registry / @zyno-io/ts-server-foundation / 26.714.651

@zyno-io/ts-server-foundation@26.714.651

TypeScript server foundation with reflected type metadata

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 185 file(s), 8.16 MB of source, external domains: github.com, spec.openapis.org

Oversized source lightweight scan

dist/src/http/router.js5.89 MB file, sampled 256 KB

ChildProcess

dist/src/index.js4.30 MB file, sampled 256 KB

Minified

dist/src/reflection/index.js2.93 MB file, sampled 256 KB

Minified

dist/src/reflection/model.js2.93 MB file, sampled 256 KB

Minified

dist/src/reflection/reflection-class.js5.86 MB file, sampled 256 KB

Minified

Source & flagged code

8 flagged

package.jsonView file

Lines 45-85json

45 "types": "./dist/src/telemetry/otel/index.d.ts",

46 "import": "./dist/src/telemetry/otel/index.js",

47 "require": "./dist/src/telemetry/otel/index.js"

48 }

49 },

50 "scripts": {

51 "clean": "rm -rf dist",

52 "build": "yarn clean && ttsc -p tsconfig.json && yarn build:type-compiler && yarn build:devconsole && chmod +x dist/src/cli/*.js",

53 "build:dirty": "ttsc -p tsconfig.json && yarn build:type-compiler && yarn build:devconsole && chmod +x dist/src/cli/*.js",

54 "build:type-compiler": "rm -rf dist/src/type-compiler && mkdir -p dist/src/type-compiler && cp -R src/type-compiler/*.cjs src/type-compiler/go dist/src/type-compiler/",

55 "build:devconsole": "vite build --config devconsole/vite.config.ts",

56 "docs:dev": "vitepress dev docs --host 0.0.0.0",

57 "docs:build": "vitepress build docs",

58 "docs:preview": "vitepress preview docs --host 0.0.0.0",

59 "gen:devconsole-proto": "tsf-gen-proto resources/proto/devconsole.proto src/devconsole/generated",

60 "format": "oxfmt && oxlint src --fix",

61 "test": "yarn build && dotenv -e .env.test -- tsf-test",

62 "test:type-compiler-go": "node scripts/test-type-compiler-go.cjs",

63 "test:dirty": "yarn build:dirty && APP_ENV=test node --test \"dist/tests/**/*.spec.js\"",

64 "test-app": "yarn clean && ttsc -p tsconfig.test-app.json && APP_ENV=test node dist/test-app/bootstrap.js",

65 "postinstall": "true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 },

67 "dependencies": {

68 "@bufbuild/protobuf": "^2.12.1",

69 "@opentelemetry/api": "^1.9.1",

70 "@opentelemetry/exporter-metrics-otlp-http": "^0.220.0",

71 "@opentelemetry/exporter-prometheus": "^0.220.0",

72 "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",

73 "@opentelemetry/instrumentation": "^0.220.0",

74 "@opentelemetry/instrumentation-dns": "^0.63.0",

75 "@opentelemetry/instrumentation-http": "^0.220.0",

76 "@opentelemetry/instrumentation-ioredis": "^0.68.0",

77 "@opentelemetry/instrumentation-mysql2": "^0.66.0",

78 "@opentelemetry/instrumentation-pg": "^0.72.0",

79 "@opentelemetry/instrumentation-undici": "^0.30.0",

80 "@opentelemetry/resources": "^2.9.0",

81 "@opentelemetry/sdk-metrics": "^2.9.0",

82 "@opentelemetry/sdk-trace-base": "^2.9.0",

83 "@opentelemetry/sdk-trace-node": "^2.9.0",

84 "@sentry/node": "^10.64.0",

85 "@types/ws": "^8.18.1",

dist/src/auth/jwt.jsView file

Lines 322-362javascript

322}

323function buildCookieAttributes(options) {

324 const parts = ['Path=/', 'HttpOnly'];

325 if (options?.secure !== false)

326 parts.push('Secure');

dist/src/database/migration/index.jsView file

Lines 1-39javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.__tsfTypeAliases = exports.MigrationRunner = void 0;

4exports.createMigration = createMigration;

5exports.defineMigration =

dist/src/database/database.jsView file

7exports.logSql = logSql; L8: const tslib_1 = require("tslib"); L9: const _a = tslib_1.__importStar(require("@zyno-io/ts-server-foundation/type-metadata-runtime"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/database/database.jsView on unpkg · L7

dist/src/index.jsView file

•path = dist/src/index.js kind = oversized_source_file sizeBytes = 4506171 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/index.jsView on unpkg

dist/src/cli/tsf-install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zyno-io/ts-server-foundation@26.714.5 matchedIdentity = npm:[redacted]:26.714.5 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/tsf-install.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/auth/jwt.jsView file

342patternName = private_key_rsa severity = critical line = 342 matchedText = return `...--`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/auth/jwt.jsView on unpkg · L342

342patternName = private_key_rsa severity = critical line = 342 matchedText = return `...--`;

Critical

Secret Pattern

RSA private key in dist/src/auth/jwt.js

dist/src/auth/jwt.jsView on unpkg · L342

dist/src/database/migration/index.jsView file

19tslib_1.__exportStar(require("./maintenance"), exports); L20: const dynamicImport = new Function('specifier', 'return import(specifier)'); L21: function createMigration(fn) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/database/migration/index.jsView on unpkg · L19

dist/src/database/database.jsView file

7exports.logSql = logSql; L8: const tslib_1 = require("tslib"); L9: const _a = tslib_1.__importStar(require("@zyno-io/ts-server-foundation/type-metadata-runtime"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/database/database.jsView on unpkg · L7

dist/src/index.jsView file

•path = dist/src/index.js kind = oversized_source_file sizeBytes = 4506171 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/index.jsView on unpkg

dist/src/cli/tsf-install.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/tsf-install.jsView on unpkg

Findings

2 Critical3 High5 Medium6 Low

CriticalCritical Secretdist/src/auth/jwt.js

CriticalSecret Patterndist/src/auth/jwt.js

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/src/index.js

HighPrevious Version Dangerous Deltadist/src/cli/tsf-install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/src/database/database.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/src/database/migration/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 45-85json

45 "types": "./dist/src/telemetry/otel/index.d.ts",

46 "import": "./dist/src/telemetry/otel/index.js",

47 "require": "./dist/src/telemetry/otel/index.js"

48 }

49 },

50 "scripts": {

51 "clean": "rm -rf dist",

52 "build": "yarn clean && ttsc -p tsconfig.json && yarn build:type-compiler && yarn build:devconsole && chmod +x dist/src/cli/*.js",

53 "build:dirty": "ttsc -p tsconfig.json && yarn build:type-compiler && yarn build:devconsole && chmod +x dist/src/cli/*.js",

54 "build:type-compiler": "rm -rf dist/src/type-compiler && mkdir -p dist/src/type-compiler && cp -R src/type-compiler/*.cjs src/type-compiler/go dist/src/type-compiler/",

55 "build:devconsole": "vite build --config devconsole/vite.config.ts",

56 "docs:dev": "vitepress dev docs --host 0.0.0.0",

57 "docs:build": "vitepress build docs",

58 "docs:preview": "vitepress preview docs --host 0.0.0.0",

59 "gen:devconsole-proto": "tsf-gen-proto resources/proto/devconsole.proto src/devconsole/generated",

60 "format": "oxfmt && oxlint src --fix",

61 "test": "yarn build && dotenv -e .env.test -- tsf-test",

62 "test:type-compiler-go": "node scripts/test-type-compiler-go.cjs",

63 "test:dirty": "yarn build:dirty && APP_ENV=test node --test \"dist/tests/**/*.spec.js\"",

64 "test-app": "yarn clean && ttsc -p tsconfig.test-app.json && APP_ENV=test node dist/test-app/bootstrap.js",

65 "postinstall": "true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 },

67 "dependencies": {

68 "@bufbuild/protobuf": "^2.12.1",

69 "@opentelemetry/api": "^1.9.1",

70 "@opentelemetry/exporter-metrics-otlp-http": "^0.220.0",

71 "@opentelemetry/exporter-prometheus": "^0.220.0",

72 "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",

73 "@opentelemetry/instrumentation": "^0.220.0",

74 "@opentelemetry/instrumentation-dns": "^0.63.0",

75 "@opentelemetry/instrumentation-http": "^0.220.0",

76 "@opentelemetry/instrumentation-ioredis": "^0.68.0",

77 "@opentelemetry/instrumentation-mysql2": "^0.66.0",

78 "@opentelemetry/instrumentation-pg": "^0.72.0",

79 "@opentelemetry/instrumentation-undici": "^0.30.0",

80 "@opentelemetry/resources": "^2.9.0",

81 "@opentelemetry/sdk-metrics": "^2.9.0",

82 "@opentelemetry/sdk-trace-base": "^2.9.0",

83 "@opentelemetry/sdk-trace-node": "^2.9.0",

84 "@sentry/node": "^10.64.0",

85 "@types/ws": "^8.18.1",

dist/src/auth/jwt.jsView file

Lines 322-362javascript

322}

323function buildCookieAttributes(options) {

324 const parts = ['Path=/', 'HttpOnly'];

325 if (options?.secure !== false)

326 parts.push('Secure');

dist/src/database/migration/index.jsView file

Lines 1-39javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.__tsfTypeAliases = exports.MigrationRunner = void 0;

4exports.createMigration = createMigration;

5exports.defineMigration =

dist/src/database/database.jsView file

7exports.logSql = logSql; L8: const tslib_1 = require("tslib"); L9: const _a = tslib_1.__importStar(require("@zyno-io/ts-server-foundation/type-metadata-runtime"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/database/database.jsView on unpkg · L7

dist/src/index.jsView file

•path = dist/src/index.js kind = oversized_source_file sizeBytes = 4506171 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/index.jsView on unpkg

dist/src/cli/tsf-install.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/tsf-install.jsView on unpkg