registry / @vikukumar/propvault / 0.1.5

@vikukumar/propvault@0.1.5

Enterprise Real Estate CMS and Page Builder Platform

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 23.1 KB of source, external domains: github.com

Source & flagged code

12 flagged

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView file

Lines 1-3javascript

1module.exports=[193695,(a,b,c)=>{b.exports=a.x("next/dist/shared/lib/no-fallback-error.external.js",()=>require("next/dist/shared/lib/no-fallback-error.external.js"))},78010,(a,b,c)=>{b.exports=a.r(918622)},179847,a=>{a.n(a.i(403343))},9185,a=>{a.n(a.i(729432))},872842,a=>{a.n(a.i(275164))},454897,a=>{a.n(a.i(330106))},856157,a=>{a.n(a.i(118970))},594331,a=>{a.n(a.i(860644))},715988,a=>{a.n(a.i(856952))},625766,a=>{a.n(a.i(777341))},529725,a=>{a.n(a.i(994290))},190833,a=>{a.n(a.i(746994))},605785,a=>{a.n(a.i(790588))},874793,a=>{a.n(a.i(633169))},285826,a=>{a.n(a.i(437111))},721565,a=>{a.n(a.i ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

3//# sourceMappingURL=%5Broot-of-the-server%5D__1vh47xh._.js.map

Long lines were clipped for display.

1patternName = aws_access_key severity = critical line = 1 matchedText = module.e...)}];

Critical

Secret Pattern

AWS access key ID in .next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.js

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

bin/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * PropVault — Command Line Interface (CLI)

5 * Manages framework initialization, server workflows, database updates, and plugin management.

6 */

8import fs from "fs";

9import path from "path";

10import http from

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View file

•path = .[redacted]-s.p.2bn3s6zvc0dyp.woff2 kind = high_entropy_blob sizeBytes = 48432 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

.next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.jsView file

Lines 1-20javascript

1module.exports=[211367,e=>{"use strict";var t=e.i(522734),s=e.i(814747);function i(e){return e.toLowerCase().trim().replace

.next/server/chunks/_0q5sg0f._.jsView file

Lines 1-38javascript

1module.exports=[289064,(e,t,i)=>{var s;!function(t){!function(i){var s="object"==typeof globalThis?globalThis:e.g,r=n(t);function n

.next/server/chunks/_0s80k7f._.jsView file

Lines 22-49javascript

22 @Field(UUID())`,n="string"):i.includes("INT")?(r=" @Field(UUID())",n="number"):(r=i.includes("BLOB")||i.includes("BYTEA")?" @Field(EncryptedString())":t.toUpperCase().includes("EMAIL")?` @Unique()

23 @Field(Email())`:" @Field(Email())",n="string"),a.push(r),a.push(` ${t}!: ${n};

24`)}a.push("}"),a.push(`

25`)}s.mkdirSync(r.dirname(r.resolve(t)),{recursive:!0}),s.writeFileSync(t,a.join("\n"),"utf-8")}}i.ModelGenerator=n},809460,(e,t,i)=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0}),i.VerificationToken=i.AuthSession=i.AuthAccount=i.AuthUser=void 0,i.BullDBNextAuthAdapter=c,i.createBetterAuthPlugin=l;let s=e.r(327845);class r extends s.BaseModel{}i.AuthUser=r;class n extends s.BaseModel{}i.AuthAccount=n;class a extends s.BaseModel{}i.AuthSession=a;class o extends s.BaseModel{}function c(e){return s.BaseModel.setDb(e),{createUser:async e=>(await r.create(e)).toJSON(),async getUser(e ...

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = WHERE ur...)}];

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.js

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView on unpkg · L18

.next/server/chunks/_0akbaq8._.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = WHERE ur...ec(`

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/_0akbaq8._.js

.next/server/chunks/_0akbaq8._.jsView on unpkg · L42

Source & flagged code

12 flagged · loading source

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = module.e...)}];

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = module.e...)}];

Critical

Secret Pattern

AWS access key ID in .next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.js

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

bin/cli.jsView file

11import net from "net"; L12: import { spawn, execSync } from "child_process"; L13: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L11

164console.log(`\x1b[34m[Process]\x1b[0m Running 'npm run ${command}'...`); L165: const proc = spawn("npm", ["run", command], { stdio: "inherit", shell: true }); L166: proc.on("exit", (code) => {

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L164

276try { L277: execSync("npx tsx scripts/migrate.ts", { stdio: "inherit" }); L278: console.log("\x1b[32m✔ Database migrations completed successfully.\x1b[0m");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L276

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View file

•path = .[redacted]-s.p.2bn3s6zvc0dyp.woff2 kind = high_entropy_blob sizeBytes = 48432 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

.next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = module.e...es a

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.js

.next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.jsView on unpkg · L1

.next/server/chunks/_0q5sg0f._.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = WHERE ur...name

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/_0q5sg0f._.js

.next/server/chunks/_0q5sg0f._.jsView on unpkg · L18

.next/server/chunks/_0s80k7f._.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = WHERE ur...ec(`

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/_0s80k7f._.js

.next/server/chunks/_0s80k7f._.jsView on unpkg · L42

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = WHERE ur...)}];

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.js

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView on unpkg · L18

.next/server/chunks/_0akbaq8._.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = WHERE ur...ec(`

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/_0akbaq8._.js

.next/server/chunks/_0akbaq8._.jsView on unpkg · L42

Findings

3 Critical4 High8 Medium4 Low

CriticalCritical Secret.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.js

CriticalManifest Confusionpackage.json

CriticalSecret Pattern.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.js

HighChild Processbin/cli.js

HighShellbin/cli.js

HighRuntime Package Installbin/cli.js

HighShips High Entropy Blob.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Pattern.next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.js

MediumSecret Pattern.next/server/chunks/_0q5sg0f._.js

MediumSecret Pattern.next/server/chunks/_0s80k7f._.js

MediumSecret Pattern.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.js

MediumSecret Pattern.next/server/chunks/_0akbaq8._.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView file

Lines 1-3javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

3//# sourceMappingURL=%5Broot-of-the-server%5D__1vh47xh._.js.map

Long lines were clipped for display.

1patternName = aws_access_key severity = critical line = 1 matchedText = module.e...)}];

Critical

Secret Pattern

AWS access key ID in .next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.js

.next/server/chunks/ssr/[root-of-the-server]__1vh47xh._.jsView on unpkg · L1

bin/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * PropVault — Command Line Interface (CLI)

5 * Manages framework initialization, server workflows, database updates, and plugin management.

6 */

8import fs from "fs";

9import path from "path";

10import http from

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View file

•path = .[redacted]-s.p.2bn3s6zvc0dyp.woff2 kind = high_entropy_blob sizeBytes = 48432 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2View on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

.next/server/chunks/src_lib_plugins_plugin-manager_ts_0u18ngw._.jsView file

Lines 1-20javascript

1module.exports=[211367,e=>{"use strict";var t=e.i(522734),s=e.i(814747);function i(e){return e.toLowerCase().trim().replace

.next/server/chunks/_0q5sg0f._.jsView file

Lines 1-38javascript

1module.exports=[289064,(e,t,i)=>{var s;!function(t){!function(i){var s="object"==typeof globalThis?globalThis:e.g,r=n(t);function n

.next/server/chunks/_0s80k7f._.jsView file

Lines 22-49javascript

22 @Field(UUID())`,n="string"):i.includes("INT")?(r=" @Field(UUID())",n="number"):(r=i.includes("BLOB")||i.includes("BYTEA")?" @Field(EncryptedString())":t.toUpperCase().includes("EMAIL")?` @Unique()

23 @Field(Email())`:" @Field(Email())",n="string"),a.push(r),a.push(` ${t}!: ${n};

24`)}a.push("}"),a.push(`

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView file

18patternName = generic_password severity = medium line = 18 matchedText = WHERE ur...)}];

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.js

.next/server/chunks/ssr/src_repositories_index_ts_0r1uc5x._.jsView on unpkg · L18

.next/server/chunks/_0akbaq8._.jsView file

42patternName = generic_password severity = medium line = 42 matchedText = WHERE ur...ec(`

Medium

Secret Pattern

Hardcoded password in .next/server/chunks/_0akbaq8._.js

.next/server/chunks/_0akbaq8._.jsView on unpkg · L42