Loading npm security reports…

create-entity-app-server: Suspicious npm security report (Warn) | LPM Firewall

registry / create-entity-app-server / 0.9.0

create-entity-app-server@0.9.0

Create an Entity App Server project with Fastify, hooks, routes, and Entity Server integration.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 335 file(s), 1.36 MB of source, external domains: access.line.me, accounts.google.com, api-alimtalk.cloud.toast.com, api-m.sandbox.paypal.com, api-sms.cloud.toast.com, api.anthropic.com, api.github.com, api.inicis.com, api.line.me, api.linkedin.com, api.odcloud.kr, api.openai.com, api.ppurio.com, api.push.apple.com, api.sandbox.push.apple.com, api.sendbill.co.kr, api.solapi.com, api.tosspayments.com, api.upstage.ai, api.wannapayments.co.kr, apis.aligo.in, apis.data.go.kr, appleid.apple.com, barobill.co.kr, crossplatform.payco.com, example.com, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, gw.settlebank.co.kr, js.tosspayments.com, kakaoapi.aligo.in, kapi.kakao.com, kauth.kakao.com, nice.checkplus.co.kr, nid.naver.com, nspay.settlebank.co.kr, oauth2.googleapis.com, one-api.danalpay.com, open-api.kakaopay.com, openapi.naver.com, pay.paygate.naver.com, pgapi.payletter.com, schemas.xmlsoap.org, stg-spl.kcp.co.kr, svc.niceapi.co.kr, uas.danal.co.kr, vision.googleapis.com, ws.baroservice.com, www.googleapis.com

Source & flagged code

7 flagged · loading source

dist/.envView file

15patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L15: ENTITY_API_KEY=<redacted:12 value> L16: ENTITY_HMAC_SECRET=<redacted:44 token-like> L19: JWT_SECRET=<redacted:48 token-like> L26: WEB_PUSH_VAPID_PRIVATE_KEY=<redacted:0 empty>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L15

dist/system.jsView file

1import{Agent as Ea,setGlobalDispatcher as Ca}from"undici";import{z as V}from"zod";import Wr from"path";import{z as g}from"zod";import Vr from"dotenv";import{existsSync as Kr}from"f... L2: `),o()})});import ms from"fastify-plugin";import{randomUUID as ss}from"crypto";import as from"jsonwebtoken";import{WebSocketServer as cs}from"ws";import{randomUUID as jn}from"crypt...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/system.jsView on unpkg · L1

dist/app/plugins/2fa/totp-utils.tsView file

50} L51: return Buffer.from(output); L52: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/app/plugins/2fa/totp-utils.tsView on unpkg · L50

dist/scripts/logs.shView file

•path = dist/scripts/logs.sh kind = build_helper sizeBytes = 2955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/logs.shView on unpkg

dist/app/plugins/oauth/docs/README.mdView file

104patternName = private_key_rsa severity = critical line = 104 matchedText = APPLE_PR......"

Critical

Secret Pattern

RSA private key in dist/app/plugins/oauth/docs/README.md

dist/app/plugins/oauth/docs/README.mdView on unpkg · L104

dist/docs/system-api.mdView file

878patternName = generic_password severity = medium line = 878 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in dist/docs/system-api.md

dist/docs/system-api.mdView on unpkg · L878

911patternName = generic_password severity = medium line = 911 matchedText = const pa...3!";

Medium

Secret Pattern

Hardcoded password in dist/docs/system-api.md

dist/docs/system-api.mdView on unpkg · L911

Source & flagged code

7 flagged

dist/.envView file

15patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L15: ENTITY_API_KEY=<redacted:12 value> L16: ENTITY_HMAC_SECRET=<redacted:44 token-like> L19: JWT_SECRET=<redacted:48 token-like> L26: WEB_PUSH_VAPID_PRIVATE_KEY=<redacted:0 empty>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L15

dist/system.jsView file

Lines 1-11javascript

1import{Agent as Ea,setGlobalDispatcher as Ca}from"undici";import{z as V}from"zod";import Wr from"path";import{z as g}from"zod";import Vr from"dotenv";import{existsSync as Kr}from"fs";import re from"path";import{fileURLToPath as zr}from"url";var ne=null,we=null;function oe(){if(ne)return ne;let e=re.dirname(zr(import.meta.url)),t=[re.resolve(e,"configs"),re.resolve(e,"..","configs"),re.resolve(e,"..","..","..","configs")];for(let n of t)if(Kr(n))return ne=n,n;return ne=t[t.length-1],ne}function $t(){return we||(we=re.resolve(oe(),".."),we)}import{existsSync as Jr,readFileSync as Gr}from"fs";imp ...

2`),o()})});import ms from"fastify-plugin";import{randomUUID as ss}from"crypto";import as from"jsonwebtoken";import{WebSocketServer as cs}from"ws";import{randomUUID as jn}from"crypto";var Bn="/v1/realtime";function ns(e){return e??"event"}function rs(e){return String(e??"system").trim()||"system"}function os(e){return String(e).trim()||"system.unknown"}function j(e){return{v:1,id:e.id??jn(),ts:e.ts??new Date().toISOString(),type:ns(e.type),channel:rs(e.channel),event:os(e.event),...typeof e.data>"u"?{}:{data:e.data},...e.meta?{meta:e.meta}:{},...e.reply_to?{reply_to:e.reply_to}:{}}}function fe( ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/system.jsView on unpkg · L1

3Connection: close\r

4\r

5`),n.destroy();return}this.wss.handleUpgrade(t,n,r,s=>{this.wss.emit("connection",s,t,i)})}parseRequestUrl(t){try{return new URL(t.url??"",y.baseUrl)}catch{return

6`)}

7`)}var Or=50*1024*1024,va=process.env.AS_STARTUP_PROFILE==="1";async function A(e,t){if(!va)return t();let

8${n.join(`

9`)}`;u.warn({moduleFailures:e.length,entityFailures:t.length},r),console.warn(`[startup] ${r}`)}var Pa=Symbol.for("entity-app-server:runtime-state"),H=globalThis[Pa]??={},_a=process.env.AS_STARTUP_PROFILE==="1";async function Ft(e,t){if(!_a)return t();let n=Br.now();try{return await t()}finally{u.info({step:e,elapsedMs:Number((Br.now()-n).toFixed(1))},"AS startup profile")}}process.on("unhandledRejection",e=>{u.error({err:e},"unhandledRejection \u2014 \uD504\uB85C\uC138\uC2A4\uB294 \uC720\uC9C0\uB429\uB2C8\uB2E4")});process.on("uncaughtException",e=>{u.error({err:e},"uncaughtException \u2014 \ ...

10`+t),setTimeout(()=>process.exit(1),200);return}}Fa();

11

Long lines were clipped for display.

dist/app/plugins/2fa/totp-utils.tsView file

Lines 30-70typescript

30 result += BASE32_CHARS[(value << (5 - bits)) & 0x1f];

31 }

32 return result;

33}

34

35/** Base32 디코딩 (NoPadding, 대소문자 무시) */

dist/scripts/logs.shView file

•path = dist/scripts/logs.sh kind = build_helper sizeBytes = 2955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/logs.shView on unpkg

dist/app/plugins/oauth/docs/README.mdView file

Lines 84-124markdown

84# Google

85GOOGLE_CLIENT_ID=...

86GOOGLE_CLIENT_SECRET=...

87

88# GitHub

89GITHUB_CLIENT_ID=...

90GITHUB_CLIENT_SECRET=...

91

92# Naver

93NAVER_CLIENT_ID=...

94NAVER_CLIENT_SECRET=...

95

dist/docs/system-api.mdView file

Lines 858-931markdown

858

859// 검증

860const submitted = request.body.code;

861const stored = await cache("auth").get(`verify:${email}`);

862if (submitted === stored) {

863 console.log("Code verified");

864}

865```

866

867---

868

869