registry / @reckona/create-mreact-app / 0.0.186

@reckona/create-mreact-app@0.0.186

Project scaffolder for mreact app-router applications.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 144 KB of source, external domains: cdn.example.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 914-954javascript

914 </label>

915 <label class="grid gap-1 text-sm text-slate-300">

916 Password

917 <input class="rounded-md border border-slate-700 bg-slate-950 px-3 py-2" name="password" type="password" defaultValue="kanban1234" required />

918 </label>

919 <button class="rounded-md bg-cyan-300 px-4 py-2 font-medium text-slate-950" type="submit">

920 Continue

921 </button>

922 </form>

923 </main>

924 );

925}

926`;

927const dashboardLoginRouteSource = `import { createSession } from "@reckona/mreact-auth";

928import { sessions } from "../../session-store.js";

929

930// Development-only demo credentials. Replace this route with your real

931// authentication provider before deploying the dashboard starter.

932const demoAccount = {

933 email: "demo@example.com",

934 password: "kanban1234",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L934

935 roles: ["admin"],

936} as const;

937

938export async function POST(request: Request): Promise<Response> {

939 if (process.env.NODE_ENV !== "development" && process.env.NODE_ENV !== "test") {

940 return Response.json(

941 { ok: false, error: "Development-only demo credentials are disabled outside development." },

942 { status: 403 },

943 );

944 }

945

946 const form = await request.formData();

947 const email = String(form.get("email") ?? "");

948 const password = String(form.get("password") ?? "");

949

950 if (email !== demoAccount.email || password !== demoAccount.password) {

951 return Response.json({ ok: false, error: "Invalid demo credentials." }, { status: 401 });

952 }

953

954 const response = new Response(null, {

src/index.tsView file

Lines 1189-1229typescript

1189 <label class="grid gap-1 text-sm text-slate-300">

1190 Password

1191 <input class="rounded-md border border-slate-700 bg-slate-950 px-3 py-2" name="password" type="password" defaultValue="kanban1234" required />

1192 </label>

1193 <

Source & flagged code

2 flagged · loading source

dist/index.jsView file

934patternName = generic_password severity = medium line = 934 matchedText = password...34",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L934

src/index.tsView file

1209patternName = generic_password severity = medium line = 1209 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/index.ts

src/index.tsView on unpkg · L1209

Findings

3 Medium2 Low

MediumSecret Patterndist/index.js

MediumEnvironment Vars

MediumSecret Patternsrc/index.ts

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 914-954javascript

914 </label>

915 <label class="grid gap-1 text-sm text-slate-300">

916 Password

917 <input class="rounded-md border border-slate-700 bg-slate-950 px-3 py-2" name="password" type="password" defaultValue="kanban1234" required />

918 </label>

919 <button class="rounded-md bg-cyan-300 px-4 py-2 font-medium text-slate-950" type="submit">

920 Continue

921 </button>

922 </form>

923 </main>

924 );

925}

926`;

927const dashboardLoginRouteSource = `import { createSession } from "@reckona/mreact-auth";

928import { sessions } from "../../session-store.js";

929

930// Development-only demo credentials. Replace this route with your real

931// authentication provider before deploying the dashboard starter.

932const demoAccount = {

933 email: "demo@example.com",

934 password: "kanban1234",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L934

935 roles: ["admin"],

936} as const;

937

938export async function POST(request: Request): Promise<Response> {

939 if (process.env.NODE_ENV !== "development" && process.env.NODE_ENV !== "test") {

940 return Response.json(

941 { ok: false, error: "Development-only demo credentials are disabled outside development." },

942 { status: 403 },

943 );

944 }

945

946 const form = await request.formData();

947 const email = String(form.get("email") ?? "");

948 const password = String(form.get("password") ?? "");

949

950 if (email !== demoAccount.email || password !== demoAccount.password) {

951 return Response.json({ ok: false, error: "Invalid demo credentials." }, { status: 401 });

952 }

953

954 const response = new Response(null, {

src/index.tsView file

Lines 1189-1229typescript

1189 <label class="grid gap-1 text-sm text-slate-300">

1190 Password

1191 <input class="rounded-md border border-slate-700 bg-slate-950 px-3 py-2" name="password" type="password" defaultValue="kanban1234" required />

1192 </label>

1193 <