@realtek/core-theme@0.0.290: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@realtek/core-theme@0.0.290: Suspicious npm security report | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

Lines 25-65json

25 "dist-lib",

26 "scripts/init-admin-mongodb.js"

27 ],

28 "sideEffects": [

29 "**/*.css"

30 ],

31 "publishConfig": {

32 "access": "public",

33 "registry": "https://registry.npmjs.org/"

34 },

35 "scripts": {

36 "install:hooks": "node scripts/install-git-hooks.js",

37 "setup": "npm ci && npm run install:hooks",

38 "predev": "node scripts/install-git-hooks.js",

39 "dev": "vite",

40 "pretest": "node scripts/install-git-hooks.js",

41 "build": "vite build",

42 "prebuild": "node scripts/install-git-hooks.js",

43 "build:lib": "vite build --config vite.lib.config.js",

44 "prepare": "npm run build:lib",

45 "postinstall": "node scripts/init-admin-mongodb.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "init:mongodb": "node scripts/init-admin-mongodb.js",

47 "check:publish": "node -e \"const p=require('./package.json');const s=p.scripts||{};const bad=['preinstall','install'].filter(k=>s[k]);if(bad.length){console.error('Refusing to publish '+p.name+': remove package lifecycle script(s): '+bad.join(', '));process.exit(1)}const expectedPostinstall='node scripts/init-admin-mongodb.js --postinstall';if(s.postinstall!==expectedPostinstall){console.error('Refusing to publish '+p.name+': postinstall must be '+JSON.stringify(expectedPostinstall)+'.');process.exit(1)}const expected=['dist-lib','scripts/init-admin-mongodb.js'];if(!Array.isArray(p.files) ...

48 "prepublishOnly": "npm run check:publish && npm run build:lib",

49 "lint": "eslint .",

50 "preview": "vite preview",

51 "test": "vitest run",

52 "test:dashboard": "node scripts/run-test-dashboard.js src/testcomponent",

53 "test:dashboard:addform": "node scripts/run-test-dashboard.js src/testcomponent/AddFormTestComponent",

54 "test:dashboard:listview": "node scripts/run-test-dashboard.js src/testcomponent/ListViewTestComponent",

55 "test:dashboard:detailview": "node scripts/run-test-dashboard.js src/testcomponent/DetailViewTestComponent",

56 "test:dashboard:editform": "node scripts/run-test-dashboard.js src/testcomponent/EditFormTestComponent",

57 "test:changed-components": "node scripts/run-changed-component-tests.js",

58 "pr:test": "node scripts/run-pr-component-tests.js",

59 "pr:create": "node scripts/create-pr-with-component-tests.js",

60 "test:addform": "vitest run src/testcomponent/AddFormTestComponent",

61 "test:addform:unit": "vitest run src/testcomponent/AddFormTestComponent/unit",

62 "test:addform:integration": "vitest run src/testcomponent/AddFormTestComponent/integration",

63 "test:addform:list": "vitest list src/testcomponent/AddFormTestComponent",

64 "test:editform": "vitest run src/testcomponent/EditFormTestComponent",

65 "test:editform:unit": "vitest run src/testcomponent/EditFormTestComponent/unit",

Long lines were clipped for display.

dist-lib/index.jsView file

9745patternName = generic_password severity = medium line = 9745 matchedText = user_pwd...23*"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist-lib/index.jsView on unpkg · L9745

scripts/init-admin-mongodb.jsView file

•scripts.postinstall = node scripts/init-admin-mongodb.js --postinstall Install-time source loads the consumer project environment, connects to an embedded authenticated MongoDB endpoint, creates or alters authorization collections, seeds a default administrator and permissions, and writes an initialization marker. const DEFAULT_MONGO_URI = 'mongodb://admin:e7cH06Dy2LK2@192.168.1.88:27017/znnxt?authSource=admin&authMechanism=SCRAM-SHA-256'; function loadProjectEnv() { function writeInitMarker({ mongoUri, dbName }) { await db.createCollection(name, { validator: collectionValidator }); async function createCollections(db) { async function seedAdminUser(db) { async function seedRoleMenuPermissions(db) { await createCollections(db);

Critical

Install Time Database Administration

An install lifecycle loads the consumer environment, connects to an embedded authenticated database endpoint, mutates authorization state, and seeds a default administrator.

scripts/init-admin-mongodb.jsView on unpkg