registry / @reldens/cms / 0.74.0

@reldens/cms@0.74.0

Reldens - CMS

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 397 KB of source, external domains: www.googletagmanager.com

Source & flagged code

7 flagged

bin/reldens-cms-update-password.jsView file

Lines 145-186javascript

145 Logger.error('Failed to initialize data server.');

146 return false;

147 }

148 Logger.debug('Data server initialized successfully.');

149 let success = await this.updateUserPassword(manager.dataServer, newPassword);

150 if(!success){

151 Logger.error('Password update failed.');

152 return false;

153 }

154 Logger.info('Password updated successfully!');

155 return true;

156 }

157

158 async promptPassword()

159 {

160 let rl = readline.createInterface({

161 input: process.stdin,

162 output: process.stdout

163 });

164 return new Promise((resolve) => {

165 rl.question('Enter new password: ', (password) => {

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/reldens-cms-update-password.jsView on unpkg · L165

166 rl.question('Confirm new password: ', (confirmPassword) => {

Medium

Secret Pattern

Hardcoded password in bin/reldens-cms-update-password.js

bin/reldens-cms-update-password.jsView on unpkg · L166

167 rl.close();

168 if(password !== confirmPassword){

169 Logger.error('Passwords do not match.');

170 resolve(null);

171 return;

172 }

173 resolve(password);

174 });

175 });

176 });

177 }

178

179 async updateUserPassword(dataServer, newPassword)

180 {

181 let usersEntity = dataServer.getEntity('users');

182 if(!usersEntity){

183 Logger.error('Users entity not found.');

184 return false;

185 }

186 let user = null;

Lines 195-232javascript

195 if(!user){

196 Logger.error('User not found with provided credentials.');

197 return false;

198 }

199 Logger.info('User found: '+user.email+' ('+user.username+')');

200 let encryptedPassword = Encryptor.

bin/reldens-cms.jsView file

Lines 30-71javascript

30 missingPackages.push('@prisma/client');

31 }

32 return missingPackages;

33}

35async function promptUserConfirmation(packages)

36{

37 let rl = readline.createInterface({

bin/reldens-cms-generate-entities.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3/**

4 *

5 * Reldens - CMS - Generate Entities CLI

6 *

7 */

9const { Manager } = require('../index');

10const { PrismaClientLoader }

.claude/password-management-guide.mdView file

Lines 139-179markdown

139- Password encryption is enabled by default via `PasswordEncryptionHandler`

140- If you disabled automatic encryption, passwords will be saved as plain text (not recommended)

141- Always verify encryption is enabled in production environments

142

143### Method 3: Direct Database Update

144

145For emergency situations or when CLI is not available:

146

1471. Generate encrypted password using Node.js:

148

149```javascript

Source & flagged code

7 flagged · loading source

bin/reldens-cms-update-password.jsView file

165patternName = generic_password severity = medium line = 165 matchedText = rl.quest...=> {

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/reldens-cms-update-password.jsView on unpkg · L165

166patternName = generic_password severity = medium line = 166 matchedText = rl.quest...=> {

Medium

Secret Pattern

Hardcoded password in bin/reldens-cms-update-password.js

bin/reldens-cms-update-password.jsView on unpkg · L166

215patternName = generic_password severity = medium line = 215 matchedText = Logger.e...ge);

Medium

Secret Pattern

Hardcoded password in bin/reldens-cms-update-password.js

bin/reldens-cms-update-password.jsView on unpkg · L215

bin/reldens-cms.jsView file

51Logger.info('Installing packages: npm install '+packages.join(' ')); L52: let {execSync} = require('child_process'); L53: execSync('npm install '+packages.join(' '), {stdio: 'inherit', cwd: projectRoot});

High

Child Process

Package source references child process execution.

bin/reldens-cms.jsView on unpkg · L51

50try { L51: Logger.info('Installing packages: npm install '+packages.join(' ')); L52: let {execSync} = require('child_process'); L53: execSync('npm install '+packages.join(' '), {stdio: 'inherit', cwd: projectRoot});

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/reldens-cms.jsView on unpkg · L50

bin/reldens-cms-generate-entities.jsView file

8L9: const { Manager } = require('../index'); L10: const { PrismaClientLoader } = require('@reldens/storage');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/reldens-cms-generate-entities.jsView on unpkg · L8

.claude/password-management-guide.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = SET pass...ash'

Medium

Secret Pattern

Hardcoded password in .claude/password-management-guide.md

.claude/password-management-guide.mdView on unpkg · L159

Findings

3 High8 Medium3 Low

HighChild Processbin/reldens-cms.js

HighShell

HighRuntime Package Installbin/reldens-cms.js

MediumSecret Patternbin/reldens-cms-update-password.js

MediumDynamic Requirebin/reldens-cms-generate-entities.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternbin/reldens-cms-update-password.js

MediumSecret Pattern.claude/password-management-guide.md

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/reldens-cms-update-password.jsView file

Lines 145-186javascript

145 Logger.error('Failed to initialize data server.');

146 return false;

147 }

148 Logger.debug('Data server initialized successfully.');

149 let success = await this.updateUserPassword(manager.dataServer, newPassword);

150 if(!success){

151 Logger.error('Password update failed.');

152 return false;

153 }

154 Logger.info('Password updated successfully!');

155 return true;

156 }

157

158 async promptPassword()

159 {

160 let rl = readline.createInterface({

161 input: process.stdin,

162 output: process.stdout

163 });

164 return new Promise((resolve) => {

165 rl.question('Enter new password: ', (password) => {

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/reldens-cms-update-password.jsView on unpkg · L165

166 rl.question('Confirm new password: ', (confirmPassword) => {

Medium

Secret Pattern

Hardcoded password in bin/reldens-cms-update-password.js

bin/reldens-cms-update-password.jsView on unpkg · L166

167 rl.close();

168 if(password !== confirmPassword){

169 Logger.error('Passwords do not match.');

170 resolve(null);

171 return;

172 }

173 resolve(password);

174 });

175 });

176 });

177 }

178

179 async updateUserPassword(dataServer, newPassword)

180 {

181 let usersEntity = dataServer.getEntity('users');

182 if(!usersEntity){

183 Logger.error('Users entity not found.');

184 return false;

185 }

186 let user = null;

Lines 195-232javascript

195 if(!user){

196 Logger.error('User not found with provided credentials.');

197 return false;

198 }

199 Logger.info('User found: '+user.email+' ('+user.username+')');

200 let encryptedPassword = Encryptor.

bin/reldens-cms.jsView file

Lines 30-71javascript

30 missingPackages.push('@prisma/client');

31 }

32 return missingPackages;

33}

35async function promptUserConfirmation(packages)

36{

37 let rl = readline.createInterface({

bin/reldens-cms-generate-entities.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3/**

4 *

5 * Reldens - CMS - Generate Entities CLI

6 *

7 */

9const { Manager } = require('../index');

10const { PrismaClientLoader }

.claude/password-management-guide.mdView file

Lines 139-179markdown

139- Password encryption is enabled by default via `PasswordEncryptionHandler`

140- If you disabled automatic encryption, passwords will be saved as plain text (not recommended)

141- Always verify encryption is enabled in production environments

142

143### Method 3: Direct Database Update

144

145For emergency situations or when CLI is not available:

146

1471. Generate encrypted password using Node.js:

148

149```javascript