registry / @simitgroup/simpleapp-generator / 2.0.3-q-alpha

@simitgroup/simpleapp-generator@2.0.3-q-alpha

frontend nuxtjs and backend nests code generator using jsonschema.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 155 file(s), 465 KB of source, external domains: paed01.github.io

Source & flagged code

6 flagged

dist/framework.jsView file

Lines 9-50javascript

9}) : (function(o, m, k, k2) {

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v) {

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || function (mod) {

19 if (mod && mod.__esModule) return mod;

20 var result = {};

21 if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);

22 __setModuleDefault(result, mod);

23 return result;

24};

25var __importDefault = (this && this.__importDefault) || function (mod) {

26 return (mod && mod.__esModule) ? mod : { "default": mod };

27};

28Object.defineProperty(exports, "__esModule", { value: true });

29exports.prepareOpenApiClient = exports.prettyNest = exports.prettyNuxt = exports.prettyMiniApi = exports.prettyMiniAppStreamlitSdk = exports.prettyMiniAppJsSdk = exports.prepareNuxt = exports.prepareProject = exports.prepareNest = exports.runCreateNuxt = exports.runCreateNest = exports.setConfiguration =

30const fs_1 = __importStar(require("fs"));

31const child_process_1 = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/framework.jsView on unpkg · L29

32const lodash_1 = __importDefault(require("lodash"));

High

Child Process

Package source references child process execution.

dist/framework.jsView on unpkg · L30

33const tslog_1 = require("tslog");

34const constants = __importStar(require("./constant"));

35const eta_1 = require("eta");

36const path_1 = __importDefault(require("path"));

37const log = new tslog_1.Logger();

38let config = {

39 jsonschemaFolder: './jsonschemas',

40 bpmnFolder: '',

41 backendFolder: './backend',

42 groupFolder: './groups',

43 langFolder: './lang',

44 backendPort: '8000',

45 mongoConnectStr: 'mongodb://127.0.0.1:27017/simpleapp',

46 mongoDbName: 'simpleapp',

47 frontendFolder: './frontend',

48 splitMobilePage: false,

49 frontendPort: '8080',

50 printFormatDir: './printformats',

Lines 80-120javascript

80 '@openapitools/openapi-generator-cli',

81 'nuxi'

82 ], { stdio: 'inherit' });

83 child.on('close', (exitCode) => {

84 const child2 = (0, child_process_1.spawn)('nest', ['new', '-p', 'pnpm', backendFolder], {

app-publish.shView file

•path = app-publish.sh kind = build_helper sizeBytes = 106 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

app-publish.shView on unpkg

templates/nuxt/assets/images/unknown.png.etaView file

•path = [redacted].png.eta kind = high_entropy_blob sizeBytes = 9597 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/nuxt/assets/images/unknown.png.etaView on unpkg

package.jsonView file

Lines 1-26json

2 "name": "@simitgroup/simpleapp-generator",

3 "version": "2.0.3q-alpha",

4 "description": "frontend nuxtjs and backend nests code generator using jsonschema.",

5 "main": "dist/index.js",

6 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

Source & flagged code

6 flagged · loading source

dist/framework.jsView file

30const fs_1 = __importStar(require("fs")); L31: const child_process_1 = require("child_process"); L32: const lodash_1 = __importDefault(require("lodash"));

High

Child Process

Package source references child process execution.

dist/framework.jsView on unpkg · L30

100if (!fs_1.default.existsSync(frontendFolder)) { L101: const child3 = (0, child_process_1.spawn)('npx', ['nuxi@latest', 'init', frontendFolder], { L102: stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/framework.jsView on unpkg · L100

29exports.prepareOpenApiClient = exports.prettyNest = exports.prettyNuxt = exports.prettyMiniApi = exports.prettyMiniAppStreamlitSdk = exports.prettyMiniAppJsSdk = exports.prepareNux... L30: const fs_1 = __importStar(require("fs")); L31: const child_process_1 = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/framework.jsView on unpkg · L29

app-publish.shView file

•path = app-publish.sh kind = build_helper sizeBytes = 106 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

app-publish.shView on unpkg

templates/nuxt/assets/images/unknown.png.etaView file

•path = [redacted].png.eta kind = high_entropy_blob sizeBytes = 9597 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/nuxt/assets/images/unknown.png.etaView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: child_process, fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

5 High3 Medium4 Low

HighChild Processdist/framework.js

HighShell

HighRuntime Package Installdist/framework.js

HighShips High Entropy Blobtemplates/nuxt/assets/images/unknown.png.eta

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requiredist/framework.js

MediumShips Build Helperapp-publish.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/framework.jsView file

Lines 9-50javascript

9}) : (function(o, m, k, k2) {

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v) {

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || function (mod) {

19 if (mod && mod.__esModule) return mod;

20 var result = {};

21 if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);

22 __setModuleDefault(result, mod);

23 return result;

24};

25var __importDefault = (this && this.__importDefault) || function (mod) {

26 return (mod && mod.__esModule) ? mod : { "default": mod };

27};

28Object.defineProperty(exports, "__esModule", { value: true });

30const fs_1 = __importStar(require("fs"));

31const child_process_1 = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/framework.jsView on unpkg · L29

32const lodash_1 = __importDefault(require("lodash"));

High

Child Process

Package source references child process execution.

dist/framework.jsView on unpkg · L30

33const tslog_1 = require("tslog");

34const constants = __importStar(require("./constant"));

35const eta_1 = require("eta");

36const path_1 = __importDefault(require("path"));

37const log = new tslog_1.Logger();

38let config = {

39 jsonschemaFolder: './jsonschemas',

40 bpmnFolder: '',

41 backendFolder: './backend',

42 groupFolder: './groups',

43 langFolder: './lang',

44 backendPort: '8000',

45 mongoConnectStr: 'mongodb://127.0.0.1:27017/simpleapp',

46 mongoDbName: 'simpleapp',

47 frontendFolder: './frontend',

48 splitMobilePage: false,

49 frontendPort: '8080',

50 printFormatDir: './printformats',

Lines 80-120javascript

80 '@openapitools/openapi-generator-cli',

81 'nuxi'

82 ], { stdio: 'inherit' });

83 child.on('close', (exitCode) => {

84 const child2 = (0, child_process_1.spawn)('nest', ['new', '-p', 'pnpm', backendFolder], {

app-publish.shView file

•path = app-publish.sh kind = build_helper sizeBytes = 106 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

app-publish.shView on unpkg

templates/nuxt/assets/images/unknown.png.etaView file

•path = [redacted].png.eta kind = high_entropy_blob sizeBytes = 9597 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/nuxt/assets/images/unknown.png.etaView on unpkg

package.jsonView file

Lines 1-26json

2 "name": "@simitgroup/simpleapp-generator",

3 "version": "2.0.3q-alpha",

4 "description": "frontend nuxtjs and backend nests code generator using jsonschema.",

5 "main": "dist/index.js",

6 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.