registry / create-efc-app / 0.4.7

create-efc-app@0.4.7

Interactive scaffolder for Express File Cluster projects

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 169 KB of source, external domains: example.com, yourapp.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1887-1927javascript

1887 await fs.outputFile(path.join(dest, "src", "model", `Coupon.${ext}`), content);

1888}

1889async function writeAuthExtendedRoutes(dest, opts) {

1890 const ext = opts.language === "typescript" ? "ts" : "js";

1891 const ts = opts.language === "typescript";

1892 const mwUser2 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];

1893` : `export const middlewares = [requireAuth];

1894`;

1895 const mwUser3 = mwUser2;

1896 const reqT = ts ? `import type { Request, Response } from 'express';

1897` : "";

1898 const RA = `import { requireAuth } from 'express-file-cluster/auth';

1899`;

1900 const mongo = opts.database === "mongodb";

1901 const hasAdmin = opts.adminPortal;

1902 const uf = opts.userFeatures;

1903 const sendResetEmail = opts.mailer ? ` var appUrl = process.env.APP_URL || 'http://localhost:3000';

1904 await enqueue('SendEmail', {

1905 to: email,

1906 subject: 'Reset your password',

1907 body: 'Reset your password: ' + appUrl + '/auth/reset-password?token=' + resetToken,

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1907

1908 });

1909` : ` // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail

1910`;

1911 const sendVerifyEmailResend = opts.mailer ? ` var appUrl = process.env.APP_URL || 'http://localhost:3000';

1912 await enqueue('SendEmail', {

1913 to: email,

1914 subject: 'Verify your email address',

1915 body: 'Verify your email: ' + appUrl + '/auth/verify-email?token=' + verifyToken,

1916 });

1917` : ` // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail

1918`;

1919 const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';

1920` : "";

1921 if (uf.accountSecurity) {

1922 const refreshMeta = mkMeta(opts, {

1923 POST: {

1924 description: "Refresh the JWT using the refresh-token cookie and issue a new access token.",

1925 response: `{ message: 'Token refreshed' }`

1926 }

1927 });

Lines 2147-2187javascript

2147 res.json({ message: 'Reset email sent' });

2148};

2149` : ts ? `${RA}import type { Request, Response } from 'express';

2150${fpMeta}export const POST = async

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1907patternName = generic_password severity = medium line = 1907 matchedText = body: 'R...ken,

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code