registry / @zuplo/cli / 6.72.16

@zuplo/cli@6.72.16

<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 206 file(s), 539 KB of source, external domains: 127.0.0.1, api.example.com, api.prod.example.com, app.posthog.com, cdn.jsdelivr.net, cdn.zuplo.com, dev.zuplo.com, example.com, github.com, learn.microsoft.com, my-api-dev-123abc.zuplo.app, my-api.zuplo.dev, portal.zuplo.com, registry.npmjs.org, your-api-123abc.zuplo.app, zuplo.com

Source & flagged code

4 flagged

dist/source/migrate/dev-portal/handler.jsView file

Lines 630-670javascript

630const createDevPortalRedirectConfig = async (config) => {

631 try {

632 const devPortalOasFile = path.join(config.absoluteBaseDir, "config", "dev-portal.oas.json");

633 const oasContent = {

634 openapi: "3.1.0",

635 info: {

636 version: "1.0.0",

637 title: "Dev Portal Redirect",

638 },

639 paths: {

640 "/docs(.*)": {

641 "x-zuplo-path": {

642 pathMode: "url-pattern",

643 },

644 get: {

645 summary: "Redirect",

646 description: "Redirect to the new Dev Portal domain",

647 "x-zuplo-route": {

648 corsPolicy: "none",

649 handler: {

650 export: "legacyDevPortalHandler",

651 module: "$import(@zuplo/runtime)",

652 options: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L650

653 mode: "redirect",

654 },

655 },

656 policies: {

657 inbound: [],

658 },

659 },

660 operationId: "dev-portal-redirect",

661 "x-internal": true,

662 },

663 },

664 },

665 };

666 await writeFile(devPortalOasFile, JSON.stringify(oasContent, null, 2));

667 const result = new PluginResult();

668 result.notes.push("Created config/dev-portal.oas.json for legacy dev portal redirects");

669 return result;

670 }

dist/common/analytics/lib.jsView file

Lines 7-47javascript

7let _userContext = {};

8async function withTimeout(promise, ms) {

9 let timer;

10 const timeout = new

dist/ca-certificate/validation.test.jsView file

Lines 69-116javascript

69 it("rejects JavaScript reserved keywords", () => {

70 for (const keyword of ["class", "delete", "import", "return", "await"]) {

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code