registry / @zintrust/core / 2.9.0

@zintrust/core@2.9.0

⚠ Under review

Production-grade TypeScript backend framework for JavaScript

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 604 file(s), 2.96 MB of source, external domains: 127.0.0.1, api.cloudflare.com, api.mailgun.net, api.pusherapp.com, api.sendgrid.com, api.termii.com, api.twilio.com, assets.local, cdn.tailwindcss.com, fonts.googleapis.com, fonts.gstatic.com, registry.npmjs.org, storage.googleapis.com, unpkg.com

Source & flagged code

5 flagged

src/config/middleware.jsView file

Lines 1-41javascript

1import { Env } from './env.js';

2import { securityConfig } from './security.js';

3import { isArray, isObject } from '../helper/index.js';

4import { bodyParsingMiddleware } from '../http/middleware/BodyParsingMiddleware.js';

5import { fileUploadMiddleware } from '../http/middleware/FileUploadMiddleware.js';

6import { AuthMiddleware } from '../middleware/AuthMiddleware.js';

7import { BulletproofAuthMiddleware } from '../middleware/BulletproofAuthMiddleware.js';

8import { CsrfMiddleware } from '../middleware/CsrfMiddleware.js';

9import { ErrorHandlerMiddleware } from '../middleware/ErrorHandlerMiddleware.js';

10import { JwtAuthMiddleware } from '../middleware/JwtAuthMiddleware.js';

11import { LoggingMiddleware } from '../middleware/LoggingMiddleware.js';

12import { RateLimiter } from '../middleware/RateLimiter.js';

13import { SanitizeBodyMiddleware } from '../middleware/SanitizeBodyMiddleware.js';

14import { SecurityMiddleware } from '../middleware/SecurityMiddleware.js';

15import { ValidationMiddleware } from '../middleware/ValidationMiddleware.js';

16import { StartupConfigFile, StartupConfigFileRegistry } from '../runtime/StartupConfigFileRegistry.js';

17import { Sanitizer } from '../security/Sanitizer.js';

18import { Schema } from '../validation/Validator.js';

19export const MiddlewareBody = {

20 email: 'email',

21 password: 'password', //NOSONAR

Medium

Secret Pattern

Package contains a possible secret pattern.

src/config/middleware.jsView on unpkg · L21

22 name: 'name',

23 count: 'count',

24};

25export const MiddlewareKeys = Object.freeze({

26 log: true,

27 error: true,

28 security: true,

29 rateLimit: true,

30 sanitizeBody: true,

31 fillRateLimit: true,

32 authRateLimit: true,

33 userMutationRateLimit: true,

34 csrf: true,

35 auth: true,

36 jwt: true,

37 bulletproof: true,

38 validateLogin: true,

39 validateRegister: true,

40 validateUserStore: true,

41 validateUserUpdate: true,

src/migrations/MigrationLoader.jsView file

Lines 2-42javascript

2import * as path from '../node-singletons/path.js';

3import { pathToFileURL } from '../node-singletons/url.js';

4function isFunction(value) {

5 return typeof value === 'function';

src/scripts/TemplateSync.jsView file

Lines 1-32javascript

1/**

2 * Template Sync Script

3 * Synchronizes base framework files to .tpl templates when checksums change

4 * Runs during npm run build

5 */

6import { TemplateRegistry } from '../templates/TemplateRegistry.js';

7import { ensureDir, esmDirname } from '../common/index.js';

8import { Logger } from '../config/logger.js';

src/tools/redis/RedisTransport.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zintrust/core@2.8.7 matchedIdentity = npm:QHppbnRydXN0L2NvcmU:2.8.7 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/tools/redis/RedisTransport.jsView on unpkg

src/config/middleware.d.tsView file

Lines 7-47typescript

7 security: Middleware;

8 rateLimit: Middleware;

9 sanitizeBody: Middleware;

10 fillRateLimit: Middleware;

11 authRateLimit: Middleware;

12 userMutationRateLimit: Middleware;

13 csrf: Middleware;

14 auth: Middleware;

Source & flagged code

5 flagged · loading source

src/config/middleware.jsView file

21patternName = generic_password severity = medium line = 21 matchedText = password...ONAR

Medium

Secret Pattern

Package contains a possible secret pattern.

src/config/middleware.jsView on unpkg · L21

src/migrations/MigrationLoader.jsView file

22const url = pathToFileURL(filePath).href; L23: const raw = (await import(url)); L24: // Some tooling/transpilation paths wrap exports under `default`.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/migrations/MigrationLoader.jsView on unpkg · L22

src/scripts/TemplateSync.jsView file

12import path from '../node-singletons/path.js'; L13: const __dirname = esmDirname(import.meta.url); L14: const ROOT_DIR = path.resolve(__dirname, '../../'); ... L336: const content = fs.readFileSync(checksumPath, 'utf8'); L337: return JSON.parse(content); L338: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/scripts/TemplateSync.jsView on unpkg · L12

src/tools/redis/RedisTransport.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/tools/redis/RedisTransport.jsView on unpkg

src/config/middleware.d.tsView file

27patternName = generic_password severity = medium line = 27 matchedText = readonly...rd";

Medium

Secret Pattern

Hardcoded password in src/config/middleware.d.ts

src/config/middleware.d.tsView on unpkg · L27

Findings

1 Critical5 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/tools/redis/RedisTransport.js

MediumSecret Patternsrc/config/middleware.js

MediumDynamic Requiresrc/migrations/MigrationLoader.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/config/middleware.d.ts

LowWeak Cryptosrc/scripts/TemplateSync.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings