registry  /  adminforth  /  3.8.0

adminforth@3.8.0

OpenSource Agent-Native forth-generation admin panel

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 90 file(s), 764 KB of source, external domains: 127.0.0.1, json-schema.org, registry.npmjs.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/modules/codeInjector.jsView file
1import { exec, spawn } from 'child_process'; L2: import filewatcher from 'filewatcher'; // todo - replace this legacy (>8y old module) with chokidar
High
Child Process

Package source references child process execution.

dist/modules/codeInjector.jsView on unpkg · L1
56} L57: const execAsync = promisify(exec); L58: function hashify(obj) {
High
Shell

Package source references shell execution.

dist/modules/codeInjector.jsView on unpkg · L56
dist/spa/tailwind.config.jsView file
1/** @type {import('tailwindcss').Config} */ L2:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/spa/tailwind.config.jsView on unpkg · L1
dist/modules/utils.jsView file
180const __filename = fileURLToPath(metaUrl); L181: let __dirname = path.dirname(__filename); L182: // Check for dist/modules in both Unix and Windows path formats ... L189: }; L190: // in both bundeled and dev mode this always points to the root of the adminforth package (where package.json is) L191: export const ADMIN_FORTH_ABSOLUTE_PATH = path.join(currentFileDir(import.meta.url), '..'); L192: const package_json = JSON.parse(fs.readFileSync(path.join(ADMIN_FORTH_ABSOLUTE_PATH, 'package.json'), 'utf8')); L193: export const ADMINFORTH_VERSION = package_json.version; ... L580: } L581: return { ok: true, data: parsed.data }; L582: }
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/modules/utils.jsView on unpkg · L180
scripts/postinstall.jsView file
15process.env.PNPM_INSTALL_SPA=1; L16: require('child_process').execSync('pnpm install --frozen-lockfile',{cwd:spaPath,stdio:'inherit'}); L17: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L15

Findings

4 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/modules/codeInjector.js
HighShelldist/modules/codeInjector.js
HighRuntime Package Installscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/spa/tailwind.config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/modules/utils.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings