registry / @xiwebdesign/xicms-core / 5.5.0

@xiwebdesign/xicms-core@5.5.0

⚠ Under review

XiCMS engine: gestructureerde content, pagina's, draft/publish, admin (TipTap+Radix), SEO en beveiliging voor klantsites.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 175 file(s), 708 KB of source, external domains: book.tablebooker.com, cal.com, calendly.com, dashboard.stripe.com, firestore.googleapis.com, fonts.googleapis.com, i.ytimg.com, module.lafourchette.com, myaccount.google.com, player.vimeo.com, schema.org, wa.me, widget.bookingkit.net, widget.formitable.com, widget.salonized.com, widget.treatwell.nl, www.openstreetmap.org, www.resengo.com, www.xiwebdesign.nl, www.youtube-nocookie.com

Source & flagged code

2 flagged

dist/server/pages.jsView file

Lines 33-73javascript

33function decode(v) {

34 if (v == null) return null;

35 if ("stringValue" in v) return v.stringValue;

36 if ("integerValue" in v) return Number(v.integerValue);

37 if ("doubleValue" in v) return v.doubleValue;

38 if ("booleanValue" in v) return v.booleanValue;

39 if ("nullValue" in v) return null;

40 if ("timestampValue" in v) return v.timestampValue;

41 if ("referenceValue" in v) return v.referenceValue;

42 if ("geoPointValue" in v) return v.geoPointValue;

43 if ("arrayValue" in v) return (v.arrayValue?.values ?? []).map(decode);

44 if ("mapValue" in v) return decodeFields(v.mapValue?.fields ?? {});

45 return null;

46}

47function decodeFields(fields) {

48 return Object.fromEntries(Object.entries(fields).map(([k, x]) => [k, decode(x)]));

49}

50function eq(fieldPath, value) {

51 return { fieldFilter: { field: { fieldPath }, op: "EQUAL", value: { stringValue: value } } };

52}

53async function restQuery(siteId, filters, limit) {

54 const apiKey = process.env.NEXT_PUBLIC_FIREBASE_API_KEY;

55 const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID;

56 if (!apiKey || !projectId) return [];

57 const url = `https://firestore.googleapis.com/v1/projects/${projectId}/databases/(default)/documents/sites/${siteId}:runQuery?key=${apiKey}`;

58 const where = filters.length === 1 ? filters[0] : { compositeFilter: { op: "AND", filters } };

59 const structuredQuery = { from: [{ collectionId: "pages" }], where };

60 if (limit) structuredQuery.limit = limit;

61 try {

62 const res = await fetch(url, {

63 method: "POST",

64 headers: { "Content-Type": "application/json" },

65 body: JSON.stringify({ structuredQuery }),

66 // Pagina's zijn ISR-gecached; next-cache mag dit hergebruiken.

67 next: { revalidate: 300 }

68 });

69 if (!res.ok) return [];

70 const rows = await res.json();

71 return rows.filter((r) => r.document).map((r) => parse(r.document.name.split("/").pop(), decodeFields(r.document.fields))).filter((p) => p !== null);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/server/pages.jsView on unpkg · L53

72 } catch (err) {

73 console.error("[xicms] Firestore REST-query mislukt:", err);

dist/XiCMSProvider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xiwebdesign/xicms-core@4.18.0 matchedIdentity = npm:QHhpd2ViZGVzaWduL3hpY21zLWNvcmU:4.18.0 similarity = 0.483 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/XiCMSProvider.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/server/pages.jsView file

53async function restQuery(siteId, filters, limit) { L54: const apiKey = process.env.NEXT_PUBLIC_FIREBASE_API_KEY; L55: const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID; L56: if (!apiKey || !projectId) return []; L57: const url = `https://firestore.googleapis.com/v1/projects/${projectId}/databases/(default)/documents/sites/${siteId}:runQuery?key=${apiKey}`; L58: const where = filters.length === 1 ? filters[0] : { compositeFilter: { op: "AND", filters } }; ... L64: headers: { "Content-Type": "application/json" }, L65: body: JSON.stringify({ structuredQuery }), L66: // Pagina's zijn ISR-gecached; next-cache mag dit hergebruiken. ... L69: if (!res.ok) return []; L70: const rows = await res.json(); L71: return rows.filter((r) => r.document).map((r) => parse(r.document.name.split("/").pop(), decodeFields(r.document.fields))).filter((p) => p !== null);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/server/pages.jsView on unpkg · L53

dist/XiCMSProvider.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/XiCMSProvider.jsView on unpkg

Findings

1 Critical1 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/XiCMSProvider.js

HighCredential Exfiltrationdist/server/pages.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/server/pages.jsView file

Lines 33-73javascript

33function decode(v) {

34 if (v == null) return null;

35 if ("stringValue" in v) return v.stringValue;

36 if ("integerValue" in v) return Number(v.integerValue);

37 if ("doubleValue" in v) return v.doubleValue;

38 if ("booleanValue" in v) return v.booleanValue;

39 if ("nullValue" in v) return null;

40 if ("timestampValue" in v) return v.timestampValue;

41 if ("referenceValue" in v) return v.referenceValue;

42 if ("geoPointValue" in v) return v.geoPointValue;

43 if ("arrayValue" in v) return (v.arrayValue?.values ?? []).map(decode);

44 if ("mapValue" in v) return decodeFields(v.mapValue?.fields ?? {});

45 return null;

46}

47function decodeFields(fields) {

48 return Object.fromEntries(Object.entries(fields).map(([k, x]) => [k, decode(x)]));

49}

50function eq(fieldPath, value) {

51 return { fieldFilter: { field: { fieldPath }, op: "EQUAL", value: { stringValue: value } } };

52}

53async function restQuery(siteId, filters, limit) {

54 const apiKey = process.env.NEXT_PUBLIC_FIREBASE_API_KEY;

55 const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID;

56 if (!apiKey || !projectId) return [];

57 const url = `https://firestore.googleapis.com/v1/projects/${projectId}/databases/(default)/documents/sites/${siteId}:runQuery?key=${apiKey}`;

58 const where = filters.length === 1 ? filters[0] : { compositeFilter: { op: "AND", filters } };

59 const structuredQuery = { from: [{ collectionId: "pages" }], where };

60 if (limit) structuredQuery.limit = limit;

61 try {

62 const res = await fetch(url, {

63 method: "POST",

64 headers: { "Content-Type": "application/json" },

65 body: JSON.stringify({ structuredQuery }),

66 // Pagina's zijn ISR-gecached; next-cache mag dit hergebruiken.

67 next: { revalidate: 300 }

68 });

69 if (!res.ok) return [];

70 const rows = await res.json();

71 return rows.filter((r) => r.document).map((r) => parse(r.document.name.split("/").pop(), decodeFields(r.document.fields))).filter((p) => p !== null);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/server/pages.jsView on unpkg · L53

72 } catch (err) {

73 console.error("[xicms] Firestore REST-query mislukt:", err);

dist/XiCMSProvider.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/XiCMSProvider.jsView on unpkg