registry / @reventlessdev/reventless-local / 3.0.0-alpha.118

@reventlessdev/reventless-local@3.0.0-alpha.118

Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Observed network, environment, and filesystem primitives are package-aligned local development platform behavior and require runtime API calls or configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports/calls platform/server/backend APIs at runtime

Impact

Local development services and configured local files only; no credential harvesting, remote payload execution, install-time mutation, or exfiltration found

Mechanism

local GraphQL/MCP servers, local auth, and optional SQLite storage

Rationale

Static source inspection found no install-time execution, foreign control-surface mutation, data exfiltration, credential harvesting, shell execution, or remote payload loading. Scanner hits are explained by local dev server, auth fixture, environment configuration, and local storage code.

Evidence

package.jsonsrc/Platform.res.mjssrc/adapter/Auth/UserStore.res.mjssrc/adapter/Auth/LocalAuth.res.mjssrc/adapter/DomainGraphQL_Server.res.mjssrc/adapter/MCP_ServerInstance.res.mjssrc/adapter/Backend.res.mjssrc/adapter/SqliteDriver.res.mjstests/adapter/LocalAuthUserStoreTest.res.mjs.reventless/users.yamlREVENTLESS_LOCAL_BACKEND sqlite:<path>

Network endpoints5

localhost:4000/graphqllocalhost:4001/graphqllocalhost:3001/mcplocalhost:3002/mcpws://localhost:4000/graphql

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks or bin entrypoints.
src/adapter/Auth/UserStore.res.mjs reads explicit/default .reventless/users.yaml for local auth; no exfiltration.
src/adapter/Auth/LocalAuth.res.mjs uses REVENTLESS_INMEMORY_TOKEN_SECRET only for local HMAC token signing.
src/adapter/DomainGraphQL_Server.res.mjs and MCP_ServerInstance.res.mjs start local HTTP/MCP servers only when start() is called.
src/adapter/SqliteDriver.res.mjs and Backend.res.mjs perform user-configured SQLite/local backend storage operations.
tests/adapter/LocalAuthUserStoreTest.res.mjs contains fixture passwords in tests, not real secrets.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 173 file(s), 927 KB of source, external domains: cdn.example.com

Source & flagged code

2 flagged

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

Lines 45-85javascript

45 if (match.TAG === "Ok") {

46 return Stdlib_JsError.throwWithMessage("expected Error for malformed YAML");

47 }

48});

50globalThis.test("parseString rejects entries missing required fields", async () => {

51 let match = UserStore$ReventlessLocal.parseString(`

52- username: alice

53 groups: [Editor]

54`);

55 if (match.TAG === "Ok") {

56 return Stdlib_JsError.throwWithMessage("expected Error for missing password");

57 }

58});

60globalThis.test("load(~users) registers credentials and returns InlineUsers", async () => {

61 resetAll();

62 let entries = [

63 {

64 username: "alice",

65 password: "alice-pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

66 groups: ["Editor"]

67 },

68 {

69 username: "bob",

70 password: "bob-pw",

71 groups: [],

72 userId: "u-bob"

73 }

74 ];

75 let msg = UserStore$ReventlessLocal.load(entries, undefined, undefined);

76 if (msg.TAG === "Ok") {

77 let tmp = msg._0;

78 if (typeof tmp === "object" || tmp !== "InlineUsers") {

79 Stdlib_JsError.throwWithMessage("expected InlineUsers");

80 }

81 } else {

82 Stdlib_JsError.throwWithMessage("load failed: " + msg._0);

83 }

84 let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");

85 if (result.TAG !== "Ok") {

Lines 141-181javascript

141 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

142 } else {

143 return;

144 }

145 } else if (tmp.TAG === "UsersFile") {

146 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

Source & flagged code

2 flagged · loading source

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

65patternName = generic_password severity = medium line = 65 matchedText = password...pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

161patternName = generic_password severity = medium line = 161 matchedText = password...pw",

Medium

Secret Pattern

Hardcoded password in tests/adapter/LocalAuthUserStoreTest.res.mjs

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L161

Findings

4 Medium4 Low

MediumSecret Patterntests/adapter/LocalAuthUserStoreTest.res.mjs

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntests/adapter/LocalAuthUserStoreTest.res.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

tests/adapter/LocalAuthUserStoreTest.res.mjsView file

Lines 45-85javascript

45 if (match.TAG === "Ok") {

46 return Stdlib_JsError.throwWithMessage("expected Error for malformed YAML");

47 }

48});

50globalThis.test("parseString rejects entries missing required fields", async () => {

51 let match = UserStore$ReventlessLocal.parseString(`

52- username: alice

53 groups: [Editor]

54`);

55 if (match.TAG === "Ok") {

56 return Stdlib_JsError.throwWithMessage("expected Error for missing password");

57 }

58});

60globalThis.test("load(~users) registers credentials and returns InlineUsers", async () => {

61 resetAll();

62 let entries = [

63 {

64 username: "alice",

65 password: "alice-pw",

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/adapter/LocalAuthUserStoreTest.res.mjsView on unpkg · L65

66 groups: ["Editor"]

67 },

68 {

69 username: "bob",

70 password: "bob-pw",

71 groups: [],

72 userId: "u-bob"

73 }

74 ];

75 let msg = UserStore$ReventlessLocal.load(entries, undefined, undefined);

76 if (msg.TAG === "Ok") {

77 let tmp = msg._0;

78 if (typeof tmp === "object" || tmp !== "InlineUsers") {

79 Stdlib_JsError.throwWithMessage("expected InlineUsers");

80 }

81 } else {

82 Stdlib_JsError.throwWithMessage("load failed: " + msg._0);

83 }

84 let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");

85 if (result.TAG !== "Ok") {

Lines 141-181javascript

141 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");

142 } else {

143 return;

144 }

145 } else if (tmp.TAG === "UsersFile") {

146 return Stdlib_JsError.throwWithMessage("expected Empty or DefaultFile");