registry / better-auth-studio / 1.1.3-beta.52

better-auth-studio@1.1.3-beta.52

Studio for Better Auth

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 981 KB of source, external domains: accounts.google.com, api.dicebear.com, api.ipinfo.io, example.com, fonts.googleapis.com, fonts.gstatic.com, github.com, ipapi.co, react.dev, registry.npmjs.org, www.googleapis.com

Oversized source lightweight scan

dist/public/assets/main-MRP9atW1.js2.26 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreact.dev

Source & flagged code

6 flagged

package.jsonView file

Lines 26-66json

26 "exports": {

27 ".": "./dist/index.js",

28 "./express": "./dist/adapters/express.js",

29 "./nextjs": "./dist/adapters/nextjs.js",

30 "./hono": "./dist/adapters/hono.js",

31 "./cloudflare-workers": "./dist/adapters/cloudflare-workers.js",

32 "./elysia": "./dist/adapters/elysia.js",

33 "./svelte-kit": "./dist/adapters/svelte-kit.js",

34 "./solid-start": "./dist/adapters/solid-start.js",

35 "./tanstack-start": "./dist/adapters/tanstack-start.js",

36 "./astro": "./dist/adapters/astro.js",

37 "./remix": "./dist/adapters/remix.js",

38 "./nuxt": "./dist/adapters/nuxt.js",

39 "./config": "./dist/types/handler.js"

40 },

41 "scripts": {

42 "build": "pnpm run clean && tsc && pnpm run frontend:build && pnpm run copy:public && pnpm run verify:public",

43 "geo:update": "node scripts/download-geolite2.js",

44 "copy:public": "rm -rf dist/public && cp -r public dist/",

45 "verify:public": "test -f dist/public/index.html && echo '✓ Public directory copied successfully' || (echo '✗ ERROR: Public directory not copied!' && exit 1)",

46 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "dev": "tsx src/cli.ts",

48 "start": "node dist/cli.js",

49 "studio": "tsx src/cli.ts",

50 "clean": "rm -rf dist",

51 "frontend:dev": "cd frontend && pnpm run dev",

52 "frontend:build": "cd frontend && pnpm run build",

53 "frontend:preview": "cd frontend && pnpm run preview",

54 "lint": "oxlint . && oxfmt --check .",

55 "format": "oxlint --fix . && oxfmt .",

56 "lint:fix": "oxlint --fix . && oxfmt .",

57 "type-check": "tsc --noEmit",

58 "test": "vitest",

59 "test:watch": "vitest --watch",

60 "test:coverage": "vitest --coverage",

61 "test:ci": "pnpm test --run",

62 "release": "pnpm build && bumpp && pnpm publish --access public --no-git-checks",

63 "release:beta": "pnpm build && bumpp --preid beta && pnpm publish --access public --tag beta --no-git-checks",

64 "release:no-build": "bumpp && pnpm publish --access public --no-git-checks --tag next",

65 "release:canary": "pnpm build && bumpp --preid canary --no-commit --no-tag --no-push && pnpm publish --access public --tag canary --no-git-checks",

66 "bump": "bumpp"

dist/routes.jsView file

Lines 2887-2965javascript

2887 limit: 1,

2888 });

2889 return res.json({ success: true, result: result });

2890 }

2891 catch (error) {

2892 res.status(500).json({

2893 success: false

dist/auth-adapter.jsView file

Lines 47-87javascript

47 debug: false,

48 fsCache: true,

49 moduleCache: true,

50 interopDefault: true,

51 alias,

52 transformOptions: {

53 babel

dist/public/assets/main-MRP9atW1.jsView file

•path = dist/public/assets/main-MRP9atW1.js kind = oversized_source_file sizeBytes = 2368120 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/main-MRP9atW1.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/routes.jsView file

2945patternName = generic_password severity = medium line = 2945 matchedText = password...23",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/routes.jsView on unpkg · L2945

2907try { L2908: const result = eval(script); L2909: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/routes.jsView on unpkg · L2907

dist/auth-adapter.jsView file

67}); L68: authModule = await jitiInstance.import(importPath); L69: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/auth-adapter.jsView on unpkg · L67

dist/public/assets/main-MRP9atW1.jsView file

•path = dist/public/assets/main-MRP9atW1.js kind = oversized_source_file sizeBytes = 2368120 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/main-MRP9atW1.jsView on unpkg

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/public/assets/main-MRP9atW1.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/routes.js

MediumDynamic Requiredist/auth-adapter.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/routes.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 26-66json

26 "exports": {

27 ".": "./dist/index.js",

28 "./express": "./dist/adapters/express.js",

29 "./nextjs": "./dist/adapters/nextjs.js",

30 "./hono": "./dist/adapters/hono.js",

31 "./cloudflare-workers": "./dist/adapters/cloudflare-workers.js",

32 "./elysia": "./dist/adapters/elysia.js",

33 "./svelte-kit": "./dist/adapters/svelte-kit.js",

34 "./solid-start": "./dist/adapters/solid-start.js",

35 "./tanstack-start": "./dist/adapters/tanstack-start.js",

36 "./astro": "./dist/adapters/astro.js",

37 "./remix": "./dist/adapters/remix.js",

38 "./nuxt": "./dist/adapters/nuxt.js",

39 "./config": "./dist/types/handler.js"

40 },

41 "scripts": {

42 "build": "pnpm run clean && tsc && pnpm run frontend:build && pnpm run copy:public && pnpm run verify:public",

43 "geo:update": "node scripts/download-geolite2.js",

44 "copy:public": "rm -rf dist/public && cp -r public dist/",

45 "verify:public": "test -f dist/public/index.html && echo '✓ Public directory copied successfully' || (echo '✗ ERROR: Public directory not copied!' && exit 1)",

46 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "dev": "tsx src/cli.ts",

48 "start": "node dist/cli.js",

49 "studio": "tsx src/cli.ts",

50 "clean": "rm -rf dist",

51 "frontend:dev": "cd frontend && pnpm run dev",

52 "frontend:build": "cd frontend && pnpm run build",

53 "frontend:preview": "cd frontend && pnpm run preview",

54 "lint": "oxlint . && oxfmt --check .",

55 "format": "oxlint --fix . && oxfmt .",

56 "lint:fix": "oxlint --fix . && oxfmt .",

57 "type-check": "tsc --noEmit",

58 "test": "vitest",

59 "test:watch": "vitest --watch",

60 "test:coverage": "vitest --coverage",

61 "test:ci": "pnpm test --run",

62 "release": "pnpm build && bumpp && pnpm publish --access public --no-git-checks",

63 "release:beta": "pnpm build && bumpp --preid beta && pnpm publish --access public --tag beta --no-git-checks",

64 "release:no-build": "bumpp && pnpm publish --access public --no-git-checks --tag next",

65 "release:canary": "pnpm build && bumpp --preid canary --no-commit --no-tag --no-push && pnpm publish --access public --tag canary --no-git-checks",

66 "bump": "bumpp"

dist/routes.jsView file

Lines 2887-2965javascript

2887 limit: 1,

2888 });

2889 return res.json({ success: true, result: result });

2890 }

2891 catch (error) {

2892 res.status(500).json({

2893 success: false

dist/auth-adapter.jsView file

Lines 47-87javascript

47 debug: false,

48 fsCache: true,

49 moduleCache: true,

50 interopDefault: true,

51 alias,

52 transformOptions: {

53 babel

dist/public/assets/main-MRP9atW1.jsView file

•path = dist/public/assets/main-MRP9atW1.js kind = oversized_source_file sizeBytes = 2368120 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/main-MRP9atW1.jsView on unpkg