registry / @zexatemplate/create-new2026 / 1.0.1

@zexatemplate/create-new2026@1.0.1

🚀 Scaffold a modern full-stack Next.js 16 app with Better Auth, Drizzle ORM, tRPC, and more

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 112 KB of source

Source & flagged code

6 flagged

template/scripts/seed-demo.tsView file

Lines 10-53typescript

10 *

11 * Usage:

12 * npx tsx scripts/seed-demo.ts

13 */

15import 'dotenv/config';

16import { db } from '../src/db';

17import { user } from '../src/db/schema';

18import { eq } from 'drizzle-orm';

20const BASE_URL = 'http://localhost:3000';

22interface DemoUser {

23 name: string;

24 email: string;

25 password: string;

26 role: string;

27}

29const DEMO_USERS: DemoUser[] = [

30 { name: 'Admin', email: 'admin@demo.com', password: 'Demo@123', role: 'admin' },

Medium

Secret Pattern

Package contains a possible secret pattern.

template/scripts/seed-demo.tsView on unpkg · L30

31 { name: 'Manager', email: 'manager@demo.com', password: 'Demo@123', role: 'manager' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L31

32 { name: 'Operator', email: 'operator@demo.com', password: 'Demo@123', role: 'operator' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L32

33 { name: 'User', email: 'user@demo.com', password: 'Demo@123', role: 'user' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L33

34];

36async function signUpUser(user: DemoUser): Promise<boolean> {

37 try {

38 const res = await fetch(`${BASE_URL}/api/auth/sign-up/email`, {

39 method: 'POST',

40 headers: { 'Content-Type': 'application/json' },

41 body: JSON.stringify({

42 name: user.name,

43 email: user.email,

44 password: user.password,

45 }),

46 });

48 if (res.ok) {

49 console.log(` ✅ Created: ${user.email}`);

50 return true;

51 }

53 const data = await res.json();

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2#!/usr/bin/env node

3"use strict";var re=Object.create;var F=Object.defineProperty;var ae=Object.getOwnPropertyDescriptor;var ne=Object.getOwnPropertyNames;var se=Object.getPrototypeOf,le=Object.prototype.hasOwnProperty;

Source & flagged code

6 flagged · loading source

template/scripts/seed-demo.tsView file

30patternName = generic_password severity = medium line = 30 matchedText = { name: ...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

template/scripts/seed-demo.tsView on unpkg · L30

31patternName = generic_password severity = medium line = 31 matchedText = { name: ...' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L31

32patternName = generic_password severity = medium line = 32 matchedText = { name: ...' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L32

33patternName = generic_password severity = medium line = 33 matchedText = { name: ...' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L33

dist/index.jsView file

2#!/usr/bin/env node L3: "use strict";var re=Object.create;var F=Object.defineProperty;var ae=Object.getOwnPropertyDescriptor;var ne=Object.getOwnPropertyNames;var se=Object.getPrototypeOf,le=Object.protot... L4: DATABASE_URL="${o.databaseUrl}"

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2

Findings

2 High7 Medium4 Low

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumSecret Patterntemplate/scripts/seed-demo.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplate/scripts/seed-demo.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

6 flagged

template/scripts/seed-demo.tsView file

Lines 10-53typescript

10 *

11 * Usage:

12 * npx tsx scripts/seed-demo.ts

13 */

15import 'dotenv/config';

16import { db } from '../src/db';

17import { user } from '../src/db/schema';

18import { eq } from 'drizzle-orm';

20const BASE_URL = 'http://localhost:3000';

22interface DemoUser {

23 name: string;

24 email: string;

25 password: string;

26 role: string;

27}

29const DEMO_USERS: DemoUser[] = [

30 { name: 'Admin', email: 'admin@demo.com', password: 'Demo@123', role: 'admin' },

Medium

Secret Pattern

Package contains a possible secret pattern.

template/scripts/seed-demo.tsView on unpkg · L30

31 { name: 'Manager', email: 'manager@demo.com', password: 'Demo@123', role: 'manager' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L31

32 { name: 'Operator', email: 'operator@demo.com', password: 'Demo@123', role: 'operator' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L32

33 { name: 'User', email: 'user@demo.com', password: 'Demo@123', role: 'user' },

Medium

Secret Pattern

Hardcoded password in template/scripts/seed-demo.ts

template/scripts/seed-demo.tsView on unpkg · L33

34];

36async function signUpUser(user: DemoUser): Promise<boolean> {

37 try {

38 const res = await fetch(`${BASE_URL}/api/auth/sign-up/email`, {

39 method: 'POST',

40 headers: { 'Content-Type': 'application/json' },

41 body: JSON.stringify({

42 name: user.name,

43 email: user.email,

44 password: user.password,

45 }),

46 });

48 if (res.ok) {

49 console.log(` ✅ Created: ${user.email}`);

50 return true;

51 }

53 const data = await res.json();

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2#!/usr/bin/env node