create-entity-app-server@0.8.11: Suspicious npm security report | LPM Firewall

Loading npm security reports…

create-entity-app-server@0.8.11: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/.envView file

15patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L15: ENTITY_API_KEY=<redacted:12 value> L16: ENTITY_HMAC_SECRET=<redacted:44 token-like> L19: JWT_SECRET=<redacted:48 token-like> L26: WEB_PUSH_VAPID_PRIVATE_KEY=<redacted:0 empty>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L15

dist/system.jsView file

1import{z as W}from"zod";import Nr from"path";import{z as p}from"zod";import $r from"dotenv";import{existsSync as Fr}from"fs";import oe from"path";import{fileURLToPath as Ir}from"ur... L2: `),o()})});import Vi from"fastify-plugin";import{randomUUID as Ui}from"crypto";import zi from"jsonwebtoken";import{WebSocketServer as Ki}from"ws";import{randomUUID as Dn}from"crypt...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/system.jsView on unpkg · L1

dist/app/plugins/2fa/totp-utils.tsView file

50} L51: return Buffer.from(output); L52: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/app/plugins/2fa/totp-utils.tsView on unpkg · L50

dist/scripts/logs.shView file

•path = dist/scripts/logs.sh kind = build_helper sizeBytes = 2955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/logs.shView on unpkg

dist/app/plugins/oauth/docs/README.mdView file

104patternName = private_key_rsa severity = critical line = 104 matchedText = APPLE_PR......"

Critical

Secret Pattern

RSA private key in dist/app/plugins/oauth/docs/README.md

dist/app/plugins/oauth/docs/README.mdView on unpkg · L104

dist/docs/system-api.mdView file

878patternName = generic_password severity = medium line = 878 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in dist/docs/system-api.md

dist/docs/system-api.mdView on unpkg · L878

911patternName = generic_password severity = medium line = 911 matchedText = const pa...3!";

Medium

Secret Pattern

Hardcoded password in dist/docs/system-api.md

dist/docs/system-api.mdView on unpkg · L911

Source & flagged code

7 flagged

dist/.envView file

15patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L15: ENTITY_API_KEY=<redacted:12 value> L16: ENTITY_HMAC_SECRET=<redacted:44 token-like> L19: JWT_SECRET=<redacted:48 token-like> L26: WEB_PUSH_VAPID_PRIVATE_KEY=<redacted:0 empty>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L15

dist/system.jsView file

Lines 1-11javascript

1import{z as W}from"zod";import Nr from"path";import{z as p}from"zod";import $r from"dotenv";import{existsSync as Fr}from"fs";import oe from"path";import{fileURLToPath as Ir}from"url";var re=null,be=null;function ie(){if(re)return re;let e=oe.dirname(Ir(import.meta.url)),t=[oe.resolve(e,"configs"),oe.resolve(e,"..","configs"),oe.resolve(e,"..","..","..","configs")];for(let n of t)if(Fr(n))return re=n,n;return re=t[t.length-1],re}function Nt(){return be||(be=oe.resolve(ie(),".."),be)}import{existsSync as Dr,readFileSync as Mr}from"fs";import qr from"path";function _(e){return e.replace(/\$\{(\w+ ...

2`),o()})});import Vi from"fastify-plugin";import{randomUUID as Ui}from"crypto";import zi from"jsonwebtoken";import{WebSocketServer as Ki}from"ws";import{randomUUID as Dn}from"crypto";var Fn="/v1/realtime";function Hi(e){return e??"event"}function Bi(e){return String(e??"system").trim()||"system"}function Li(e){return String(e).trim()||"system.unknown"}function j(e){return{v:1,id:e.id??Dn(),ts:e.ts??new Date().toISOString(),type:Hi(e.type),channel:Bi(e.channel),event:Li(e.event),...typeof e.data>"u"?{}:{data:e.data},...e.meta?{meta:e.meta}:{},...e.reply_to?{reply_to:e.reply_to}:{}}}function le( ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/system.jsView on unpkg · L1

3Connection: close\r

4\r

5`),n.destroy();return}this.wss.handleUpgrade(t,n,r,s=>{this.wss.emit("connection",s,t,i)})}parseRequestUrl(t){try{return new URL(t.url??"",y.baseUrl)}catch{return null}}async authenticateRequest(t){let n=String(t.searchParams.

6`)}

7`)}var Cr=50*1024*1024,na=process.env.AS_STARTUP_PROFILE==="1";async function T(e,t){if(!na)return t();let n=Er.now();try{return await t()}finally{u.info({step:e,elapsedMs:Number((Er.now()-n).toFixed(1))},"AS startup profile")}}function ra(e){let t=he.join(e,"config.json");if(!Pr

8${n.join(`

9`)}`;u.warn({moduleFailures:e.length,entityFailures:t.length},r),console.warn(`[startup] ${r}`)}var sa=Symbol.for("entity-app-server:runtime-state"),$=globalThis[sa]??={},aa=process.env.AS_STARTUP_PROFILE==="1";async function Ft(e,t){if(!aa)return t();let n=xr.now();try{return await t()}finally{u.info({step:e,elapsedMs:Number((xr.now()-n).toFixed(1))},"AS startup profile")}}process.on("unhandledRejection",e=>{u.error({err:e},"unhandledRejection \u2014 \uD504\uB85C\uC138\uC2A4\uB294 \uC720\uC9C0\uB429\uB2C8\uB2E4")});process.on("uncaughtException",e=>{u.error({err:e},"uncaughtException \u2014 \ ...

10`+t),setTimeout(()=>process.exit(1),200);return}}la();

11

Long lines were clipped for display.

dist/app/plugins/2fa/totp-utils.tsView file

Lines 30-70typescript

30 result += BASE32_CHARS[(value << (5 - bits)) & 0x1f];

31 }

32 return result;

33}

34

35/** Base32 디코딩 (NoPadding, 대소문자 무시) */

dist/scripts/logs.shView file

•path = dist/scripts/logs.sh kind = build_helper sizeBytes = 2955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/logs.shView on unpkg

dist/app/plugins/oauth/docs/README.mdView file

Lines 84-124markdown

84# Google

85GOOGLE_CLIENT_ID=...

86GOOGLE_CLIENT_SECRET=...

87

88# GitHub

89GITHUB_CLIENT_ID=...

90GITHUB_CLIENT_SECRET=...

91

92# Naver

93NAVER_CLIENT_ID=...

94NAVER_CLIENT_SECRET=...

95

dist/docs/system-api.mdView file

Lines 858-931markdown

858

859// 검증

860const submitted = request.body.code;

861const stored = await cache("auth").get(`verify:${email}`);

862if (submitted === stored) {

863 console.log("Code verified");

864}

865```

866

867---

868

869