registry / adminforth / 3.9.0

adminforth@3.9.0

⚠ Under review

OpenSource Agent-Native forth-generation admin panel

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 765 KB of source, external domains: 127.0.0.1, json-schema.org, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 25-65json

25 "files": [

26 "dist/**/*",

27 "commands/**/*",

28 "scripts/**/*"

29 ],

30 "bin": {

31 "adminforth": "./commands/cli.js"

32 },

33 "repository": {

34 "type": "git",

35 "url": "https://github.com/devforth/adminforth.git"

36 },

37 "scripts": {

38 "test": "echo \"Error: no test specified yet\" && exit 1",

39 "build": "pnpm type-check-spa && rm -rf dist && tsc && pnpm prepareDist",

40 "--comment-prepareDist": "-rl allows supply the spa without symlinks which allows to not include source code in the package",

41 "prepareDist": "cp -rL spa dist/",

42 "rollout-doc": "cd documentation && npm run build && npm run deploy",

43 "docs": "typedoc",

44 "--comment_postinstall": "postinstall executed after package installed in other project package and when we do pnpm i in the package",

45 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "type-check-spa": "cd spa && pnpm i && pnpm exec vue-tsc --build --force --pretty"

47 },

48 "release": {

49 "plugins": [

50 "@semantic-release/commit-analyzer",

51 "@semantic-release/release-notes-generator",

52 "@semantic-release/npm",

53 "@semantic-release/github",

54 [

55 "semantic-release-slack-bot",

56 {

57 "packageName": "adminforth",

58 "notifyOnSuccess": true,

59 "notifyOnFail": true,

60 "slackIcon": ":package:",

61 "markdownReleaseNotes": true

62 }

63 ]

64 ],

65 "branches": [

dist/modules/codeInjector.jsView file

Lines 1-21javascript

1import { exec, spawn } from 'child_process';

2import filewatcher from 'filewatcher'; // todo - replace this legacy (>8y old module) with chokidar

High

Child Process

Package source references child process execution.

dist/modules/codeInjector.jsView on unpkg · L1

3import fs from 'fs';

4import fsExtra from 'fs-extra';

dist/spa/tailwind.config.jsView file

Lines 1-19javascript

1/** @type {import('tailwindcss').Config} */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/spa/tailwind.config.jsView on unpkg · L1

3export default {

4 content: ["./src/**/*.{vue, js, ts, tsx}","./src/*.{vue, js, ts, tsx}", "./index.html", "./node_modules/flowbite/**/*.js"],

5 safelist: [

6 /* IMPORTANT:ADMINFORTH TAILWIND SAFELIST */

dist/modules/utils.jsView file

Lines 160-200javascript

160export async function getLoginPromptHTML(loginPrompt) {

161 if (typeof loginPrompt === 'function') {

162 const resolvedLoginPrompt = await loginPrompt();

163 return resolvedLoginPrompt ||

scripts/postinstall.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { fileURLToPath } from 'node:url';

5const nodeBinary = process.execPath;

6const __filename = fileURLToPath

dist/servers/express.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = adminforth@3.8.2 matchedIdentity = npm:YWRtaW5mb3J0aA:3.8.2 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/servers/express.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/modules/codeInjector.jsView file

1import { exec, spawn } from 'child_process'; L2: import filewatcher from 'filewatcher'; // todo - replace this legacy (>8y old module) with chokidar

High

Child Process

Package source references child process execution.

dist/modules/codeInjector.jsView on unpkg · L1

56} L57: const execAsync = promisify(exec); L58: function hashify(obj) {

High

Shell

Package source references shell execution.

dist/modules/codeInjector.jsView on unpkg · L56

dist/spa/tailwind.config.jsView file

1/** @type {import('tailwindcss').Config} */ L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/spa/tailwind.config.jsView on unpkg · L1

dist/modules/utils.jsView file

180const __filename = fileURLToPath(metaUrl); L181: let __dirname = path.dirname(__filename); L182: // Check for dist/modules in both Unix and Windows path formats ... L189: }; L190: // in both bundeled and dev mode this always points to the root of the adminforth package (where package.json is) L191: export const ADMIN_FORTH_ABSOLUTE_PATH = path.join(currentFileDir(import.meta.url), '..'); L192: const package_json = JSON.parse(fs.readFileSync(path.join(ADMIN_FORTH_ABSOLUTE_PATH, 'package.json'), 'utf8')); L193: export const ADMINFORTH_VERSION = package_json.version;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/modules/utils.jsView on unpkg · L180

scripts/postinstall.jsView file

15process.env.PNPM_INSTALL_SPA=1; L16: require('child_process').execSync('pnpm install --frozen-lockfile',{cwd:spaPath,stdio:'inherit'}); L17: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L15

dist/servers/express.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/servers/express.jsView on unpkg

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/servers/express.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/modules/codeInjector.js

HighShelldist/modules/codeInjector.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/spa/tailwind.config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/modules/utils.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 25-65json

25 "files": [

26 "dist/**/*",

27 "commands/**/*",

28 "scripts/**/*"

29 ],

30 "bin": {

31 "adminforth": "./commands/cli.js"

32 },

33 "repository": {

34 "type": "git",

35 "url": "https://github.com/devforth/adminforth.git"

36 },

37 "scripts": {

38 "test": "echo \"Error: no test specified yet\" && exit 1",

39 "build": "pnpm type-check-spa && rm -rf dist && tsc && pnpm prepareDist",

40 "--comment-prepareDist": "-rl allows supply the spa without symlinks which allows to not include source code in the package",

41 "prepareDist": "cp -rL spa dist/",

42 "rollout-doc": "cd documentation && npm run build && npm run deploy",

43 "docs": "typedoc",

44 "--comment_postinstall": "postinstall executed after package installed in other project package and when we do pnpm i in the package",

45 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "type-check-spa": "cd spa && pnpm i && pnpm exec vue-tsc --build --force --pretty"

47 },

48 "release": {

49 "plugins": [

50 "@semantic-release/commit-analyzer",

51 "@semantic-release/release-notes-generator",

52 "@semantic-release/npm",

53 "@semantic-release/github",

54 [

55 "semantic-release-slack-bot",

56 {

57 "packageName": "adminforth",

58 "notifyOnSuccess": true,

59 "notifyOnFail": true,

60 "slackIcon": ":package:",

61 "markdownReleaseNotes": true

62 }

63 ]

64 ],

65 "branches": [

dist/modules/codeInjector.jsView file

Lines 1-21javascript

1import { exec, spawn } from 'child_process';

2import filewatcher from 'filewatcher'; // todo - replace this legacy (>8y old module) with chokidar

High

Child Process

Package source references child process execution.

dist/modules/codeInjector.jsView on unpkg · L1

3import fs from 'fs';

4import fsExtra from 'fs-extra';

dist/spa/tailwind.config.jsView file

Lines 1-19javascript

1/** @type {import('tailwindcss').Config} */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/spa/tailwind.config.jsView on unpkg · L1

3export default {

4 content: ["./src/**/*.{vue, js, ts, tsx}","./src/*.{vue, js, ts, tsx}", "./index.html", "./node_modules/flowbite/**/*.js"],

5 safelist: [

6 /* IMPORTANT:ADMINFORTH TAILWIND SAFELIST */

dist/modules/utils.jsView file

Lines 160-200javascript

160export async function getLoginPromptHTML(loginPrompt) {

161 if (typeof loginPrompt === 'function') {

162 const resolvedLoginPrompt = await loginPrompt();

163 return resolvedLoginPrompt ||

scripts/postinstall.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { fileURLToPath } from 'node:url';

5const nodeBinary = process.execPath;

6const __filename = fileURLToPath

dist/servers/express.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/servers/express.jsView on unpkg