registry / @skalfa/skalfa-api-core / 1.0.9

@skalfa/skalfa-api-core@1.0.9

Core framework engine and foundational utilities for the Skalfa API backend.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 150 file(s), 326 KB of source, external domains: schema.getpostman.com

Source & flagged code

3 flagged

dist/commands/runner/da-migration.jsView file

Lines 11-51javascript

11// ## Create Migration Table

12// ================================

13async function ensureMigrationTable() {

14 if (!da) {

15 logger.error("ClickHouse connection (da) is not available. Ensure @skalfa/da is installed.");

16 process.exit(1);

17 }

18 await da.exec(`

19 CREATE TABLE IF NOT EXISTS ${MIGRATION_TABLE} (

20 name String,

21 executed_at DateTime DEFAULT now()

22 )

23 ENGINE = MergeTree()

24 ORDER BY (name)

25 `);

26}

27// ================================

28// ## Ensure OLAP Database Exists

29// ================================

30async function ensureDatabaseExists() {

31 // @ts-ignore

32 const { createClient } = await import("@clickhouse/client");

33 let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

34 url: "http://" + (process.env.DA_HOST || '127.0.0.1') + ':' + (process.env.DA_PORT || '8123'),

35 username: process.env.DA_USERNAME || 'default',

36 password: process.env.DA_PASSWORD || '',

37 });

38 logger.info(`Database ${process.env.DA_DATABASE || "default"} not found. Create new database...`);

39 await dac.query({ query: `CREATE DATABASE IF NOT EXISTS ${process.env.DA_DATABASE || "default"}` });

40 logger.info(`Database ${process.env.DA_DATABASE || "default"} successfully created.`);

41}

42// ================================

43// ## GET LIST OF APPLIED MIGRATIONS

44// ================================

45async function getMigratedNames() {

46 try {

47 const rows = (await da.from("migrations").select("name").get());

48 return rows.map((r) => r.name);

49 }

50 catch {

51 return [];

Lines 143-183javascript

143 return [];

144 const entries = fs.readdirSync(dir, { withFileTypes: true });

145 let files = [];

146 for (const entry of entries) {

147 const fullPath = path.join(dir, entry.name);

dist/commands/runner/barrels.jsView file

Lines 1-39javascript

1import fs from "fs";

2import path from "path";

3import { exec, execSync } from "child_process";

4import { Command } from "commander";

5import { logger } from "@utils";

Source & flagged code

3 flagged · loading source

dist/commands/runner/da-migration.jsView file

163} L164: async exec(query) { L165: if (!daClient) {

High

Child Process

Package source references child process execution.

dist/commands/runner/da-migration.jsView on unpkg · L163

31// @ts-ignore L32: const { createClient } = await import("@clickhouse/client"); L33: let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

dist/commands/runner/barrels.jsView file

19try { L20: execSync("bunx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L21: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/runner/barrels.jsView on unpkg · L19

Findings

3 High4 Medium4 Low

HighChild Processdist/commands/runner/da-migration.js

HighShell

HighRuntime Package Installdist/commands/runner/barrels.js

MediumDynamic Requiredist/commands/runner/da-migration.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/commands/runner/da-migration.jsView file

Lines 11-51javascript

11// ## Create Migration Table

12// ================================

13async function ensureMigrationTable() {

14 if (!da) {

15 logger.error("ClickHouse connection (da) is not available. Ensure @skalfa/da is installed.");

16 process.exit(1);

17 }

18 await da.exec(`

19 CREATE TABLE IF NOT EXISTS ${MIGRATION_TABLE} (

20 name String,

21 executed_at DateTime DEFAULT now()

22 )

23 ENGINE = MergeTree()

24 ORDER BY (name)

25 `);

26}

27// ================================

28// ## Ensure OLAP Database Exists

29// ================================

30async function ensureDatabaseExists() {

31 // @ts-ignore

32 const { createClient } = await import("@clickhouse/client");

33 let dac = createClient({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/runner/da-migration.jsView on unpkg · L31

34 url: "http://" + (process.env.DA_HOST || '127.0.0.1') + ':' + (process.env.DA_PORT || '8123'),

35 username: process.env.DA_USERNAME || 'default',

36 password: process.env.DA_PASSWORD || '',

37 });

38 logger.info(`Database ${process.env.DA_DATABASE || "default"} not found. Create new database...`);

39 await dac.query({ query: `CREATE DATABASE IF NOT EXISTS ${process.env.DA_DATABASE || "default"}` });

40 logger.info(`Database ${process.env.DA_DATABASE || "default"} successfully created.`);

41}

42// ================================

43// ## GET LIST OF APPLIED MIGRATIONS

44// ================================

45async function getMigratedNames() {

46 try {

47 const rows = (await da.from("migrations").select("name").get());

48 return rows.map((r) => r.name);

49 }

50 catch {

51 return [];

Lines 143-183javascript

143 return [];

144 const entries = fs.readdirSync(dir, { withFileTypes: true });

145 let files = [];

146 for (const entry of entries) {

147 const fullPath = path.join(dir, entry.name);

dist/commands/runner/barrels.jsView file

Lines 1-39javascript

1import fs from "fs";

2import path from "path";

3import { exec, execSync } from "child_process";

4import { Command } from "commander";

5import { logger } from "@utils";