@querygraph/verdun@0.4.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@querygraph/verdun@0.4.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

16 flagged · loading source

scripts/smoke-email-auth.mjsView file

78patternName = generic_password severity = medium line = 78 matchedText = const pa...ple'

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/smoke-email-auth.mjsView on unpkg · L78

164patternName = generic_password severity = medium line = 164 matchedText = password...ng',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth.mjs

scripts/smoke-email-auth.mjsView on unpkg · L164

scripts/smoke-account-store.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'node:child_process' L3: import { mkdir, mkdtemp, readFile } from 'node:fs/promises'

High

Child Process

Package source references child process execution.

scripts/smoke-account-store.mjsView on unpkg · L1

43verdunAccountUsage, L44: } = await import(pathToFileURL(join(outDir, 'store.js')).href) L45: const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-account-store.mjsView on unpkg · L43

scripts/deploy-workbench-database.mjsView file

161function assertVercelDatabaseEnv() { L162: const result = spawnSync('npx', ['vercel', 'env', 'ls', 'production'], { L163: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/deploy-workbench-database.mjsView on unpkg · L161

scripts/smoke-plans.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @querygraph/verdun@0.1.1 matchedIdentity = npm:QHF1ZXJ5Z3JhcGgvdmVyZHVu:0.1.1 similarity = 0.922 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/smoke-plans.mjsView on unpkg

scripts/smoke-email-auth-postgres.mjsView file

48patternName = generic_password severity = medium line = 48 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L48

87patternName = generic_password severity = medium line = 87 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L87

95patternName = generic_password severity = medium line = 95 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L95

137patternName = generic_password severity = medium line = 137 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

Source & flagged code

16 flagged

scripts/smoke-email-auth.mjsView file

Lines 58-98javascript

58 name: null,

59 picture_url: null,

60 provider: 'email',

61 provider_subject: 'person@example.test',

62 tier: 'free',

63 status: 'active',

64 created_at: '2026-07-14T00:00:00.000Z',

65 updated_at: '2026-07-14T00:00:00.000Z',

66 last_login_at: '2026-07-14T00:00:00.000Z',

67}

68

69if (normalizeVerdunEmail(' Person@Example.Test ') !== 'person@example.test') {

70 throw new Error('email normalization must trim and lowercase without provider-specific rewriting')

71}

72for (const invalidEmail of ['', 'missing-at.example.test', 'person@localhost', 'two words@example.test', 'two@ats@example.test']) {

73 await expectError(() => normalizeVerdunEmail(invalidEmail), 'invalid_email')

74}

75if (assertVerdunAuthPepper(` ${pepper} `) !== pepper) throw new Error('auth pepper should be trimmed')

76await expectError(() => assertVerdunAuthPepper('too-short'), 'auth_pepper_not_configured')

77

78const password = 'correct horse battery staple'

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/smoke-email-auth.mjsView on unpkg · L78

79const passwordHash = await hashVerdunPassword(password)

80if (!passwordHash.startsWith('scrypt$32768$8$1$') || passwordHash.includes(password)) {

81 throw new Error(`password hash uses an unexpected or unsafe representation: ${passwordHash}`)

82}

83if (!await verifyVerdunPassword(password, passwordHash)) throw new Error('password verifier rejected the correct password')

84if (await verifyVerdunPassword('wrong-password', passwordHash)) throw new Error('password verifier accepted an incorrect password')

85if (await verifyVerdunPassword(password, 'not-a-password-hash')) throw new Error('password verifier accepted an invalid hash')

86

87const linkToken = 'raw-link-token'

88const tokenHash = hashVerdunEmailLinkToken(linkToken)

89if (tokenHash === linkToken || tokenHash.length !== 64) throw new Error('link tokens must be stored as SHA-256 hashes')

90const codeHash = hashVerdunEmailCode(accountRow.id, '001234', pepper)

91if (codeHash.includes('001234') || codeHash === hashVerdunEmailCode(accountRow.id, '001234', `${pepper}-different`)) {

92 throw new Error('six-digit codes must be stored as challenge-bound, peppered HMACs')

93}

94

95const sql = fakeSql({ accountRow, passwordHash })

96const challenge = await requestVerdunEmailChallenge(sql, {

97 purpose: 'verify_email',

98 email: ' Person@Example.Test ',

Lines 144-184javascript

144})

145if (completed.account.id !== accountRow.id || completed.sessionToken.length < 40) {

146 throw new Error(`challenge completion returned an invalid account/session: ${JSON.stringify(completed)}`)

scripts/smoke-account-store.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process'

3import { mkdir, mkdtemp, readFile } from 'node:fs/promises'

High

Child Process

Package source references child process execution.

scripts/smoke-account-store.mjsView on unpkg · L1

4import { join } from 'node:path'

5

scripts/deploy-workbench-database.mjsView file

Lines 141-181javascript

141 ? 'generic workbench database load applied and deployed database gate passed'

142 : 'generic workbench database deployment preflight passed (dry run only; add --apply to load external Postgres)')

143}

144

145function optionValue(args, name) {

146

scripts/smoke-plans.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @querygraph/verdun@0.1.1 matchedIdentity = npm:QHF1ZXJ5Z3JhcGgvdmVyZHVu:0.1.1 similarity = 0.922 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/smoke-plans.mjsView on unpkg

scripts/smoke-email-auth-postgres.mjsView file

Lines 28-115javascript

28await admin.connect()

29try {

30 await admin.query(`create database ${databaseName}`)

31 client = new Client({ database: databaseName, host: '/tmp'