registry / @tahminator/pipeline / 1.0.66

@tahminator/pipeline@1.0.66

A collection of Bun shell scripts that can be re-used in various CICD pipelines.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 54 file(s), 54.2 KB of source, external domains: github.com, sonarcloud.io, www.npmjs.com

Source & flagged code

1 flagged

dist/postgres/client.jsView file

Lines 18-58javascript

18 // get credentials

19 const { database, host, port, password, user } = pgClient.state;

21 $.env({

22 ...process.env,

23 DB_HOST: host,

24 DB_PORT: String(port),

25 DB_NAME: database,

26 DB_USERNAME: user,

27 DB_PASSWORD: password,

28 })`just migrate`

30 // `pgClient` will be automatically cleaned up at the end of the scope.

31 }

32 * ```

33 */

34 static async create(state) {

35 const iState = {

36 ...state,

37 user: "postgres",

38 password: "postgres",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres/client.jsView on unpkg · L38

39 port: 5432,

40 host: "127.0.0.1",

41 dockerName: `local-db-${randomUUIDv7()}`,

42 };

43 const hostPort = await this.launch(iState);

44 iState.port = hostPort;

45 await this.waitUntilReady(iState);

46 return new this(iState);

47 }

48 static async launch(iState) {

49 await $ `docker run -d \

50 --name ${iState.dockerName} \

51 -e POSTGRES_USER=${iState.user} \

52 -e POSTGRES_PASSWORD=${iState.password} \

53 -e POSTGRES_DB=${iState.database} \

54 -p 5432 \

55 mirror.gcr.io/library/postgres:16-alpine`;

56 const raw = (await $ `docker port ${iState.dockerName} 5432/tcp`.text()).trim();

57 const match = raw.match(/:(\d+)/);

58 if (!match) {

Source & flagged code

1 flagged · loading source

dist/postgres/client.jsView file

38patternName = generic_password severity = medium line = 38 matchedText = password...es",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres/client.jsView on unpkg · L38

Findings

3 Medium5 Low

MediumSecret Patterndist/postgres/client.js

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dist/postgres/client.jsView file

Lines 18-58javascript

18 // get credentials

19 const { database, host, port, password, user } = pgClient.state;

21 $.env({

22 ...process.env,

23 DB_HOST: host,

24 DB_PORT: String(port),

25 DB_NAME: database,

26 DB_USERNAME: user,

27 DB_PASSWORD: password,

28 })`just migrate`

30 // `pgClient` will be automatically cleaned up at the end of the scope.

31 }

32 * ```

33 */

34 static async create(state) {

35 const iState = {

36 ...state,

37 user: "postgres",

38 password: "postgres",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/postgres/client.jsView on unpkg · L38

39 port: 5432,

40 host: "127.0.0.1",

41 dockerName: `local-db-${randomUUIDv7()}`,

42 };

43 const hostPort = await this.launch(iState);

44 iState.port = hostPort;

45 await this.waitUntilReady(iState);

46 return new this(iState);

47 }

48 static async launch(iState) {

49 await $ `docker run -d \

50 --name ${iState.dockerName} \

51 -e POSTGRES_USER=${iState.user} \

52 -e POSTGRES_PASSWORD=${iState.password} \

53 -e POSTGRES_DB=${iState.database} \

54 -p 5432 \

55 mirror.gcr.io/library/postgres:16-alpine`;

56 const raw = (await $ `docker port ${iState.dockerName} 5432/tcp`.text()).trim();

57 const match = raw.match(/:(\d+)/);

58 if (!match) {