registry / @xdelivered/emberflow / 0.6.2

@xdelivered/emberflow@0.6.2

Visual builder and runner for API operations modelled as node graphs, with scenarios, mocks and agent skills.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 28 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 328 file(s), 3.84 MB of source, external domains: 127.0.0.1, api.example.com, api.open-meteo.com, change-me.example.com, dev.api.example.com, example.test, geocoding-api.open-meteo.com, ntfy.sh, pradar.example.com, react.dev, registry.npmjs.org, staging.example.com, www.w3.org

Source & flagged code

18 flagged

dist/src/flows/login-flow.jsView file

Lines 5-45javascript

5 * ├─ new → welcome ─┐

6 * └─ existing → checkPlan ┴→ issueToken → result

7 *

8 * Route reads `isNew` off the fetched user: `true` takes the welcome branch,

9 * anything else falls back to `existing` and runs the plan check. Both branches

10 * converge on issueToken; on the new-user path checkPlan is skipped, so its

11 * `plan` input resolves undefined and IssueToken falls back to 'free'.

12 */

13export function createLoginFlow() {

14 const nodes = [

15 {

16 id: 'input',

17 type: 'Input',

18 label: 'Login Request',

19 position: { x: 60, y: 220 },

20 config: {

21 fields: [

22 { name: 'username', type: 'string', required: true },

23 { name: 'password', type: 'string', required: true },

24 ],

25 defaults: { username: 'ada', password: 'lovelace' },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/flows/login-flow.jsView on unpkg · L25

26 },

27 },

28 {

29 id: 'validate',

30 type: 'ValidateCredentials',

31 label: 'Validate Credentials',

32 position: { x: 300, y: 220 },

33 config: {},

34 inputMap: {

35 username: from('input', 'username'),

36 password: from('input', 'password'),

37 },

38 },

39 {

40 id: 'fetch',

41 type: 'FetchUser',

42 label: 'Fetch User',

43 position: { x: 540, y: 220 },

44 config: {},

45 inputMap: {

Lines 107-146javascript

107 { id: 'e2', source: 'fetch', target: 'route', targetHandle: 'value' },

108 { id: 'e3', source: 'route', target: 'welcome', sourceHandle

bin/commands.tsView file

Lines 1-21typescript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/commands.tsView on unpkg · L1

3import { homedir } from 'node:os';

4import

dist/server/projectConfig.jsView file

Lines 13-53javascript

13 return config;

14}

15/** The resolved emberflow.config.* path for a project dir, or undefined. */

16export function configPathFor(dir) {

17 const root = resolve(dir);

server/environmentsRoute.test.tsView file

Lines 46-86typescript

46 method: 'POST',

47 headers: { 'Content-Type': 'application/json' },

48 body: JSON.stringify({ flow: echoFlow, mode: 'step', input, environment: 'runattach' }),

studio-dist/assets/ibm-plex-mono-latin-ext-500-normal-CZ70TYgx.woffView file

•path = studio-dist/assets/ibm-plex-mono-latin-ext-500-normal-CZ70TYgx.woff kind = high_entropy_blob sizeBytes = 11768 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio-dist/assets/ibm-plex-mono-latin-ext-500-normal-CZ70TYgx.woffView on unpkg

src/nodes/login.test.tsView file

Lines 20-60typescript

20 });

22 it('result node output contains the token', async () => {

23 const flow = createLoginFlow();

24 const run

src/nodes/flow-control.test.tsView file

41patternName = generic_password severity = medium line = 41 matchedText = input: {...' },

Medium

Secret Pattern

Hardcoded password in src/nodes/flow-control.test.ts

src/nodes/flow-control.test.tsView on unpkg · L41

44patternName = generic_password severity = medium line = 44 matchedText = expect(r... });

Medium

Secret Pattern

Hardcoded password in src/nodes/flow-control.test.ts

src/nodes/flow-control.test.tsView on unpkg · L44

src/flows/login-flow.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = defaults...' },

Medium

Secret Pattern

Hardcoded password in src/flows/login-flow.ts

src/flows/login-flow.tsView on unpkg · L28

132patternName = generic_password severity = medium line = 132 matchedText = input: {...' },

Medium

Secret Pattern

Hardcoded password in src/flows/login-flow.ts

src/flows/login-flow.tsView on unpkg · L132

138patternName = generic_password severity = medium line = 138 matchedText = input: {...' },

Medium

Secret Pattern

Hardcoded password in src/flows/login-flow.ts

src/flows/login-flow.tsView on unpkg · L138

src/store/builderStore.test.tsView file

503patternName = generic_password severity = medium line = 503 matchedText = .addScen...h');

Medium

Secret Pattern

Hardcoded password in src/store/builderStore.test.ts

src/store/builderStore.test.tsView on unpkg · L503

524patternName = generic_password severity = medium line = 524 matchedText = .addScen... });

Medium

Secret Pattern

Hardcoded password in src/store/builderStore.test.ts

src/store/builderStore.test.tsView on unpkg · L524

531patternName = generic_password severity = medium line = 531 matchedText = expect(c... });

Medium

Secret Pattern

Hardcoded password in src/store/builderStore.test.ts

src/store/builderStore.test.tsView on unpkg · L531

554patternName = generic_password severity = medium line = 554 matchedText = .addScen... });

Medium

Secret Pattern

Hardcoded password in src/store/builderStore.test.ts

src/store/builderStore.test.tsView on unpkg · L554

Source & flagged code

18 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code