registry / @reventlessdev/reventless-aws / 3.0.0-alpha.210

@reventlessdev/reventless-aws@3.0.0-alpha.210

AWS adapters for Reventless

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 254 file(s), 1.14 MB of source, external domains: sqs.eu-west-1.amazonaws.com, x.appsync-api.eu-west-1.amazonaws.com

Source & flagged code

6 flagged

jest.setup.cjsView file

Lines 1-6javascript

1const { webcrypto } = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

jest.setup.cjsView on unpkg · L1

3if (typeof globalThis.crypto === "undefined") {

4 globalThis.crypto =

Source & flagged code

6 flagged · loading source

jest.setup.cjsView file

1const { webcrypto } = require("node:crypto"); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

jest.setup.cjsView on unpkg · L1

src/adapter/Runtime/ApiSchemaPush_Runtime.mjsView file

46package = @reventlessdev/reventless-aws; repositoryIdentity = reventless-core; dependency = @aws-sdk/client-appsync L46: async function updateAppSyncSchema(apiId, sdl) { L47: const { AppSyncClient, StartSchemaCreationCommand } = await import("@aws-sdk/client-appsync"); L48: const client = new AppSyncClient({});

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/adapter/Runtime/ApiSchemaPush_Runtime.mjsView on unpkg · L46

scripts/run-pg-integration-tests.shView file

•path = scripts/run-pg-integration-tests.sh kind = build_helper sizeBytes = 1894 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-pg-integration-tests.shView on unpkg

licenses-analysis.odsView file

•path = licenses-analysis.ods kind = high_entropy_blob sizeBytes = 30305 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

licenses-analysis.odsView on unpkg

•path = licenses-analysis.ods kind = compressed_blob sizeBytes = 30305 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

licenses-analysis.odsView on unpkg

•path = licenses-analysis.ods kind = nested_archive_needs_inspection sizeBytes = 30305 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

licenses-analysis.odsView on unpkg

Findings

2 High6 Medium5 Low

HighCopied Package Dependency Bridgesrc/adapter/Runtime/ApiSchemaPush_Runtime.mjs

HighShips High Entropy Bloblicenses-analysis.ods

MediumDynamic Requirejest.setup.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/run-pg-integration-tests.sh

MediumShips Compressed Bloblicenses-analysis.ods

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlicenses-analysis.ods

src/adapter/Runtime/ApiSchemaPush_Runtime.mjsView file

Lines 26-66javascript

26 countRootTypeFields,

27 isCatastrophicSchemaShrink,

28} from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";

29import {

30 baseFragment as adminBaseFragment,

31 systemCallerFieldNames,

32} from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";

34const COMP = "apiSchemaPush";

36// ── AppSync push primitives (mirror AdminEventCollectorEntryPoint.mjs) ──────────

38const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

40// Push the SDL. Bounded retry on the AppSync API-level lock ("Schema is currently being

41// altered" / ConcurrentModification) — the legacy connect-driven mkUpdateApiSchema still

42// pushes until Plan Phase 4, and a standalone-service push can also contend. The lock

43// clears in seconds, so this is NOT the plan's rejected lagging-read retry (that had no

44// ceiling). The singleton aggregate's single-shard stream already serializes THIS writer

45// against itself; this only covers cross-writer contention.

46async function updateAppSyncSchema(apiId, sdl) {

47 const { AppSyncClient, StartSchemaCreationCommand } = await import("@aws-sdk/client-appsync");

48 const client = new AppSyncClient({});

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/adapter/Runtime/ApiSchemaPush_Runtime.mjsView on unpkg · L46

49 const maxAttempts = 6;

50 for (let attempt = 1; ; attempt++) {

51 try {

52 await client.send(new StartSchemaCreationCommand({ apiId, definition: sdl }));

53 return;

54 } catch (e) {

55 const msg = (e && e.message) || String(e);

56 const locked = /being altered|ConcurrentModification|currently in the process/i.test(msg);

57 if (!locked || attempt >= maxAttempts) throw e;

58 const backoff = Math.min(1000 * 2 ** (attempt - 1), 8000);

59 log.warn(`schema push contended (${msg}) — retry ${attempt}/${maxAttempts} in ${backoff}ms`, { comp: COMP });

60 await sleep(backoff);

61 }

62 }

63}

65// Current live schema as SDL for the shrink guard. "" (not error) when the API has

66// no schema yet or introspection fails — the caller treats "" as "no baseline".