registry / @zenith-open/zenithcms-core / 1.0.0-beta.1

@zenith-open/zenithcms-core@1.0.0-beta.1

Zenith CMS â€” headless engine with REST, GraphQL, and AI tools

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 232 file(s), 1.30 MB of source, external domains: accounts.google.com, api.anthropic.com, api.cohere.com, api.github.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, api.x.ai, dummy-test-file-url-12345.public.blob.vercel-storage.com, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, oauth2.googleapis.com, openrouter.ai, production.zenithcms.internal, storage.googleapis.com, www.googleapis.com, www.paypal.com, zenithcms.com

Source & flagged code

5 flagged

dist/packages/core/src/api/auth/sso.jsView file

Lines 11-51javascript

11 if (env.NODE_ENV === 'production') {

12 throw new Error('ADMIN_URL environment variable is required in production');

13 }

14 return 'http://localhost:5173';

15}

16/**

17 * Shared handler for all SSO providers to upsert user and generate Zenith tokens

18 */

19async function handleSsoSuccess(req, res, next) {

20 try {

21 const profile = req.user;

22 if (!profile)

23 throw new AuthenticationError('SSO authentication failed: no profile received');

24 // 1. Upsert user in database

25 const adapter = AdapterFactory.getActiveAdapter();

26 const existing = await adapter.find('users', { email: profile.email });

27 let user = existing[0];

28 if (!user) {

29 user = await adapter.create('users', {

30 email: profile.email.toLowerCase(),

31 password: 'sso-managed-account',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L31

32 role: profile.role || 'editor',

33 ssoId: profile.id

34 });

35 }

36 // 2. Generate Zenith Session Tokens

37 const userId = (user.id || user._id).toString();

38 const payload = { id: userId, email: user.email, role: user.role };

39 const accessToken = AuthService.generateToken(payload);

40 const refreshToken = AuthService.generateRefreshToken(payload);

41 res.cookie('refreshToken', refreshToken, {

42 httpOnly: true,

43 secure: env.NODE_ENV === 'production',

44 sameSite: 'strict',

45 maxAge: 7 * 24 * 60 * 60 * 1000,

46 });

47 res.cookie('accessToken', accessToken, {

48 httpOnly: true,

49 secure: env.NODE_ENV === 'production',

50 sameSite: 'strict',

51 maxAge: 15 * 60 * 1000,

dist/packages/core/src/cli/index.jsView file

Lines 217-257javascript

217 }

218 },

219 });

220 if (options.dryRun) {

221 console.log('\n DRY RUN — no data will be written to Zenith.\n');

222 }

223 await migrator.run();

224 process.

dist/packages/core/src/database/adapters/AotBridge.jsView file

Lines 10-50javascript

10 * Bypasses dynamic schema/query construction in Mongo/Postgres drivers

11 * for optimized direct executions.

12 */

13export class AotBridge {

14 static compiledModule = null;

dist/packages/core/src/services/flow-engine.jsView file

Lines 101-141javascript

101 (!config.action || config.action === action)) {

102 shouldTrigger = true;

103 }

104 }

105 }

106 if (shouldTrigger) {

107 logger.info({ flowId: flow._id, name: flow.name }, 'Triggering flow execution'

dist/packages/core/src/api/system.jsView file

Lines 1191-1231javascript

1191 const keyHash = crypto.createHash('sha256').update(rawKey).digest('hex');

1192 const apiKey = await adapter.create('z_api_keys', {

1193 name: keyName ||

Source & flagged code

5 flagged · loading source

dist/packages/core/src/api/auth/sso.jsView file

31patternName = generic_password severity = medium line = 31 matchedText = password...nt',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L31

dist/packages/core/src/cli/index.jsView file

237const prompts = require('prompts'); L238: const { execSync } = require('child_process'); L239: console.log('\n======================================');

High

Child Process

Package source references child process execution.

dist/packages/core/src/cli/index.jsView on unpkg · L237

dist/packages/core/src/database/adapters/AotBridge.jsView file

30try { L31: // Convert absolute Windows paths to file:// URLs for ESM import() compatibility L32: const fileUrl = pathToFileURL(fileToLoad).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/core/src/database/adapters/AotBridge.jsView on unpkg · L30

dist/packages/core/src/services/flow-engine.jsView file

121status: 'running', L122: context: { payload, env: process.env }, L123: completedNodes: {}, ... L321: else { L322: const headers = config.headers ? JSON.parse(config.headers) : {}; L323: const body = config.body ? JSON.parse(config.body) : context.payload || context; L324: const method = config.method || 'POST'; L325: const res = await fetch(config.url, { L326: method, L327: headers: { 'Content-Type': 'application/json', ...headers }, L328: body: method !== 'GET' ? JSON.stringify(body) : undefined L329: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/packages/core/src/services/flow-engine.jsView on unpkg · L121

dist/packages/core/src/api/system.jsView file

1211try { L1212: execSync(`npx tsx ${scriptPath}`, { stdio: 'inherit' }); L1213: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/core/src/api/system.jsView on unpkg · L1211

Findings

2 High6 Medium5 Low

HighChild Processdist/packages/core/src/cli/index.js

HighRuntime Package Installdist/packages/core/src/api/system.js

MediumSecret Patterndist/packages/core/src/api/auth/sso.js

MediumDynamic Requiredist/packages/core/src/database/adapters/AotBridge.js

MediumUnsafe Vm Contextdist/packages/core/src/services/flow-engine.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/packages/core/src/api/auth/sso.jsView file

Lines 11-51javascript

11 if (env.NODE_ENV === 'production') {

12 throw new Error('ADMIN_URL environment variable is required in production');

13 }

14 return 'http://localhost:5173';

15}

16/**

17 * Shared handler for all SSO providers to upsert user and generate Zenith tokens

18 */

19async function handleSsoSuccess(req, res, next) {

20 try {

21 const profile = req.user;

22 if (!profile)

23 throw new AuthenticationError('SSO authentication failed: no profile received');

24 // 1. Upsert user in database

25 const adapter = AdapterFactory.getActiveAdapter();

26 const existing = await adapter.find('users', { email: profile.email });

27 let user = existing[0];

28 if (!user) {

29 user = await adapter.create('users', {

30 email: profile.email.toLowerCase(),

31 password: 'sso-managed-account',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L31

32 role: profile.role || 'editor',

33 ssoId: profile.id

34 });

35 }

36 // 2. Generate Zenith Session Tokens

37 const userId = (user.id || user._id).toString();

38 const payload = { id: userId, email: user.email, role: user.role };

39 const accessToken = AuthService.generateToken(payload);

40 const refreshToken = AuthService.generateRefreshToken(payload);

41 res.cookie('refreshToken', refreshToken, {

42 httpOnly: true,

43 secure: env.NODE_ENV === 'production',

44 sameSite: 'strict',

45 maxAge: 7 * 24 * 60 * 60 * 1000,

46 });

47 res.cookie('accessToken', accessToken, {

48 httpOnly: true,

49 secure: env.NODE_ENV === 'production',

50 sameSite: 'strict',

51 maxAge: 15 * 60 * 1000,

dist/packages/core/src/cli/index.jsView file

Lines 217-257javascript

217 }

218 },

219 });

220 if (options.dryRun) {

221 console.log('\n DRY RUN — no data will be written to Zenith.\n');

222 }

223 await migrator.run();

224 process.

dist/packages/core/src/database/adapters/AotBridge.jsView file

Lines 10-50javascript

10 * Bypasses dynamic schema/query construction in Mongo/Postgres drivers

11 * for optimized direct executions.

12 */

13export class AotBridge {

14 static compiledModule = null;

dist/packages/core/src/services/flow-engine.jsView file

Lines 101-141javascript

101 (!config.action || config.action === action)) {

102 shouldTrigger = true;

103 }

104 }

105 }

106 if (shouldTrigger) {

107 logger.info({ flowId: flow._id, name: flow.name }, 'Triggering flow execution'

dist/packages/core/src/api/system.jsView file

Lines 1191-1231javascript

1191 const keyHash = crypto.createHash('sha256').update(rawKey).digest('hex');

1192 const apiKey = await adapter.create('z_api_keys', {

1193 name: keyName ||