registry / arcanajs / 6.1.0

arcanajs@6.1.0

ArcanaJS Framework

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscated

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 2.47 MB of source

Source & flagged code

8 flagged

dist/development/cli/index.jsView file

Lines 1-33javascript

1/******/ (() => { // webpackBootstrap

2/******/ var __webpack_modules__ = ({

4/***/ "./node_modules/reflect-metadata/Reflect.js":

5/*!**************************************************!*\

6 !*** ./node_modules/reflect-metadata/Reflect.js ***!

7 \**************************************************/

8/***/ (() => {

10/*! *****************************************************************************

12Licensed under the Apache License, Version 2.0 (the "License"); you may not use

13this file except in compliance with the License. You may obtain a copy of the

14License at http://www.apache.org/licenses/LICENSE-2.0

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/development/cli/index.jsView on unpkg · L13

16THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

17KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED

18WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,

19MERCHANTABLITY OR NON-INFRINGEMENT.

21See the Apache Version 2.0 License for specific language governing permissions

22and limitations under the License.

23***************************************************************************** */

24var Reflect;

25(function (Reflect) {

26 // Metadata Proposal

27 // https://rbuckton.github.io/reflect-metadata/

28 (function (factory) {

29 var root = typeof globalThis === "object" ? globalThis :

30 typeof global === "object" ? global :

31 typeof self === "object" ? self :

32 typeof this === "object" ? this :

33 sloppyModeThis();

Lines 1433-1473javascript

1433/***/ ((__unused_webpack_module, exports, __webpack_require__) => {

1434

1435"use strict";

1436

1437Object.defineProperty(exports, "__esModule", ({

1438 value: true

1439}));

1440function _export(target, all) {

Lines 2141-2181javascript

2141 };

2142}

2143const detectPackageManager = ()=>{

2144 const cwd = process.cwd();

2145 if (_fs.default.existsSync(_path.default.join(cwd, "bun.lockb"))) {

2146 return "bun";

2147

Lines 14042-14104javascript

14042 writable: true

14043 });

14044 } else {

14045 obj[key] = value;

14046 }

14047 return obj;

14048}

14049class ModuleLoader {

14050 /**

14051 * Dynamically require a module at runtime.

14052

bin/arcanajs.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

3require("../dist/cli/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/arcanajs.jsView on unpkg · L2

dist/production/arcanajs.min.jsView file

Lines 1-2javascript

1(()=>{var __webpack_modules__={190:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"ClassScanner",{enumerable:!0,get:function(){return u}});const

dist/lib/validation/ValidationException.d.tsView file

Lines 1-34typescript

1import type { ErrorFormat, FlatErrorResponse, ValidationErrorResponse, ValidationErrors } from "./types";

2/**

3 * Professional ValidationException with multiple error formats

4 * and comprehensive error handling capabilities.

5 *

6 * @example

7 * ```typescript

8 * // Throw validation exception

9 * throw new ValidationException({ email: ['Invalid email format'] });

Source & flagged code

8 flagged · loading source

dist/development/cli/index.jsView file

1453}); L1454: const _child_process = __webpack_require__(/*! child_process */ "child_process"); L1455: const _fs = /*#__PURE__*/ _interop_require_default(__webpack_require__(/*! fs */ "fs"));

High

Child Process

Package source references child process execution.

dist/development/cli/index.jsView on unpkg · L1453

14084const _global = global; L14085: const nativeRequire = _global["process"]?.["mainModule"]?.["require"]; L14086: if (nativeRequire) {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/development/cli/index.jsView on unpkg · L14084

13Cross-file remote execution chain: dist/development/cli/index.js spawns dist/development/lib/client/hmr-client.js; helper contains network access plus dynamic code execution. L13: this file except in compliance with the License. You may obtain a copy of the L14: License at http://www.apache.org/licenses/LICENSE-2.0 L15: ... L91: var _WeakMap = typeof WeakMap === "function" ? WeakMap : CreateWeakMapPolyfill(); L92: var registrySymbol = supportsSymbol ? Symbol.for("@reflect-metadata:registry") : undefined; L93: var metadataRegistry = GetOrCreateMetadataRegistry(); ... L1453: }); L1454: const _child_process = __webpack_require__(/*! child_process */ "child_process"); L1455: const _fs = /*#__PURE__*/ _interop_require_default(__webpack_require__(/*! fs */ "fs")); ... L1505: */ async build(options = {}) { L1506: process.env.NODE_ENV = "production"; L1507: this.buildStartTime = Date.now();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/development/cli/index.jsView on unpkg · L13

2161case "yarn": L2162: return `yarn add ${pkgList}`; L2163: case "pnpm": ... L2175: try { L2176: (0, _child_process.execSync)(installCmd, { L2177: stdio: "inherit"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/development/cli/index.jsView on unpkg · L2161

14062// Use eval to avoid Webpack bundling L14063: const r = eval("module.require"); L14064: if (r) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/development/cli/index.jsView on unpkg · L14062

bin/arcanajs.jsView file

2L3: require("../dist/cli/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/arcanajs.jsView on unpkg · L2

dist/production/arcanajs.min.jsView file

1(()=>{var __webpack_modules__={190:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"ClassScanner",{enumerable:!0,get:function(){retu... L2: //# sourceMappingURL=arcanajs.min.js.map

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/production/arcanajs.min.jsView on unpkg · L1

dist/lib/validation/ValidationException.d.tsView file

14patternName = generic_password severity = medium line = 14 matchedText = * pass...eak'

Medium

Secret Pattern

Hardcoded password in dist/lib/validation/ValidationException.d.ts

dist/lib/validation/ValidationException.d.tsView on unpkg · L14

Findings

5 High5 Medium5 Low

HighChild Processdist/development/cli/index.js

HighSame File Env Network Executiondist/production/arcanajs.min.js

HighObfuscated Payload Loaderdist/development/cli/index.js

HighCross File Remote Execution Contextdist/development/cli/index.js

HighRuntime Package Installdist/development/cli/index.js

MediumDynamic Requirebin/arcanajs.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/validation/ValidationException.d.ts

LowScripts Present

LowEvaldist/development/cli/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

Source & flagged code

8 flagged

dist/development/cli/index.jsView file

Lines 1-33javascript

1/******/ (() => { // webpackBootstrap

2/******/ var __webpack_modules__ = ({

4/***/ "./node_modules/reflect-metadata/Reflect.js":

5/*!**************************************************!*\

6 !*** ./node_modules/reflect-metadata/Reflect.js ***!

7 \**************************************************/

8/***/ (() => {

10/*! *****************************************************************************

12Licensed under the Apache License, Version 2.0 (the "License"); you may not use

13this file except in compliance with the License. You may obtain a copy of the

14License at http://www.apache.org/licenses/LICENSE-2.0

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/development/cli/index.jsView on unpkg · L13

16THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

17KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED

18WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,

19MERCHANTABLITY OR NON-INFRINGEMENT.

21See the Apache Version 2.0 License for specific language governing permissions

22and limitations under the License.

23***************************************************************************** */

24var Reflect;

25(function (Reflect) {

26 // Metadata Proposal

27 // https://rbuckton.github.io/reflect-metadata/

28 (function (factory) {

29 var root = typeof globalThis === "object" ? globalThis :

30 typeof global === "object" ? global :

31 typeof self === "object" ? self :

32 typeof this === "object" ? this :

33 sloppyModeThis();

Lines 1433-1473javascript

1433/***/ ((__unused_webpack_module, exports, __webpack_require__) => {

1434

1435"use strict";

1436

1437Object.defineProperty(exports, "__esModule", ({

1438 value: true

1439}));

1440function _export(target, all) {

Lines 2141-2181javascript

2141 };

2142}

2143const detectPackageManager = ()=>{

2144 const cwd = process.cwd();

2145 if (_fs.default.existsSync(_path.default.join(cwd, "bun.lockb"))) {

2146 return "bun";

2147

Lines 14042-14104javascript

14042 writable: true

14043 });

14044 } else {

14045 obj[key] = value;

14046 }

14047 return obj;

14048}

14049class ModuleLoader {

14050 /**

14051 * Dynamically require a module at runtime.

14052

bin/arcanajs.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

3require("../dist/cli/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/arcanajs.jsView on unpkg · L2

dist/production/arcanajs.min.jsView file

Lines 1-2javascript

1(()=>{var __webpack_modules__={190:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"ClassScanner",{enumerable:!0,get:function(){return u}});const

dist/lib/validation/ValidationException.d.tsView file

Lines 1-34typescript

1import type { ErrorFormat, FlatErrorResponse, ValidationErrorResponse, ValidationErrors } from "./types";

2/**

3 * Professional ValidationException with multiple error formats

4 * and comprehensive error handling capabilities.

5 *

6 * @example

7 * ```typescript

8 * // Throw validation exception

9 * throw new ValidationException({ email: ['Invalid email format'] });