT = process.env.CUE_EMULATOR_AUTH_PORT ?? "9099";

385var EMULATOR_AUTH_HOST = `localhost:${EMULATOR_AUTH_PORT}`;

386var EMULATOR_STORAGE_PORT = parseInt(process.env.CUE_EMULATOR_STORAGE_PORT ?? "9199", 10);

387var EMULATOR_FIRESTORE_PORT = parseInt(process.env.CUE_EMULATOR_FIRESTORE_PORT ?? "8080", 10);

388var getEmulatorEndpoints = () => ({

389 gatewayUrl: EMULATOR_API_GATEWAY_BASE,

390 tokenUrl: TOKEN_ENDPOINT_EMULATOR,

391 authEmulatorUrl: `http://${EMULATOR_AUTH_HOST}`,

392 storageEmulatorHost: "localhost",

393 storageEmulatorPort: EMULATOR_STORAGE_PORT,

394 firestoreEmulatorHost: "localhost",

395 firestoreEmulatorPort: EMULATOR_FIRESTORE_PORT

396});

397var EMULATOR_QLEVER_PORT = process.env.CUE_QLEVER_PORT ?? "8102";

398var QLEVER_QUERY_ENDPOINT_EMULATOR = process.env.CUE_QLEVER_ENDPOINT ? `${process.env.CUE_QLEVER_ENDPOINT}/query` : `http://localhost:${EMULATOR_QLEVER_PORT}/query`;

399var QLEVER_UPDATE_ENDPOINT_EMULATOR = process.env.CUE_QLEVER_ENDPOINT ? `${process.env.CUE_QLEVER_ENDPOINT}/update` : `http://localhost:${EMULATOR_QLEVER_PORT}/update`;

400var SPARQL_ENDPOINT_EMULATOR = `${EMULATOR_API_GATEWAY_BASE}/triplestore/query`;

401var SPARQL_ENDPOINT = "https://accessors-api-gateway-ueyeemwf2a-oa.a.run.app/triplestore/query";

402var HASH_WORKER_PATH = (0, import_path.join)(__dirname, "hash-worker.js");

403var FIREBASE_CONFIG = (useEmulator = false) => ({

404 apiKey: "AIzaSyCLhz5Wa3ZCERQZVurSt9bqupPeREALFLk",

High

High Secret

Package contains a high-severity secret pattern.

main.jsView on unpkg · L404

High

Secret Pattern

Google API key in main.js

main.jsView on unpkg · L404

405 appId: "1:151132927589:web:d11c64cc55bdc0f13ab88c",

406 measurementId: "G-Z0FEE58EXY",

407 useEmulator

408});

409var IGNORED_LOCAL = {

410 dirs: ["node_modules", ".git", ".hg", ".svn", ".DS_Store", ".Trash", ".Trashes", "$RECYCLE.BIN", "System Volume Information"],

411 suffix: [".tmp", ".part", ".crdownload", ".zip", ".tar", ".gz"]

412};

413

414// libs/js/sync-tools/src/lib/compare-local-remote.ts

415function compareLocalRemote(localFiles, remoteFiles) {

416 return new Promise((resolve2) => {

417 const localByContentUUID = /* @__PURE__ */ new Map();

418 const localBylocationUUID = /* @__PURE__ */ new Map();

419 for (const lf of localFiles) {

420 if (!localByContentUUID.has(lf.contentUUID)) {

421 localByContentUUID.set(lf.contentUUID, []);

422 }

423 localByContentUUID.get(lf.contentUUID)?.push(lf);

424 localBylocationUUID.set(lf.locationUUID, lf);

Lines 5092-5132javascript

5092 if (dirty) {

5093 cached = compute();

5094 dirty = false;

5095 }

5096 return cached;

5097 },

5098 subscribe(fn) {

5099 listeners.add(fn);

5100 return () =>

hash-worker.jsView file

Lines 1-21javascript

1// apps/desktop/cue-cli/src/hash-worker.js

2var { parentPort } = require("worker_threads");

3var { createReadStream } = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hash-worker.jsView on unpkg · L1

4var SparkMD5 = require("spark-md5");

assets/wasm/dir_scanner_wasm_bg.wasmView file

•path = assets/wasm/dir_scanner_wasm_bg.wasm kind = wasm_module sizeBytes = 380698 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/wasm/dir_scanner_wasm_bg.wasmView on unpkg