registry / @zenith-open/zenithcms-core / 1.0.0-beta.36

@zenith-open/zenithcms-core@1.0.0-beta.36

Zenith CMS — headless engine with REST, GraphQL, and AI tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 194 file(s), 1.05 MB of source, external domains: accounts.google.com, api.github.com, api.openai.com, fonts.googleapis.com, fonts.gstatic.com, github.com, oauth2.googleapis.com, openrouter.ai, production.zenithcms.internal, www.googleapis.com, www.paypal.com, zenithcms.com

Source & flagged code

5 flagged

dist/packages/core/src/api/auth/sso.jsView file

Lines 16-56javascript

16/**

17 * Shared handler for all SSO providers to upsert user and generate Zenith tokens

18 */

19async function handleSsoSuccess(req, res, next) {

20 try {

21 const profile = req.user;

22 if (!profile)

23 throw new AuthenticationError('SSO authentication failed: no profile received');

24 // 1. Upsert user in database

25 const adapter = AdapterFactory.getActiveAdapter();

26 const existing = await adapter.find('users', { email: profile.email });

27 let user = existing[0];

28 if (!user) {

29 const AVATAR_COLORS = [

30 '#ef4444', '#f97316', '#f59e0b', '#84cc16', '#10b981',

31 '#14b8a6', '#06b6d4', '#0ea5e9', '#3b82f6', '#6366f1',

32 '#8b5cf6', '#d946ef', '#f43f5e'

33 ];

34 user = await adapter.create('users', {

35 email: profile.email.toLowerCase(),

36 password: 'sso-managed-account',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L36

37 role: profile.role || 'editor',

38 ssoId: profile.id,

39 color: AVATAR_COLORS[Math.floor(Math.random() * AVATAR_COLORS.length)]

40 });

41 }

42 // 2. Generate Zenith Session Tokens

43 const userId = (user.id).toString();

44 const payload = { id: userId, email: user.email, role: user.role };

45 const accessToken = AuthService.generateToken(payload);

46 const refreshToken = AuthService.generateRefreshToken(payload);

47 res.cookie('refreshToken', refreshToken, {

48 httpOnly: true,

49 secure: env.NODE_ENV === 'production',

50 sameSite: 'strict',

51 maxAge: 7 * 24 * 60 * 60 * 1000,

52 });

53 res.cookie('accessToken', accessToken, {

54 httpOnly: true,

55 secure: env.NODE_ENV === 'production',

56 sameSite: 'strict',

dist/packages/core/src/index.jsView file

Lines 492-532javascript

492 logger.info(`Initial Super Admin created successfully: ${initialEmail}`);

493 }

494 }

495 catch (err) {

496 logger.error({ err }, 'Failed to seed initial admin user');

497 }

498 }

499 this

dist/packages/core/src/database/adapters/AotBridge.jsView file

Lines 10-50javascript

10 * Bypasses dynamic schema/query construction in Mongo/Postgres drivers

11 * for optimized direct executions.

12 */

13export class AotBridge {

14 static compiledModule = null;

dist/packages/core/src/services/flow-engine.jsView file

Lines 101-141javascript

101 (!config.action || config.action === action)) {

102 shouldTrigger = true;

103 }

104 }

105 }

106 if (shouldTrigger) {

107 logger.info({ flowId: flow.id, name: flow.name }, 'Triggering flow execution'

dist/packages/core/src/api/system/audit-logs.jsView file

Lines 163-203javascript

163 });

164 const state = await adapter.findOne('z_onboarding', siteId ? { siteId } : {});

165 const updateData = { completedAt: new Date(), answers: { ...(state?.answers || {}), generatedApiKeyId: apiKey.id } };

Source & flagged code

5 flagged · loading source

dist/packages/core/src/api/auth/sso.jsView file

36patternName = generic_password severity = medium line = 36 matchedText = password...nt',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L36

dist/packages/core/src/index.jsView file

512const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open'; L513: require('child_process').exec(`${cmd} http://localhost:${port}/admin`); L514: }

High

Child Process

Package source references child process execution.

dist/packages/core/src/index.jsView on unpkg · L512

dist/packages/core/src/database/adapters/AotBridge.jsView file

30try { L31: // Convert absolute Windows paths to file:// URLs for ESM import() compatibility L32: const fileUrl = pathToFileURL(fileToLoad).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/core/src/database/adapters/AotBridge.jsView on unpkg · L30

dist/packages/core/src/services/flow-engine.jsView file

121status: 'running', L122: context: { payload, env: process.env }, L123: completedNodes: {}, ... L321: else { L322: const headers = config.headers ? JSON.parse(config.headers) : {}; L323: const body = config.body ? JSON.parse(config.body) : context.payload || context; L324: const method = config.method || 'POST'; L325: const res = await fetch(config.url, { L326: method, L327: headers: { 'Content-Type': 'application/json', ...headers }, L328: body: method !== 'GET' ? JSON.stringify(body) : undefined L329: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/packages/core/src/services/flow-engine.jsView on unpkg · L121

dist/packages/core/src/api/system/audit-logs.jsView file

183try { L184: execSync(`npx tsx "${scriptPath}"`, { stdio: 'inherit' }); L185: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/core/src/api/system/audit-logs.jsView on unpkg · L183

Findings

2 High6 Medium4 Low

HighChild Processdist/packages/core/src/index.js

HighRuntime Package Installdist/packages/core/src/api/system/audit-logs.js

MediumSecret Patterndist/packages/core/src/api/auth/sso.js

MediumDynamic Requiredist/packages/core/src/database/adapters/AotBridge.js

MediumUnsafe Vm Contextdist/packages/core/src/services/flow-engine.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/packages/core/src/api/auth/sso.jsView file

Lines 16-56javascript

16/**

17 * Shared handler for all SSO providers to upsert user and generate Zenith tokens

18 */

19async function handleSsoSuccess(req, res, next) {

20 try {

21 const profile = req.user;

22 if (!profile)

23 throw new AuthenticationError('SSO authentication failed: no profile received');

24 // 1. Upsert user in database

25 const adapter = AdapterFactory.getActiveAdapter();

26 const existing = await adapter.find('users', { email: profile.email });

27 let user = existing[0];

28 if (!user) {

29 const AVATAR_COLORS = [

30 '#ef4444', '#f97316', '#f59e0b', '#84cc16', '#10b981',

31 '#14b8a6', '#06b6d4', '#0ea5e9', '#3b82f6', '#6366f1',

32 '#8b5cf6', '#d946ef', '#f43f5e'

33 ];

34 user = await adapter.create('users', {

35 email: profile.email.toLowerCase(),

36 password: 'sso-managed-account',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/core/src/api/auth/sso.jsView on unpkg · L36

37 role: profile.role || 'editor',

38 ssoId: profile.id,

39 color: AVATAR_COLORS[Math.floor(Math.random() * AVATAR_COLORS.length)]

40 });

41 }

42 // 2. Generate Zenith Session Tokens

43 const userId = (user.id).toString();

44 const payload = { id: userId, email: user.email, role: user.role };

45 const accessToken = AuthService.generateToken(payload);

46 const refreshToken = AuthService.generateRefreshToken(payload);

47 res.cookie('refreshToken', refreshToken, {

48 httpOnly: true,

49 secure: env.NODE_ENV === 'production',

50 sameSite: 'strict',

51 maxAge: 7 * 24 * 60 * 60 * 1000,

52 });

53 res.cookie('accessToken', accessToken, {

54 httpOnly: true,

55 secure: env.NODE_ENV === 'production',

56 sameSite: 'strict',

dist/packages/core/src/index.jsView file

Lines 492-532javascript

492 logger.info(`Initial Super Admin created successfully: ${initialEmail}`);

493 }

494 }

495 catch (err) {

496 logger.error({ err }, 'Failed to seed initial admin user');

497 }

498 }

499 this

dist/packages/core/src/database/adapters/AotBridge.jsView file

Lines 10-50javascript

10 * Bypasses dynamic schema/query construction in Mongo/Postgres drivers

11 * for optimized direct executions.

12 */

13export class AotBridge {

14 static compiledModule = null;

dist/packages/core/src/services/flow-engine.jsView file

Lines 101-141javascript

101 (!config.action || config.action === action)) {

102 shouldTrigger = true;

103 }

104 }

105 }

106 if (shouldTrigger) {

107 logger.info({ flowId: flow.id, name: flow.name }, 'Triggering flow execution'

dist/packages/core/src/api/system/audit-logs.jsView file

Lines 163-203javascript

163 });

164 const state = await adapter.findOne('z_onboarding', siteId ? { siteId } : {});

165 const updateData = { completedAt: new Date(), answers: { ...(state?.answers || {}), generatedApiKeyId: apiKey.id } };