registry / @wavemaker/react-codegen / 11.15.5-1.256

@wavemaker/react-codegen@11.15.5-1.256

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 158 file(s), 583 KB of source

Source & flagged code

3 flagged

templates/project/.envView file

•patternName = blocked_file severity = critical matchedText = templates/project/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/project/.envView on unpkg

src/gen-app-override-css.jsView file

Lines 21-61javascript

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.generateOverrideCSS = void 0;

37const path = __importStar(require("path"));

38const fs = __importStar(require("fs"));

39const url_1 = require("url");

40const download_packages_1 = require("./download-packages");

41const utils_1 = require("./utils");

42const dynamicImport = new Function("specifier", "return import(specifier);");

43const importFromFile = async (modulePath) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/gen-app-override-css.jsView on unpkg · L41

44 const moduleUrl = (0, url_1.pathToFileURL)(modulePath).href;

45 return dynamicImport(moduleUrl);

46};

47const groupFilesByMode = (directory) => {

48 const modeGroups = {

49 default: [], // files without a mode in the name

50 };

51 const items = fs.readdirSync(directory);

52 items.forEach((item) => {

53 const itemPath = path.join(directory, item);

54 const stats = fs.statSync(itemPath);

55 if (stats.isDirectory()) {

56 // Recursively collect from subdirectories

57 const subGroup = groupFilesByMode(itemPath);

58 for (const mode in subGroup) {

59 if (!modeGroups[mode]) {

60 modeGroups[mode] = [];

61 }

index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

Source & flagged code

3 flagged · loading source

templates/project/.envView file

•patternName = blocked_file severity = critical matchedText = templates/project/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/project/.envView on unpkg

src/gen-app-override-css.jsView file

41const utils_1 = require("./utils"); L42: const dynamicImport = new Function("specifier", "return import(specifier);"); L43: const importFromFile = async (modulePath) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/gen-app-override-css.jsView on unpkg · L41

index.jsView file

6Object.defineProperty(exports, "__esModule", { value: true }); L7: const yargs_1 = __importDefault(require("yargs")); L8: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

Findings

1 Critical3 Medium5 Low

CriticalCritical Secrettemplates/project/.env

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/gen-app-override-css.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

templates/project/.envView file

•patternName = blocked_file severity = critical matchedText = templates/project/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/project/.envView on unpkg

src/gen-app-override-css.jsView file

Lines 21-61javascript

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.generateOverrideCSS = void 0;

37const path = __importStar(require("path"));

38const fs = __importStar(require("fs"));

39const url_1 = require("url");

40const download_packages_1 = require("./download-packages");

41const utils_1 = require("./utils");

42const dynamicImport = new Function("specifier", "return import(specifier);");

43const importFromFile = async (modulePath) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/gen-app-override-css.jsView on unpkg · L41

44 const moduleUrl = (0, url_1.pathToFileURL)(modulePath).href;

45 return dynamicImport(moduleUrl);

46};

47const groupFilesByMode = (directory) => {

48 const modeGroups = {

49 default: [], // files without a mode in the name

50 };

51 const items = fs.readdirSync(directory);

52 items.forEach((item) => {

53 const itemPath = path.join(directory, item);

54 const stats = fs.statSync(itemPath);

55 if (stats.isDirectory()) {

56 // Recursively collect from subdirectories

57 const subGroup = groupFilesByMode(itemPath);

58 for (const mode in subGroup) {

59 if (!modeGroups[mode]) {

60 modeGroups[mode] = [];

61 }

index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};