registry / @stamhoofd/backend / 2.127.0

@stamhoofd/backend@2.127.0

To run, make sure you set your environment variables.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 527 file(s), 4.14 MB of source, external domains: account-test.uitid.be, account.uitid.be, api-test.uitpas.be, api.basisregisters.vlaanderen.be, api.ext.payconiq.com, api.mollie.com, api.publiq.be, api.stripe.com, checkout.buckaroo.nl, dashboard.stripe.com, docs.mollie.com, ec.europa.eu, example.com, files.stamhoofd.be, merchant.api.preprod.bancontact.net, payconiq-checkout.test, search-test.uitdatabank.be, stamhoofd.be, test.com, testcheckout.buckaroo.nl, www.example.com, www.google.com, www.stamhoofd.be

Source & flagged code

6 flagged

src/migrations/0000000001-development-user.tsView file

Lines 6-46typescript

6 if (STAMHOOFD.environment !== 'development') {

7 console.log('Skipped');

8 return;

9 }

11 // Check if total users is 0

12 const hasUser = await User.select().where('id', '!=', '1').first(false);

13 if (hasUser) {

14 console.log('Skipped, users already exist');

15 return;

16 }

18 // Create a development user with platform level admin access

19 const user = await User.register(

20 null, // No organization

21 NewUser.create({

22 id: '00000000-0000-4000-8000-000000000000',

23 firstName: 'Stamhoofd',

24 lastName: 'Development',

25 email: 'hallo@stamhoofd.be',

26 password: 'stamhoofd',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/migrations/0000000001-development-user.tsView on unpkg · L26

27 }),

28 { allowPlatform: true },

29 );

31 if (!user) {

32 throw new Error('Failed to create development user');

33 }

35 user.verified = true;

36 user.permissions = UserPermissions.create({

37 globalPermissions: Permissions.create({

38 level: PermissionLevel.Full,

39 }),

40 });

41 await user.save();

43 console.log('Created a new development user:');

44 console.log('E-mail:', user.email);

45 console.log('Password: stamhoofd');

src/helpers/BuckarooHelper.tsView file

Lines 1-24typescript

1import { SimpleError } from '@simonbackx/simple-errors';

2import type { Payment } from '@stamhoofd/models';

3import { BuckarooPayment } from '@stamhoofd/models';

4import { PaymentMethod, PaymentStatus } from '@stamhoofd/structures';

5import axios from 'axios'

src/endpoints/auth/CreateTokenEndpoint.test.tsView file

Lines 1-62typescript

1import { Request } from '@simonbackx/simple-endpoints';

2import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';

3import { Token as TokenStruct } from '@stamhoofd/structures';

5import { testServer } from '../../../tests/helpers/TestServer.js';

6import

src/endpoints/global/organizations/CreateOrganizationEndpoint.test.tsView file

Lines 8-59typescript

8describe.skip('Endpoint.CreateOrganization', () => {

9 // Test endpoint

10 const endpoint = new CreateOrganizationEndpoint();

12 test('Can create a new organization', async () => {

Source & flagged code

6 flagged · loading source

src/migrations/0000000001-development-user.tsView file

26patternName = generic_password severity = medium line = 26 matchedText = password...fd',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/migrations/0000000001-development-user.tsView on unpkg · L26

src/helpers/BuckarooHelper.tsView file

4import { PaymentMethod, PaymentStatus } from '@stamhoofd/structures'; L5: import axios from 'axios'; L6: import crypto from 'crypto'; ... L20: if (content) { L21: return crypto.createHash('md5').update(content).digest('base64'); L22: } ... L66: }, L67: data: json, L68: ... L216: L217: private getStatusFromResponse(data: any) { L218: const status: string = data['Status']?.['Code']?.['Code']?.toString() ?? '';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/helpers/BuckarooHelper.tsView on unpkg · L4

src/endpoints/auth/CreateTokenEndpoint.test.tsView file

15patternName = generic_password severity = medium line = 15 matchedText = const pa...&é';

Medium

Secret Pattern

Hardcoded password in src/endpoints/auth/CreateTokenEndpoint.test.ts

src/endpoints/auth/CreateTokenEndpoint.test.tsView on unpkg · L15

42patternName = generic_password severity = medium line = 42 matchedText = const pa...&é';

Medium

Secret Pattern

Hardcoded password in src/endpoints/auth/CreateTokenEndpoint.test.ts

src/endpoints/auth/CreateTokenEndpoint.test.tsView on unpkg · L42

src/endpoints/global/organizations/CreateOrganizationEndpoint.test.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/endpoints/global/organizations/CreateOrganizationEndpoint.test.ts

src/endpoints/global/organizations/CreateOrganizationEndpoint.test.tsView on unpkg · L28

52patternName = generic_password severity = medium line = 52 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/endpoints/global/organizations/CreateOrganizationEndpoint.test.ts

src/endpoints/global/organizations/CreateOrganizationEndpoint.test.tsView on unpkg · L52

Findings

7 Medium5 Low

MediumSecret Patternsrc/migrations/0000000001-development-user.ts

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/endpoints/auth/CreateTokenEndpoint.test.ts

MediumSecret Patternsrc/endpoints/global/organizations/CreateOrganizationEndpoint.test.ts

LowScripts Present

LowWeak Cryptosrc/helpers/BuckarooHelper.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

src/migrations/0000000001-development-user.tsView file

Lines 6-46typescript

6 if (STAMHOOFD.environment !== 'development') {

7 console.log('Skipped');

8 return;

9 }

11 // Check if total users is 0

12 const hasUser = await User.select().where('id', '!=', '1').first(false);

13 if (hasUser) {

14 console.log('Skipped, users already exist');

15 return;

16 }

18 // Create a development user with platform level admin access

19 const user = await User.register(

20 null, // No organization

21 NewUser.create({

22 id: '00000000-0000-4000-8000-000000000000',

23 firstName: 'Stamhoofd',

24 lastName: 'Development',

25 email: 'hallo@stamhoofd.be',

26 password: 'stamhoofd',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/migrations/0000000001-development-user.tsView on unpkg · L26

27 }),

28 { allowPlatform: true },

29 );

31 if (!user) {

32 throw new Error('Failed to create development user');

33 }

35 user.verified = true;

36 user.permissions = UserPermissions.create({

37 globalPermissions: Permissions.create({

38 level: PermissionLevel.Full,

39 }),

40 });

41 await user.save();

43 console.log('Created a new development user:');

44 console.log('E-mail:', user.email);

45 console.log('Password: stamhoofd');

src/helpers/BuckarooHelper.tsView file

Lines 1-24typescript

1import { SimpleError } from '@simonbackx/simple-errors';

2import type { Payment } from '@stamhoofd/models';

3import { BuckarooPayment } from '@stamhoofd/models';

4import { PaymentMethod, PaymentStatus } from '@stamhoofd/structures';

5import axios from 'axios'

src/endpoints/auth/CreateTokenEndpoint.test.tsView file

Lines 1-62typescript

1import { Request } from '@simonbackx/simple-endpoints';

2import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';

3import { Token as TokenStruct } from '@stamhoofd/structures';

5import { testServer } from '../../../tests/helpers/TestServer.js';

6import

src/endpoints/global/organizations/CreateOrganizationEndpoint.test.tsView file

Lines 8-59typescript

8describe.skip('Endpoint.CreateOrganization', () => {

9 // Test endpoint

10 const endpoint = new CreateOrganizationEndpoint();

12 test('Can create a new organization', async () => {