registry / @reventlessdev/reventless-local / 3.0.0-alpha.115

@reventlessdev/reventless-local@3.0.0-alpha.115

Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 161 file(s), 830 KB of source, external domains: cdn.example.com

Source & flagged code

2 flagged

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

Lines 45-85javascript

45 if (match.TAG === "Ok") {

46 return Stdlib_JsError.throwWithMessage("expected Error for malformed YAML");

47 }

48});

50globalThis.test("parseString rejects entries missing required fields", async () => {

51 let match = UserStore$ReventlessLocal.parseString(`

52- username: alice

53 groups: [Editor]

54`);

55 if (match.TAG === "Ok") {

56 return Stdlib_JsError.throwWithMessage("expected Error for missing password");

57 }

58});

60globalThis.test("load(~users) registers credentials and returns InlineUsers", async () => {

61 resetAll();

62 let entries = [

63 {

64 username: "alice",

65 password: "alice-pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

66 groups: ["Editor"]

67 },

68 {

69 username: "bob",

70 password: "bob-pw",

71 groups: [],

72 userId: "u-bob"

73 }

74 ];

75 let msg = UserStore$ReventlessLocal.load(entries, undefined, undefined);

76 if (msg.TAG === "Ok") {

77 let tmp = msg._0;

78 if (typeof tmp === "object" || tmp !== "InlineUsers") {

79 Stdlib_JsError.throwWithMessage("expected InlineUsers");

80 }

81 } else {

82 Stdlib_JsError.throwWithMessage("load failed: " + msg._0);

83 }

84 let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");

85 if (result.TAG !== "Ok") {

Lines 141-181javascript

141 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

142 } else {

143 return;

144 }

145 } else if (tmp.TAG === "UsersFile") {

146 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

Source & flagged code

2 flagged · loading source

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

65patternName = generic_password severity = medium line = 65 matchedText = password...pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

161patternName = generic_password severity = medium line = 161 matchedText = password...pw",

Medium

Secret Pattern

Hardcoded password in tests/adapter/LocalAuthUserStoreTest.res.mjs

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L161

Findings

4 Medium4 Low

MediumSecret Patterntests/adapter/LocalAuthUserStoreTest.res.mjs

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntests/adapter/LocalAuthUserStoreTest.res.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

Lines 45-85javascript

45 if (match.TAG === "Ok") {

46 return Stdlib_JsError.throwWithMessage("expected Error for malformed YAML");

47 }

48});

50globalThis.test("parseString rejects entries missing required fields", async () => {

51 let match = UserStore$ReventlessLocal.parseString(`

52- username: alice

53 groups: [Editor]

54`);

55 if (match.TAG === "Ok") {

56 return Stdlib_JsError.throwWithMessage("expected Error for missing password");

57 }

58});

60globalThis.test("load(~users) registers credentials and returns InlineUsers", async () => {

61 resetAll();

62 let entries = [

63 {

64 username: "alice",

65 password: "alice-pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

66 groups: ["Editor"]

67 },

68 {

69 username: "bob",

70 password: "bob-pw",

71 groups: [],

72 userId: "u-bob"

73 }

74 ];

75 let msg = UserStore$ReventlessLocal.load(entries, undefined, undefined);

76 if (msg.TAG === "Ok") {

77 let tmp = msg._0;

78 if (typeof tmp === "object" || tmp !== "InlineUsers") {

79 Stdlib_JsError.throwWithMessage("expected InlineUsers");

80 }

81 } else {

82 Stdlib_JsError.throwWithMessage("load failed: " + msg._0);

83 }

84 let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");

85 if (result.TAG !== "Ok") {

Lines 141-181javascript

141 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

142 } else {

143 return;

144 }

145 } else if (tmp.TAG === "UsersFile") {

146 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");