busabase: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.21 KB of source

Source & flagged code

6 flagged

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView file

13patternName = private_key_rsa severity = critical line = 13 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView on unpkg · L13

13patternName = private_key_rsa severity = critical line = 13 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in .next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.js

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView on unpkg · L13

bin/busabase.mjsView file

Lines 164-204javascript

164 await mkdir(pgDir, { recursive: true });

165 await mkdir(storageDir, { recursive: true });

166 process.env.PORT = String(port);

167 process.env.HOSTNAME = host;

168 // pglite + local storage persist here so data survives restarts regardless of cwd.

169 process.env.PG_DATABASE_URL ??= `pglite://${pgDir}`;

170 process.env.STORAGE_URL ??= `local:${storageDir}?base_url=/api/dev/attachment`;

171 process.env.NODE_ENV ??= "production";

172

173 const entry = findServerEntry();

174 if (!entry) {

175 console.error(

176 "busabase: no built server found.\n" +

177 "This package must ship the Next standalone build. If you are running from\n" +

178 "source, build it first: pnpm --filter busabase build\n",

179 );

180 process.exit(1);

181 }

182 // Standalone server.js resolves static/public relative to its own directory.

183 process.chdir(dirname(entry));

184 printSplash({ host, port, dataDir });

185 await import(entry);

186}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/busabase.mjsView on unpkg · L184

187

188async function runClientCli(argv) {

189 let runCli;

190 try {

191 ({ runCli } = await import("busabase-cli"));

192 } catch (error) {

193 const siblingBin = resolve(pkgRoot, "../busabase-cli/bin/busabase-cli.mjs");

194 if (existsSync(siblingBin)) {

195 process.env.BUSABASE_CLI_DELEGATED_ARGV = JSON.stringify(argv);

196 await import(siblingBin);

197 return 0;

198 }

199 const message = error instanceof Error ? error.message : String(error);

200 console.error(

201 "busabase: could not load busabase-cli.\n" +

202 `Cause: ${message}\n\n` +

203 "If you are running from source, build the CLI first:\n" +

204 " pnpm --filter busabase-cli build\n\n" +

.next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasmView file

•path = .next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasm kind = wasm_module sizeBytes = 1218626 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasmView on unpkg

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView file

•path = .next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icns kind = high_entropy_blob sizeBytes = 301642 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView on unpkg

•path = .next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icns kind = payload_in_excluded_dir sizeBytes = 301642 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView on unpkg

Source & flagged code

6 flagged · loading source

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView file

13patternName = private_key_rsa severity = critical line = 13 matchedText = -----END...----

busabase: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView file

13patternName = private_key_rsa severity = critical line = 13 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView on unpkg · L13

13patternName = private_key_rsa severity = critical line = 13 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in .next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.js

.next/standalone/apps/busabase/.next/static/media/__worker__.0_husg21o_d3g.jsView on unpkg · L13

bin/busabase.mjsView file

Lines 164-204javascript

164 await mkdir(pgDir, { recursive: true });

165 await mkdir(storageDir, { recursive: true });

166 process.env.PORT = String(port);

167 process.env.HOSTNAME = host;

168 // pglite + local storage persist here so data survives restarts regardless of cwd.

169 process.env.PG_DATABASE_URL ??= `pglite://${pgDir}`;

170 process.env.STORAGE_URL ??= `local:${storageDir}?base_url=/api/dev/attachment`;

171 process.env.NODE_ENV ??= "production";

172

173 const entry = findServerEntry();

174 if (!entry) {

175 console.error(

176 "busabase: no built server found.\n" +

177 "This package must ship the Next standalone build. If you are running from\n" +

178 "source, build it first: pnpm --filter busabase build\n",

179 );

180 process.exit(1);

181 }

182 // Standalone server.js resolves static/public relative to its own directory.

183 process.chdir(dirname(entry));

184 printSplash({ host, port, dataDir });

185 await import(entry);

186}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/busabase.mjsView on unpkg · L184

187

188async function runClientCli(argv) {

189 let runCli;

190 try {

191 ({ runCli } = await import("busabase-cli"));

192 } catch (error) {

193 const siblingBin = resolve(pkgRoot, "../busabase-cli/bin/busabase-cli.mjs");

194 if (existsSync(siblingBin)) {

195 process.env.BUSABASE_CLI_DELEGATED_ARGV = JSON.stringify(argv);

196 await import(siblingBin);

197 return 0;

198 }

199 const message = error instanceof Error ? error.message : String(error);

200 console.error(

201 "busabase: could not load busabase-cli.\n" +

202 `Cause: ${message}\n\n` +

203 "If you are running from source, build the CLI first:\n" +

204 " pnpm --filter busabase-cli build\n\n" +

.next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasmView file

•path = .next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasm kind = wasm_module sizeBytes = 1218626 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.next/standalone/apps/busabase/.next/server/assets/emscripten-module.0m.aum~0l0v7w.wasmView on unpkg

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView file

•path = .next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icns kind = high_entropy_blob sizeBytes = 301642 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView on unpkg

•path = .next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icns kind = payload_in_excluded_dir sizeBytes = 301642 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/apps/busabase-desktop/src-tauri/icons/icon.icnsView on unpkg

busabase@0.9.11

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code