registry  /  @restforgejs/platform  /  5.3.19

@restforgejs/platform@5.3.19

RESTForge Platform — Schema-driven backend framework and code generator for full-stack Node.js applications. Generates production backend APIs with multi-database support (PostgreSQL, MySQL, Oracle, SQLite). A platform builder and backend runtime, not an

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious install-time attack surface was found. Residual risk remains from obfuscated runtime/license code and bundled native binaries that cannot be fully audited statically from readable source.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
user invokes restforge CLI/server or consumer/designer commands
Impact
unresolved runtime visibility risk; no confirmed exfiltration or persistence
Mechanism
obfuscated commercial runtime, license validation, and bundled native tools
Rationale
Source inspection does not support a malicious verdict because the lifecycle hook is benign and risky primitives are runtime/user-invoked or package-aligned. Obfuscation, native binaries, and opaque license networking justify a warning rather than clean.
Evidence
package.jsonscripts/check-install.jsserver.jscli/consumer.jscli/consumer-deploy.jscli/designer.jssrc/utils/license-client.jsscripts/verify-integrity.jsgenerators/cli/fast-track.jsintegrity-manifest.jsonbin/restforge-designer.exebin/restforge-hwinfo.exebin/sdf-tools.exe
Network endpoints1
oauth2.googleapis.com/tokeninfo

Decision evidence

public snapshot
AI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • server.js, cli/consumer.js, cli/consumer-deploy.js, cli/designer.js are heavily obfuscated entrypoints.
  • server.js imports scripts/verify-integrity.js and exits on integrity failure at runtime.
  • src/utils/license-client.js is obfuscated and uses https plus machine/license validation logic.
  • Package ships native executables under bin/ including restforge-designer.exe and hwinfo tools.
Evidence against
  • package.json preinstall only runs scripts/check-install.js.
  • scripts/check-install.js only prints global/local install guidance and exits 0.
  • No install-time writes, credential harvesting, or AI-agent control-surface mutation found.
  • Network behavior appears package-aligned for license validation and generated app/auth templates.
  • generators/cli/fast-track.js package-manager/runtime commands are explicit user-invoked project generation flow.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 322 file(s), 5.53 MB of source, external domains: 127.0.0.1, example.com, restforge.dev, schema.getpostman.com

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg
•scripts.preinstall = node scripts/check-install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
cli/designer.jsView file
2L3: 'use strict';const a0_0x4198ab=a0_0x4fdb;function a0_0x477c(){const _0x29af9a=['tNbnrMO','nJKWmdq0mgLKELLZqW','odKZmda3tfzfrMv2','mJmYvxnIz012','zxHPDa','mZv5DhfxALi','Cgf0Aa','Aw5...
High
Child Process

Package source references child process execution.

cli/designer.jsView on unpkg · L2
server.jsView file
2L3: const a0_0x346c23=a0_0x28b8;(function(_0x30dfa8,_0x5726b5){const _0x1c3c48=a0_0x28b8,_0x282497=_0x30dfa8();while(!![]){try{const _0x3024aa=-parseInt(_0x1c3c48(0xfc7,'&Z6*'))/(0x8a2...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server.jsView on unpkg · L2
2L3: const a0_0x346c23=a0_0x28b8;(function(_0x30dfa8,_0x5726b5){const _0x1c3c48=a0_0x28b8,_0x282497=_0x30dfa8();while(!![]){try{const _0x3024aa=-parseInt(_0x1c3c48(0xfc7,'&Z6*'))/(0x8a2...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

server.jsView on unpkg · L2
generators/lib/dbschema-kit/naming.jsView file
1'use strict'; L2:
Low
Weak Crypto

Package source references weak cryptographic algorithms.

generators/lib/dbschema-kit/naming.jsView on unpkg · L1
generators/cli/fast-track.jsView file
272// cmd.exe (Windows) atau /bin/sh (Linux/macOS) otomatis, termasuk resolusi PATH. L273: const r = spawnSync('npx restforge-designer --version', { shell: true, encoding: 'utf8' }); L274: const found = !r.error && r.status === 0;
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

generators/cli/fast-track.jsView on unpkg · L272
bin/restforge-designer.exeView file
•path = bin/restforge-designer.exe kind = native_binary sizeBytes = 25211904 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/restforge-designer.exeView on unpkg

Findings

1 Critical6 High5 Medium7 Low
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/designer.js
HighShell
HighObfuscated Payload Loaderserver.js
HighRuntime Package Installgenerators/cli/fast-track.js
HighObfuscated
MediumDynamic Requireserver.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/restforge-designer.exe
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptogenerators/lib/dbschema-kit/naming.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License