registry / @stacksjs/defaults / 0.70.111

@stacksjs/defaults@0.70.111

Default Stacks scaffold resources (views, layouts, components, preloader) — shipped so apps consuming the framework from node_modules get the same fallback resources a vendored checkout provides. Source of truth: storage/framework/defaults.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 601 file(s), 1022 KB of source, external domains: bsky.app, example.com, github.com, google.com, images.unsplash.com, stacks.dev, stacksjs.com, staging.stacks.dev, twitter.com, www.linkedin.com, www.sitemaps.org, www.w3.org

Source & flagged code

3 flagged

resources/assets/scripts/main.tsView file

Lines 976-1016typescript

976 code: `import { User } from './models/User'

977

978// Eloquent-style queries

979const users = await User.where('active', true)

980 .orderBy('created_at', 'desc')

981 .limit(10)

982 .get()

983

984// Create new records

Source & flagged code

3 flagged · loading source

resources/assets/scripts/main.tsView file

996patternName = generic_password severity = medium line = 996 matchedText = password...:8',

Medium

Secret Pattern

Package contains a possible secret pattern.

resources/assets/scripts/main.tsView on unpkg · L996

app/Listener.tsView file

44try { L45: const imported = await import(p.appPath(`Actions/${listener}.ts`)) L46: const actionModule = imported.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/Listener.tsView on unpkg · L44

resources/assets/fonts/19de0a60.woff2View file

•path = resources/assets/fonts/19de0a60.woff2 kind = high_entropy_blob sizeBytes = 30676 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/assets/fonts/19de0a60.woff2View on unpkg

Findings

1 High5 Medium4 Low

HighShips High Entropy Blobresources/assets/fonts/19de0a60.woff2

MediumSecret Patternresources/assets/scripts/main.ts

MediumDynamic Requireapp/Listener.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

3 flagged

resources/assets/scripts/main.tsView file

Lines 976-1016typescript

976 code: `import { User } from './models/User'

977

978// Eloquent-style queries

979const users = await User.where('active', true)

980 .orderBy('created_at', 'desc')

981 .limit(10)

982 .get()

983

984// Create new records

985await User.create({

986 name: 'John Doe',

987 email: 'john@example.com'

988})`,

989 },

990 validation: {

991 title: 'Validation',

992 code: `import { validate } from '@stacksjs/validation'

993

994const result = await validate(request.body, {

995 email: 'required|email',

996 password: 'required|min:8',

Medium

Secret Pattern

Package contains a possible secret pattern.

resources/assets/scripts/main.tsView on unpkg · L996

997 age: 'numeric|min:18'

998})

999

1000if (result.fails()) {

1001 return result.errors()

1002}`,

1003 },

1004 storage: {

1005 title: 'Storage',

1006 code: `import { Storage } from '@stacksjs/storage'

1007

1008// Store file

1009await Storage.put('avatars/user.jpg', fileData)

1010

1011// Retrieve file

1012const file = await Storage.get('avatars/user.jpg')

1013

1014// Delete file

1015await Storage.delete('avatars/user.jpg')`,

1016 },

app/Listener.tsView file

Lines 24-64typescript

24

25 const eventListeners = events[type]

26 if (!eventListeners || eventListeners.length === 0)

27 return

28

29 // Fire-and-forget with error handling — mitt doesn't await wildcard handlers

30 processListeners(type as string, eventListeners, event)

31}

32

33async function resolveAction(listener: string): Promise<{ handle: (event: any) => Promise<any> | any } | null

34 // Check cache first

35 const cached = actionCache.get(listener)

36 if (cached) return cached

37

38 // Check if an import is already in-flight

39 let pending = pendingImports.get(listener)

40 if (pending) return pending

41

42 // Start the import and cache the promise to deduplicate concurrent calls

43 pending = (async () => {

44 try {

45 const imported = await import(p.appPath(`Actions/${listener}.ts`))

46 const actionModule = imported.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/Listener.tsView on unpkg · L44

47 if (actionModule && typeof actionModule.handle === 'function') {

48 actionCache.set(listener, actionModule)

49 return actionModule

50 }

51 handleError(`Action "${listener}" does not export a handle method`)

52 return null

53 }

54 catch (error) {

55 handleError(`Failed to import action "${listener}"`, error)

56 return null

57 }

58 finally {

59 pendingImports.delete(listener)

60 }

61 })()

62

63 pendingImports.set(listener, pending)

64 return pending

resources/assets/fonts/19de0a60.woff2View file

•path = resources/assets/fonts/19de0a60.woff2 kind = high_entropy_blob sizeBytes = 30676 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/assets/fonts/19de0a60.woff2View on unpkg

> {