registry / @xuda.io/controller_module / 1.1.1199

@xuda.io/controller_module@1.1.1199

Xuda Controller Server Module

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 233 KB of source, external domains: api.digitalocean.com

Source & flagged code

5 flagged

index.jsView file

Lines 1492-1532javascript

1492 app_obj.replications.push(ret);

1493 const save_ret = await db.insert(app_obj);

1494 }

1495 return { system_replications, user_replications };

1496};

1497

1498const setup_replication_for_new_regional_server = async function (regional_server_id, master_server_id = 'master') {

1499 const regional_server_ret = await db_module.get_couch_doc('xuda_servers', regional_server_id);

1500 if (regional_server_ret.code < 0) {

1501 return console.error(regional_server_ret);

1502 }

1503 let master_server_ret = await db_module.get_couch_doc('xuda_servers', master_server_id);

1504 if (master_server_ret.code < 0) {

1505 return console.error(master_server_ret);

1506 }

1507

1508 const from_url = {

1509 db_server_http: 'http',

1510 db_server_location: `${master_server_ret.data.private}:5984`,

1511 db_server_username: 'admin',

1512 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1513 }; // `http://admin:G1qdwb43@${master_server_ret.data.private}:5984/`;

1514 const to_url = {

1515 db_server_http: 'http',

1516 db_server_location: `${regional_server_ret.data.private}:5984`,

1517 db_server_username: 'admin',

1518 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

1519 }; //`http://admin:G1qdwb43@${regional_server_ret.data.private}:5984/`;

1520

1521 let replications_to = await replicate_server(from_url, to_url, { create_target: true, continuous: true }, master_server_ret.data.private);

1522 // setTimeout(() => {

1523 let replications_from = await replicate_server(to_url, from_url, { continuous: true }, master_server_ret.data.private);

1524 // }, 120000);

1525

1526 // get refresh server doc

1527 let master_server_ret_new = await db_module.get_couch_doc('xuda_servers', master_server_id);

1528 if (!master_server_ret_new.data.replications) master_server_ret_new.data.replications = [];

1529 master_server_ret_new.data.replications.push({ replications_to, replications_from });

1530 await db_module.save_couch_doc('xuda_servers', master_server_ret_new.data, true);

1531};

1532

index_ms.mjsView file

Lines 1-28javascript

1// =====================================================

2// Queue wrapper – generated from index.mjs

3// Queue target : controller_module

4// =====================================================

7 import path from 'node:path';

9 const { MessageBroker } = await import(path.

index.mjsView file

Lines 4036-4077javascript

4036 }

4037

4038 await db_module.save_couch_bulk_docs('db_prj_3uh4q1zj0llw3mj4wgifh1', docs);

4039 console.log('delete_docs', 'done');

4040 };

4041

4042 const setup_replication_for_new_regional_server = async function

Source & flagged code

5 flagged · loading source

index.jsView file

1512patternName = generic_password severity = medium line = 1512 matchedText = db_serve...43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1518patternName = generic_password severity = medium line = 1518 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

index_ms.mjsView file

8L9: const { MessageBroker } = await import(path.join(process.env.XUDA_HOME, 'common', 'ms_broker.mjs')); L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index_ms.mjsView on unpkg · L8

index.mjsView file

4056patternName = generic_password severity = medium line = 4056 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.mjs

index.mjsView on unpkg · L4056

4062patternName = generic_password severity = medium line = 4062 matchedText = db_serve...43',

Medium

Secret Pattern

Hardcoded password in index.mjs

index.mjsView on unpkg · L4062

Findings

7 Medium4 Low

MediumSecret Patternindex.js

MediumDynamic Requireindex_ms.mjs

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternindex.js

MediumSecret Patternindex.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 1492-1532javascript

1492 app_obj.replications.push(ret);

1493 const save_ret = await db.insert(app_obj);

1494 }

1495 return { system_replications, user_replications };

1496};

1497

1498const setup_replication_for_new_regional_server = async function (regional_server_id, master_server_id = 'master') {

1499 const regional_server_ret = await db_module.get_couch_doc('xuda_servers', regional_server_id);

1500 if (regional_server_ret.code < 0) {

1501 return console.error(regional_server_ret);

1502 }

1503 let master_server_ret = await db_module.get_couch_doc('xuda_servers', master_server_id);

1504 if (master_server_ret.code < 0) {

1505 return console.error(master_server_ret);

1506 }

1507

1508 const from_url = {

1509 db_server_http: 'http',

1510 db_server_location: `${master_server_ret.data.private}:5984`,

1511 db_server_username: 'admin',

1512 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L1512

1513 }; // `http://admin:G1qdwb43@${master_server_ret.data.private}:5984/`;

1514 const to_url = {

1515 db_server_http: 'http',

1516 db_server_location: `${regional_server_ret.data.private}:5984`,

1517 db_server_username: 'admin',

1518 db_server_password: 'G1qdwb43',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L1518

1519 }; //`http://admin:G1qdwb43@${regional_server_ret.data.private}:5984/`;

1520

1521 let replications_to = await replicate_server(from_url, to_url, { create_target: true, continuous: true }, master_server_ret.data.private);

1522 // setTimeout(() => {

1523 let replications_from = await replicate_server(to_url, from_url, { continuous: true }, master_server_ret.data.private);

1524 // }, 120000);

1525

1526 // get refresh server doc

1527 let master_server_ret_new = await db_module.get_couch_doc('xuda_servers', master_server_id);

1528 if (!master_server_ret_new.data.replications) master_server_ret_new.data.replications = [];

1529 master_server_ret_new.data.replications.push({ replications_to, replications_from });

1530 await db_module.save_couch_doc('xuda_servers', master_server_ret_new.data, true);

1531};

1532

index_ms.mjsView file

Lines 1-28javascript

1// =====================================================

2// Queue wrapper – generated from index.mjs

3// Queue target : controller_module

4// =====================================================

7 import path from 'node:path';

9 const { MessageBroker } = await import(path.

index.mjsView file

Lines 4036-4077javascript

4036 }

4037

4038 await db_module.save_couch_bulk_docs('db_prj_3uh4q1zj0llw3mj4wgifh1', docs);

4039 console.log('delete_docs', 'done');

4040 };

4041

4042 const setup_replication_for_new_regional_server = async function