registry / @restforgejs/platform / 5.3.18

@restforgejs/platform@5.3.18

⚠ Under review

RESTForge Platform — Schema-driven backend framework and code generator for full-stack Node.js applications. Generates production backend APIs with multi-database support (PostgreSQL, MySQL, Oracle, SQLite). A platform builder and backend runtime, not an

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 322 file(s), 5.53 MB of source, external domains: 127.0.0.1, example.com, restforge.dev, schema.getpostman.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

2 "name": "@restforgejs/platform",

3 "version": "5.3.18",

4 "description": "RESTForge Platform — Schema-driven backend framework and code generator for full-stack Node.js applications. Generates production backend APIs with multi-database support (PostgreSQL, MySQL, Oracle, SQLite). A platform builder and backend runtime, not an API testing or client tool.",

5 "main": "server.js",

6 "bin": {

7 "restforge": "server.js",

8 "restforge-consumer": "cli/consumer.js",

9 "restforge-consumer-deploy": "cli/consumer-deploy.js",

10 "restforge-designer": "cli/designer.js"

11 },

12 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L12

13 "preinstall": "node scripts/check-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test": "node --test tests/unit/**/*.test.js",

15 "test:coverage": "node --test --experimental-test-coverage tests/unit/**/*.test.js",

16 "test:watch": "node --test --watch tests/unit/**/*.test.js",

17 "test:soft-delete": "node --test tests/unit/**/*soft-delete*.test.js generators/tests/unit/**/*soft-delete*.test.js",

18 "smoke": "node tests/smoke/run-smoke.js",

19 "prepublishOnly": "node scripts/verify-publish.js"

20 },

21 "keywords": [

22 "backend-api",

23 "api-generator",

24 "express",

25 "postgresql",

26 "oracle",

27 "mysql",

28 "sqlite",

29 "restforge",

30 "module-generator",

31 "cli",

32 "backend",

33 "crud",

cli/designer.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

3'use strict';const a0_0x4c5bc4=a0_0x1ab3;(function(_0x515605,_0x2ed8f5){const _0xf1258a=a0_0x1ab3,_0x4b4f8b=_0x515605();while(!![]){try{const _0x59efad=parseInt(_0xf1258a

server.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

3const a0_0x46e71c=a0_0x2e25;(function(_0x598e87,_0xa63d25){const _0x2814bb=a0_0x2e25,_0x25b150=_0x598e87();while(!![]){try{const _0x567f91=-parseInt(_0x2814bb(0xa0f,

generators/lib/dbschema-kit/naming.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

generators/lib/dbschema-kit/naming.jsView on unpkg · L1

3const crypto = require('crypto');

5const DEFAULT_MAX_NAME_LENGTH = 30;

6const

generators/cli/fast-track.jsView file

Lines 252-292javascript

252 names = FALLBACK_TABLES.slice();

253 let n = names.length + 1;

254 while (names.length < 30) {

255 names.push(`entity-${String(

bin/restforge-designer.exeView file

•path = bin/restforge-designer.exe kind = native_binary sizeBytes = 25211904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/restforge-designer.exeView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.preinstall = node scripts/check-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

cli/designer.jsView file

2L3: 'use strict';const a0_0x4c5bc4=a0_0x1ab3;(function(_0x515605,_0x2ed8f5){const _0xf1258a=a0_0x1ab3,_0x4b4f8b=_0x515605();while(!![]){try{const _0x59efad=parseInt(_0xf1258a(0x187))/0...

High

Child Process

Package source references child process execution.

cli/designer.jsView on unpkg · L2

server.jsView file

2L3: const a0_0x46e71c=a0_0x2e25;(function(_0x598e87,_0xa63d25){const _0x2814bb=a0_0x2e25,_0x25b150=_0x598e87();while(!![]){try{const _0x567f91=-parseInt(_0x2814bb(0xa0f,'mCAi'))/(-0x2*...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server.jsView on unpkg · L2

2L3: const a0_0x46e71c=a0_0x2e25;(function(_0x598e87,_0xa63d25){const _0x2814bb=a0_0x2e25,_0x25b150=_0x598e87();while(!![]){try{const _0x567f91=-parseInt(_0x2814bb(0xa0f,'mCAi'))/(-0x2*...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server.jsView on unpkg · L2

generators/lib/dbschema-kit/naming.jsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

generators/lib/dbschema-kit/naming.jsView on unpkg · L1

generators/cli/fast-track.jsView file

272// cmd.exe (Windows) atau /bin/sh (Linux/macOS) otomatis, termasuk resolusi PATH. L273: const r = spawnSync('npx restforge-designer --version', { shell: true, encoding: 'utf8' }); L274: const found = !r.error && r.status === 0;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

generators/cli/fast-track.jsView on unpkg · L272

bin/restforge-designer.exeView file

•path = bin/restforge-designer.exe kind = native_binary sizeBytes = 25211904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/restforge-designer.exeView on unpkg

Findings

1 Critical6 High5 Medium7 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/designer.js

HighShell

HighObfuscated Payload Loaderserver.js

HighRuntime Package Installgenerators/cli/fast-track.js

HighObfuscated

MediumDynamic Requireserver.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/restforge-designer.exe

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptogenerators/lib/dbschema-kit/naming.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

2 "name": "@restforgejs/platform",

3 "version": "5.3.18",

5 "main": "server.js",

6 "bin": {

7 "restforge": "server.js",

8 "restforge-consumer": "cli/consumer.js",

9 "restforge-consumer-deploy": "cli/consumer-deploy.js",

10 "restforge-designer": "cli/designer.js"

11 },

12 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L12

13 "preinstall": "node scripts/check-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test": "node --test tests/unit/**/*.test.js",

15 "test:coverage": "node --test --experimental-test-coverage tests/unit/**/*.test.js",

16 "test:watch": "node --test --watch tests/unit/**/*.test.js",

17 "test:soft-delete": "node --test tests/unit/**/*soft-delete*.test.js generators/tests/unit/**/*soft-delete*.test.js",

18 "smoke": "node tests/smoke/run-smoke.js",

19 "prepublishOnly": "node scripts/verify-publish.js"

20 },

21 "keywords": [

22 "backend-api",

23 "api-generator",

24 "express",

25 "postgresql",

26 "oracle",

27 "mysql",

28 "sqlite",

29 "restforge",

30 "module-generator",

31 "cli",

32 "backend",

33 "crud",

cli/designer.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

3'use strict';const a0_0x4c5bc4=a0_0x1ab3;(function(_0x515605,_0x2ed8f5){const _0xf1258a=a0_0x1ab3,_0x4b4f8b=_0x515605();while(!![]){try{const _0x59efad=parseInt(_0xf1258a

server.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

3const a0_0x46e71c=a0_0x2e25;(function(_0x598e87,_0xa63d25){const _0x2814bb=a0_0x2e25,_0x25b150=_0x598e87();while(!![]){try{const _0x567f91=-parseInt(_0x2814bb(0xa0f,

generators/lib/dbschema-kit/naming.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

generators/lib/dbschema-kit/naming.jsView on unpkg · L1

3const crypto = require('crypto');

5const DEFAULT_MAX_NAME_LENGTH = 30;

6const

generators/cli/fast-track.jsView file

Lines 252-292javascript

252 names = FALLBACK_TABLES.slice();

253 let n = names.length + 1;

254 while (names.length < 30) {

255 names.push(`entity-${String(

bin/restforge-designer.exeView file

•path = bin/restforge-designer.exe kind = native_binary sizeBytes = 25211904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/restforge-designer.exeView on unpkg