registry / @things-factory/integration-base / 10.0.0-zeta.8

@things-factory/integration-base@10.0.0-zeta.8

Module for managing integration scenario.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 152 file(s), 539 KB of source

Source & flagged code

5 flagged

dist-server/engine/connector/headless-connector.jsView file

Lines 467-507javascript

467 await page.reload({ waitUntil: 'networkidle2', timeout: loginInfo.timeout });

468 if (loginInfo.loginRequired && loginInfo.loginSelectors.successSelector) {

469 const success = await this.resolveShadowDom(page, loginInfo.loginSelectors.shadowDomSelectors, loginInfo.loginSelectors.successSelector);

Source & flagged code

5 flagged · loading source

dist-server/engine/connector/headless-connector.jsView file

487patternName = generic_password severity = medium line = 487 matchedText = `passwor... ` +

Medium

Secret Pattern

Package contains a possible secret pattern.

dist-server/engine/connector/headless-connector.jsView on unpkg · L487

dist-server/engine/evaluate-template.jsView file

18const values = keys.map(k => scope[k]); L19: const fn = new Function(...keys, 'return (`' + template + '`)'); L20: return fn(...values);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-server/engine/evaluate-template.jsView on unpkg · L18

dist-server/routers/scenario-view-router.jsView file

3exports.scenarioViewRouter = void 0; L4: const tslib_1 = require("tslib"); L5: const koa_router_1 = tslib_1.__importDefault(require("koa-router"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/routers/scenario-view-router.jsView on unpkg · L3

dist-server/engine/task/mssql-procedure.jsView file

2package = @things-factory/integration-base; repositoryIdentity = things-factory; dependency = @things-factory/env L2: Object.defineProperty(exports, "__esModule", { value: true }); L3: const env_1 = require("@things-factory/env"); L4: const utils_1 = require("@things-factory/utils");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist-server/engine/task/mssql-procedure.jsView on unpkg · L2

package.jsonView file

•Runtime dependency names matching Node built-ins: readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

2 High4 Medium4 Low

HighCopied Package Dependency Bridgedist-server/engine/task/mssql-procedure.js

HighNode Builtin Dependency Squatpackage.json

MediumSecret Patterndist-server/engine/connector/headless-connector.js

MediumDynamic Requiredist-server/routers/scenario-view-router.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist-server/engine/evaluate-template.js

LowFilesystem

LowHigh Entropy Strings

dist-server/engine/evaluate-template.jsView file

Lines 1-38javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.evaluateTemplate = evaluateTemplate;

4exports.evaluateScript = evaluateScript;

5exports.evaluateTemplateObject = evaluateTemplateObject;

6/**

7 * Evaluate a template string with context variables using `new Function`.

8 *

9 * Replaces the former SES `Compartment.evaluate('`' + tpl + '`')` pattern.

10 * The template is evaluated as a JS template literal, so `${data.foo}` works.

11 *

12 * @param template - The raw template string (without surrounding back-ticks)

13 * @param scope - An object whose keys become local variable names

14 * @returns The interpolated string

15 */

16function evaluateTemplate(template, scope) {

17 const keys = Object.keys(scope);

18 const values = keys.map(k => scope[k]);

19 const fn = new Function(...keys, 'return (`' + template + '`)');

20 return fn(...values);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-server/engine/evaluate-template.jsView on unpkg · L18

21}

22/**

23 * Evaluate an arbitrary script string with context variables using `new Function`.

24 *

25 * Replaces the former SES `Compartment.evaluate(script)` pattern.

26 *

27 * @param script - The JavaScript source to execute

28 * @param scope - An object whose keys become local variable names inside the script

29 * @param thisArg - Optional `this` binding. SES Compartment 시절의 `this.X` 패턴

30 * 호환을 위해 보통 `scope` 자체를 넘긴다 — 그러면 script 내부에서

31 * `X` 직접 접근과 `this.X` 둘 다 동일 객체를 가리킴.

32 * thisArg 를 scope 보다 넓은 객체로 넘기면 platform internal 까지

33 * 노출되므로 권장하지 않음.

34 * @returns The result of the script evaluation

35 */

36function evaluateScript(script, scope, thisArg) {

37 const keys = Object.keys(scope);

38 const values = keys.map(k => scope[k]);

dist-server/routers/scenario-view-router.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.scenarioViewRouter = void 0;

4const tslib_1 = require("tslib");

5const koa_router_1 = tslib_1.__importDefault(require("koa-router"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/routers/scenario-view-router.jsView on unpkg · L3

6const shell_1 = require("@things-factory/shell");

7const scenario_1 = require("../service/scenario/scenario");

8exports.scenarioViewRouter = new koa_router_1.default();

9exports.scenarioViewRouter.get('/scenario-view/:name', async (context, next) => {

10 const { domain } = context.state;

11 const { name } = context.params;

12 const scenario = await (0, shell_1.getRepository)(scenario_1.Scenario).findOne({

13 where: {

14 domain: { id: domain.id },

15 name

16 },

17 relations: ['steps']

18 });

19 const steps = scenario.steps;

20 const nodes = {};

21 const edges = [];

22 steps.forEach(({ id, name }) => {

23 nodes[id] = {

dist-server/engine/task/mssql-procedure.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const env_1 = require("@things-factory/env");

4const utils_1 = require("@things-factory/utils");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist-server/engine/task/mssql-procedure.jsView on unpkg · L2

5const connection_manager_1 = require("../connection-manager");

6const evaluate_template_1 = require("../evaluate-template");

7const task_registry_1 = require("../task-registry");

8try {

9 var mssql = require('mssql');

10}

11catch (err) {

12 env_1.logger.error('mssql module loading failed', err);

13}

14const DIR = {

15 In: 'in',

16 Out: 'out',

17 Inout: 'inout' /* 초기값이 있는 out 파라미터 */

18};

19const NUMBER_TYPES = [

20 'TINYINT',

21 'SMALLINT',

22 'INT',

package.jsonView file

Lines 1-39json

2 "name": "@things-factory/integration-base",

3 "version": "10.0.0-zeta.8",

4 "main": "dist-server/index.js",

5 "browser": "client/index.ts",

6 "things-factory": true,

7 "author": "heartyoh <heartyoh@hatiolab.com>",

8 "description": "Module for managing integration scenario.",

9 "license": "MIT",

10 "publishConfig": {

11 "access": "public",

12 "@things-factory:registry": "https://registry.npmjs.org"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/hatiolab/things-factory.git",

17 "directory": "packages/integration-base"

18 },

19 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L19

20 "build": "tsc --p tsconfig.json",

21 "build:server": "npm run clean:server && tsc",

22 "clean:server": "rm -rf dist-server",

23 "clean": "npm run clean:server",

24 "migration:create": "node ../../node_modules/typeorm/cli.js migration:create ./server/migrations/migration",

25 "test": "NODE_ENV=test DEBUG=things-factory:* jest",

26 "lint": "eslint 'server/**/*.ts' 'client/**/*.ts' --max-warnings 0",

27 "lint:fix": "eslint 'server/**/*.ts' 'client/**/*.ts' --fix",

28 "lint:check": "eslint 'server/**/*.ts' 'client/**/*.ts' --max-warnings 0 --quiet",

29 "typecheck": "tsc --noEmit",

30 "check": "npm run lint:check && npm run typecheck"

31 },

32 "dependencies": {

33 "@apollo/client": "^3.6.9",

34 "@operato/moment-timezone-es": "^10.0.0-beta.1",

35 "@things-factory/api": "^10.0.0-zeta.8",

36 "@things-factory/auth-base": "^10.0.0-zeta.8",

37 "@things-factory/cache-service": "^10.0.0-zeta.8",

38 "@things-factory/env": "^10.0.0-zeta.8",

39 "@things-factory/oauth2-client": "^10.0.0-zeta.8",