registry / create-efc-app / 0.3.7

create-efc-app@0.3.7

Interactive scaffolder for Express File Cluster projects

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 142 KB of source, external domains: example.com, yourapp.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1743-1783javascript

1743export {};

1744`;

1745 await fs.outputFile(path.join(dest, "src", "model", `Coupon.${ext}`), content);

1746}

1747async function writeAuthExtendedRoutes(dest, opts) {

1748 const ext = opts.language === "typescript" ? "ts" : "js";

1749 const ts = opts.language === "typescript";

1750 const mwUser2 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];

1751` : `export const middlewares = [requireAuth];

1752`;

1753 const mwUser3 = mwUser2;

1754 const reqT = ts ? `import type { Request, Response } from 'express';

1755` : "";

1756 const RA = `import { requireAuth } from 'express-file-cluster/auth';

1757`;

1758 const mongo = opts.database === "mongodb";

1759 const sendResetEmail = opts.mailer ? ` var appUrl = process.env.APP_URL || 'http://localhost:3000';

1760 await enqueue('SendEmail', {

1761 to: email,

1762 subject: 'Reset your password',

1763 body: 'Reset your password: ' + appUrl + '/auth/reset-password?token=' + resetToken,

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1763

1764 });

1765` : ` // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail

1766`;

1767 const sendVerifyEmailResend = opts.mailer ? ` var appUrl = process.env.APP_URL || 'http://localhost:3000';

1768 await enqueue('SendEmail', {

1769 to: email,

1770 subject: 'Verify your email address',

1771 body: 'Verify your email: ' + appUrl + '/auth/verify-email?token=' + verifyToken,

1772 });

1773` : ` // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail

1774`;

1775 const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';

1776` : "";

1777 const refreshMeta = mkMeta(opts, "Refresh the JWT and issue a new token.", `{ message: 'Token refreshed' }`);

1778 const refreshContent = mongo ? ts ? `import { issueToken } from 'express-file-cluster/auth';

1779import type { Request, Response } from 'express';

1780import crypto from 'node:crypto';

1781import { User } from '../../model/User.js';

1782import { Admin } from '../../model/Admin.js';

1783${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days

Lines 1974-2014javascript

1974 else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });

1975${sendResetEmail} }

1976

1977 res.json({ message: 'Reset email sent' });

1978};

1979` : ts ? `${RA}import type { Request, Response }

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1763patternName = generic_password severity = medium line = 1763 matchedText = body: 'R...ken,

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code