Loading npm security reports…

@stacksjs/defaults@0.70.88: Suspicious npm security report (Warn) | LPM Firewall

registry / @stacksjs/defaults / 0.70.88

@stacksjs/defaults@0.70.88

Default Stacks scaffold resources (views, layouts, components, preloader) — shipped so apps consuming the framework from node_modules get the same fallback resources a vendored checkout provides. Source of truth: storage/framework/defaults.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 578 file(s), 989 KB of source, external domains: bsky.app, example.com, github.com, google.com, i.pravatar.cc, images.unsplash.com, picsum.photos, stacks.dev, stacksjs.com, staging.stacks.dev, twitter.com, www.linkedin.com, www.sitemaps.org, www.w3.org

Source & flagged code

3 flagged

resources/assets/scripts/main.tsView file

Lines 976-1016typescript

976 code: `import { User } from './models/User'

977

978// Eloquent-style queries

979const users = await User.where('active', true)

980 .orderBy('created_at', 'desc')

981 .limit(10)

982 .get()

983

984// Create new records

985await User.create({

986 name: 'John Doe',

987 email: 'john@example.com'

988})`,

989 },

990 validation: {

991 title: 'Validation',

992 code: `import { validate } from '@stacksjs/validation'

993

994const result = await validate(request.body, {

995 email: 'required|email',

996 password: 'required|min:8',

Medium

Secret Pattern

Package contains a possible secret pattern.

resources/assets/scripts/main.tsView on unpkg · L996

997 age: 'numeric|min:18'

998})

999

1000if (result.fails()) {

1001 return result.errors()

1002}`,

1003 },

1004 storage: {

1005 title: 'Storage',

1006 code: `import { Storage } from '@stacksjs/storage'

1007

1008// Store file

1009await Storage.put('avatars/user.jpg', fileData)

1010

1011// Retrieve file

1012const file = await Storage.get('avatars/user.jpg')

1013

1014// Delete file

1015await Storage.delete('avatars/user.jpg')`,

1016 },

app/Listener.tsView file

Lines 24-64typescript

25 const eventListeners = events[type]

26 if (!eventListeners || eventListeners.length === 0)

27 return

resources/assets/fonts/19de0a60.woff2View file

•path = resources/assets/fonts/19de0a60.woff2 kind = high_entropy_blob sizeBytes = 30676 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/assets/fonts/19de0a60.woff2View on unpkg

Source & flagged code

3 flagged · loading source

resources/assets/scripts/main.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code