registry / @terreno/api / 0.25.0

@terreno/api@0.25.0

Styled after the Django & Django REST Framework, a batteries-include framework for building REST APIs with Node/Express/Mongoose.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 50 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 230 file(s), 3.55 MB of source, external domains: 127.0.0.1, changed.example.com, chat.example, direct.example, example.com, food.com, github.com, slack.example, www.example.com, www.google.com, zoom.example

Source & flagged code

43 flagged

dist/expressServer.jsView file

Lines 171-211javascript

171 var _a, _b, _c, _d;

172 var startTime = process.hrtime.bigint();

173 var userString = "";

174 if (req.user) {

175 var type = "User";

176 if ((_a = req.user) === null || _a === void 0 ? void 0 : _a.admin) {

177 type = "Admin";

178 }

179 else if ((_b = req.user) === null || _b === void 0 ? void 0 : _b.testUser) {

180 type = "Test User";

181 }

182 else if ((_c = req.user) === null || _c === void 0 ? void 0 : _c.type) {

183 type = (_d = req.user) === null || _d === void 0 ? void 0 : _d.type;

184 }

185 userString = " <".concat(type, ":").concat(req.user.id, ">");

186 }

187 var body = "";

188 if (req.body && Object.keys(req.body).length > 0) {

189 var bodyCopy = (0, cloneDeep_1.default)(req.body);

190 if (bodyCopy.password) {

191 bodyCopy.password = "<PASSWORD>";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/expressServer.jsView on unpkg · L191

192 }

193 body = " Body: ".concat(JSON.stringify(bodyCopy));

194 }

195 if (process.env.DISABLE_LOG_ALL_REQUESTS !== "true") {

196 logger_1.logger.debug("".concat(req.method, " <- ").concat(req.url).concat(userString).concat(body));

197 }

198 (0, on_finished_1.default)(res, function () { return logRequestsFinished(req, res, startTime); });

199 next();

200};

201exports.logRequests = logRequests;

202var createRouter = function (rootPath, addRoutes, middleware) {

203 if (middleware === void 0) { middleware = []; }

204 var routePathMiddleware = function (req, _res, next) {

205 if (!req.routeMount) {

206 req.routeMount = [];

207 }

208 req.routeMount.push(rootPath);

209 next();

210 };

211 var router = express_1.default.Router();

dist/actions.test.jsView file

Lines 49-89javascript

49var __read = (this && this.__read) || function (o, n) {

50 var m = typeof Symbol === "function" && o[Symbol.iterator];

51 if (!m) return

dist/tests/bunSetup.jsView file

Lines 51-91javascript

51 if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0)

dist/auth.compile.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @terreno/api@0.24.0 matchedIdentity = npm:QHRlcnJlbm8vYXBp:0.24.0 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.compile.test.jsView on unpkg

dist/api.query.test.jsView file

Lines 488-528javascript

488 (0, bun_test_1.it)("list query by nested param", function () { return __awaiter(void 0, void 0, void 0, function () {

489 var res;

490 return __generator(this, function

dist/expressServer.test.jsView file

Lines 249-289javascript

249 (0, bun_test_1.it)("logs request with custom user type", function () {

250 var req = {

251 body: {},

252 method: "GET",

253 url: "/test",

254 user: { id: "user-123", type: "CustomType" },

255 };

dist/auth.test.jsView file

Lines 343-413javascript

343 return [4 /*yield*/, agent

344 .post("/auth/login")

345 .send({ email: "nope@example.com", password: "wrong" })

346 .expect(401)];

347 case 2:

dist/githubAuth.test.jsView file

258patternName = generic_password severity = medium line = 258 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L258

307patternName = generic_password severity = medium line = 307 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L307

732patternName = generic_password severity = medium line = 732 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L732

952patternName = generic_password severity = medium line = 952 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L952

src/githubAuth.test.tsView file

183patternName = generic_password severity = medium line = 183 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L183

223patternName = generic_password severity = medium line = 223 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L223

561patternName = generic_password severity = medium line = 561 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L561

724patternName = generic_password severity = medium line = 724 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L724

src/auth.test.tsView file

243patternName = generic_password severity = medium line = 243 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L243

251patternName = generic_password severity = medium line = 251 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L251

259patternName = generic_password severity = medium line = 259 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L259

309patternName = generic_password severity = medium line = 309 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L309

345patternName = generic_password severity = medium line = 345 matchedText = .send({e...d"})

Source & flagged code

43 flagged · loading source

dist/expressServer.jsView file

191patternName = generic_password severity = medium line = 191 matchedText = bodyCopy...D>";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/expressServer.jsView on unpkg · L191

dist/actions.test.jsView file

69// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing L70: var bun_test_1 = require("bun:test"); L71: var mongoose_1 = require("mongoose");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/actions.test.jsView on unpkg · L69

dist/tests/bunSetup.jsView file

71package = @terreno/api; repositoryIdentity = terreno; dependency = @terreno/test L71: Object.defineProperty(exports, "__esModule", { value: true }); L72: var test_1 = require("@terreno/test"); L73: var useFixtureCache = process.env.TERRENO_TEST_USE_FIXTURE_CACHE === "true";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/tests/bunSetup.jsView on unpkg · L71

dist/auth.compile.test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.compile.test.jsView on unpkg

dist/api.query.test.jsView file

508patternName = generic_password severity = medium line = 508 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/api.query.test.js

dist/api.query.test.jsView on unpkg · L508

dist/expressServer.test.jsView file

269patternName = generic_password severity = medium line = 269 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/expressServer.test.js

dist/expressServer.test.jsView on unpkg · L269

dist/auth.test.jsView file

363patternName = generic_password severity = medium line = 363 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L363

378patternName = generic_password severity = medium line = 378 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L378

393patternName = generic_password severity = medium line = 393 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L393

450patternName = generic_password severity = medium line = 450 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L450

491patternName = generic_password severity = medium line = 491 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L491

548patternName = generic_password severity = medium line = 548 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L548

615patternName = generic_password severity = medium line = 615 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L615

638patternName = generic_password severity = medium line = 638 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L638

680patternName = generic_password severity = medium line = 680 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L680

837patternName = generic_password severity = medium line = 837 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L837

849patternName = generic_password severity = medium line = 849 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L849

1628patternName = generic_password severity = medium line = 1628 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L1628

1694patternName = generic_password severity = medium line = 1694 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L1694

1747patternName = generic_password severity = medium line = 1747 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/auth.test.js

dist/auth.test.jsView on unpkg · L1747

dist/githubAuth.test.jsView file

258patternName = generic_password severity = medium line = 258 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L258

307patternName = generic_password severity = medium line = 307 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L307

732patternName = generic_password severity = medium line = 732 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L732

952patternName = generic_password severity = medium line = 952 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L952

1049patternName = generic_password severity = medium line = 1049 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L1049

src/githubAuth.test.tsView file

183patternName = generic_password severity = medium line = 183 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L183

223patternName = generic_password severity = medium line = 223 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L223

561patternName = generic_password severity = medium line = 561 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L561

724patternName = generic_password severity = medium line = 724 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L724

794patternName = generic_password severity = medium line = 794 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L794

src/auth.test.tsView file

243patternName = generic_password severity = medium line = 243 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L243

251patternName = generic_password severity = medium line = 251 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L251

259patternName = generic_password severity = medium line = 259 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L259

309patternName = generic_password severity = medium line = 309 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L309

345patternName = generic_password severity = medium line = 345 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L345

392patternName = generic_password severity = medium line = 392 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L392

443patternName = generic_password severity = medium line = 443 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L443

458patternName = generic_password severity = medium line = 458 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L458

486patternName = generic_password severity = medium line = 486 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L486

607patternName = generic_password severity = medium line = 607 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L607

619patternName = generic_password severity = medium line = 619 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L619

1122patternName = generic_password severity = medium line = 1122 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L1122

1167patternName = generic_password severity = medium line = 1167 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L1167

Findings

2 High44 Medium4 Low

HighCopied Package Dependency Bridgedist/tests/bunSetup.js

HighPrevious Version Dangerous Deltadist/auth.compile.test.js

MediumSecret Patterndist/expressServer.js

MediumDynamic Requiredist/actions.test.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/api.query.test.js

MediumSecret Patterndist/expressServer.test.js

MediumSecret Patterndist/auth.test.js

MediumSecret Patterndist/githubAuth.test.js

MediumSecret Patternsrc/githubAuth.test.ts

MediumSecret Patternsrc/auth.test.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

43 flagged

dist/expressServer.jsView file

Lines 171-211javascript

171 var _a, _b, _c, _d;

172 var startTime = process.hrtime.bigint();

173 var userString = "";

174 if (req.user) {

175 var type = "User";

176 if ((_a = req.user) === null || _a === void 0 ? void 0 : _a.admin) {

177 type = "Admin";

178 }

179 else if ((_b = req.user) === null || _b === void 0 ? void 0 : _b.testUser) {

180 type = "Test User";

181 }

182 else if ((_c = req.user) === null || _c === void 0 ? void 0 : _c.type) {

183 type = (_d = req.user) === null || _d === void 0 ? void 0 : _d.type;

184 }

185 userString = " <".concat(type, ":").concat(req.user.id, ">");

186 }

187 var body = "";

188 if (req.body && Object.keys(req.body).length > 0) {

189 var bodyCopy = (0, cloneDeep_1.default)(req.body);

190 if (bodyCopy.password) {

191 bodyCopy.password = "<PASSWORD>";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/expressServer.jsView on unpkg · L191

192 }

193 body = " Body: ".concat(JSON.stringify(bodyCopy));

194 }

195 if (process.env.DISABLE_LOG_ALL_REQUESTS !== "true") {

196 logger_1.logger.debug("".concat(req.method, " <- ").concat(req.url).concat(userString).concat(body));

197 }

198 (0, on_finished_1.default)(res, function () { return logRequestsFinished(req, res, startTime); });

199 next();

200};

201exports.logRequests = logRequests;

202var createRouter = function (rootPath, addRoutes, middleware) {

203 if (middleware === void 0) { middleware = []; }

204 var routePathMiddleware = function (req, _res, next) {

205 if (!req.routeMount) {

206 req.routeMount = [];

207 }

208 req.routeMount.push(rootPath);

209 next();

210 };

211 var router = express_1.default.Router();

dist/actions.test.jsView file

Lines 49-89javascript

49var __read = (this && this.__read) || function (o, n) {

50 var m = typeof Symbol === "function" && o[Symbol.iterator];

51 if (!m) return

dist/tests/bunSetup.jsView file

Lines 51-91javascript

51 if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0)

dist/auth.compile.test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.compile.test.jsView on unpkg

dist/api.query.test.jsView file

Lines 488-528javascript

488 (0, bun_test_1.it)("list query by nested param", function () { return __awaiter(void 0, void 0, void 0, function () {

489 var res;

490 return __generator(this, function

dist/expressServer.test.jsView file

Lines 249-289javascript

249 (0, bun_test_1.it)("logs request with custom user type", function () {

250 var req = {

251 body: {},

252 method: "GET",

253 url: "/test",

254 user: { id: "user-123", type: "CustomType" },

255 };

dist/auth.test.jsView file

Lines 343-413javascript

343 return [4 /*yield*/, agent

344 .post("/auth/login")

345 .send({ email: "nope@example.com", password: "wrong" })

346 .expect(401)];

347 case 2:

dist/githubAuth.test.jsView file

258patternName = generic_password severity = medium line = 258 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L258

307patternName = generic_password severity = medium line = 307 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L307

732patternName = generic_password severity = medium line = 732 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L732

952patternName = generic_password severity = medium line = 952 matchedText = .send({ ..." })

Medium

Secret Pattern

Hardcoded password in dist/githubAuth.test.js

dist/githubAuth.test.jsView on unpkg · L952

src/githubAuth.test.tsView file

183patternName = generic_password severity = medium line = 183 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L183

223patternName = generic_password severity = medium line = 223 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L223

561patternName = generic_password severity = medium line = 561 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L561

724patternName = generic_password severity = medium line = 724 matchedText = .send({e...3"})

Medium

Secret Pattern

Hardcoded password in src/githubAuth.test.ts

src/githubAuth.test.tsView on unpkg · L724

src/auth.test.tsView file

243patternName = generic_password severity = medium line = 243 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L243

251patternName = generic_password severity = medium line = 251 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L251

259patternName = generic_password severity = medium line = 259 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L259

309patternName = generic_password severity = medium line = 309 matchedText = .send({e...d"})

Medium

Secret Pattern

Hardcoded password in src/auth.test.ts

src/auth.test.tsView on unpkg · L309

345patternName = generic_password severity = medium line = 345 matchedText = .send({e...d"})