registry / @things-factory/integration-base / 10.0.0-zeta.8

@things-factory/integration-base@10.0.0-zeta.8

Module for managing integration scenario.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 152 file(s), 539 KB of source

Source & flagged code

5 flagged

dist-server/engine/connector/headless-connector.jsView file

Lines 467-507javascript

467 await page.reload({ waitUntil: 'networkidle2', timeout: loginInfo.timeout });

468 if (loginInfo.loginRequired && loginInfo.loginSelectors.successSelector) {

469 const success = await this.resolveShadowDom(page, loginInfo.loginSelectors.shadowDomSelectors, loginInfo.loginSelectors.successSelector);

470 if (!success) {

471 throw new Error('Session invalid, login required');

472 }

473 }

474 }

475 async performLogin(page, uri, loginInfo) {

476 let lastError = null;

477 for (let attempt = 1; attempt <= loginInfo.retries; attempt++) {

478 try {

479 await page.goto(`${uri}${loginInfo.loginPagePath}`, { waitUntil: 'networkidle2', timeout: loginInfo.timeout });

480 const usernameInput = await this.resolveShadowDom(page, loginInfo.loginSelectors.shadowDomSelectors, loginInfo.loginSelectors.usernameSelector);

481 const passwordInput = await this.resolveShadowDom(page, loginInfo.loginSelectors.shadowDomSelectors, loginInfo.loginSelectors.passwordSelector);

482 const submitButton = await this.resolveShadowDom(page, loginInfo.loginSelectors.shadowDomSelectors, loginInfo.loginSelectors.submitSelector);

483 if (!usernameInput || !passwordInput || !submitButton) {

484 throw new Error(`Failed to locate login form elements ` +

485 `(username=${!!usernameInput}, password=${!!passwordInput}, submit=${!!submitButton}). ` +

486 `Selectors: username='${loginInfo.loginSelectors.usernameSelector}', ` +

487 `password='${loginInfo.loginSelectors.passwordSelector}', ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

dist-server/engine/connector/headless-connector.jsView on unpkg · L487

488 `submit='${loginInfo.loginSelectors.submitSelector}'. ` +

489 `사이트 폼 변경 가능성 — Connection params 의 *Selector 값을 실제 폼에 맞춰 덮어쓰세요.`);

490 }

491 await usernameInput.type(loginInfo.username);

492 await passwordInput.type(loginInfo.password);

493 var loginApiUrl = loginInfo.loginApiUrl ||

494 (await page.evaluate(button => {

495 const form = button.closest('form');

496 return form ? form.action : null;

497 }, submitButton));

498 if (loginApiUrl && !loginApiUrl.startsWith('http')) {

499 loginApiUrl = `${uri}${loginApiUrl}`;

500 }

501 if (!loginApiUrl) {

502 throw new Error('❌ Unable to detect login API URL!');

503 }

504 console.log('✅ Detected login API URL:', loginApiUrl);

505 const [response] = await Promise.all([

506 page.waitForResponse(response => {

507 const url = response.url();

dist-server/engine/evaluate-template.jsView file

Lines 1-38javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.evaluateTemplate = evaluateTemplate;

4exports.evaluateScript = evaluateScript;

5exports.evaluateTemplateObject = evaluateTemplateObject;

6/**

7 * Evaluate a template string with context variables using `new Function`.

dist-server/routers/scenario-view-router.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.scenarioViewRouter = void 0;

4const tslib_1 = require("tslib");

5const

dist-server/engine/task/mssql-procedure.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const env_1 = require("@things-factory/env");

4const utils_1 = require("@things-factory/utils");

package.jsonView file

Lines 1-39json

2 "name": "@things-factory/integration-base",

3 "version": "10.0.0-zeta.8",

4 "main": "dist-server/index.js",

5 "browser": "client/index.ts",

6 "things-factory": true,

7 "author"

Source & flagged code

5 flagged · loading source

dist-server/engine/connector/headless-connector.jsView file

487patternName = generic_password severity = medium line = 487 matchedText = `passwor... ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

dist-server/engine/connector/headless-connector.jsView on unpkg · L487

dist-server/engine/evaluate-template.jsView file

18const values = keys.map(k => scope[k]); L19: const fn = new Function(...keys, 'return (`' + template + '`)'); L20: return fn(...values);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-server/engine/evaluate-template.jsView on unpkg · L18

dist-server/routers/scenario-view-router.jsView file

3exports.scenarioViewRouter = void 0; L4: const tslib_1 = require("tslib"); L5: const koa_router_1 = tslib_1.__importDefault(require("koa-router"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/routers/scenario-view-router.jsView on unpkg · L3

dist-server/engine/task/mssql-procedure.jsView file

2package = @things-factory/integration-base; repositoryIdentity = things-factory; dependency = @things-factory/env L2: Object.defineProperty(exports, "__esModule", { value: true }); L3: const env_1 = require("@things-factory/env"); L4: const utils_1 = require("@things-factory/utils");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist-server/engine/task/mssql-procedure.jsView on unpkg · L2

package.jsonView file

•Runtime dependency names matching Node built-ins: readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

2 High4 Medium4 Low

HighCopied Package Dependency Bridgedist-server/engine/task/mssql-procedure.js

HighNode Builtin Dependency Squatpackage.json

MediumSecret Patterndist-server/engine/connector/headless-connector.js

MediumDynamic Requiredist-server/routers/scenario-view-router.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist-server/engine/evaluate-template.js

LowFilesystem

LowHigh Entropy Strings