registry / create-express-modular / 3.3.6
create-express-modular@3.3.6
Scaffold a modular, domain-driven Express + TypeScript backend. Choose your database (Mongoose, Prisma, or Drizzle) and validator (Zod or Joi). Optionally add JWT auth and Docker setup.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/bin/cli.jsView file
1#!/usr/bin/env node
L2: 'use strict';var ue=require('fs'),Re=require('path'),child_process=require('child_process'),util=require('util'),I3=require('https'),$3=require('os');function _interopDefault(e){re...
L3: `),{succeed:s=>pe(s),fail:s=>ye(s)};let r=["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"],t=0,n=" ".repeat(e.length+12),i=setInterval(()...
High
1#!/usr/bin/env node
L2: 'use strict';var ue=require('fs'),Re=require('path'),child_process=require('child_process'),util=require('util'),I3=require('https'),$3=require('os');function _interopDefault(e){re...
L3: `),{succeed:s=>pe(s),fail:s=>ye(s)};let r=["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"],t=0,n=" ".repeat(e.length+12),i=setInterval(()...
L4: `).forEach(i=>{let o=wb(i);o!==null&&console.log(o);});}),t.stderr.setEncoding("utf8"),t.stderr.on("data",n=>{n.split(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/cli.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin/cli.js:
`).slice(0,20).forEach(b=>{console.log(` ${Me(b)}`);}));}),A(),console.log(` ${w("\u2500".repeat(50))}`),A();let s=t.every(d=>d.passed),c=t.length,u=t.filter(d=>!d.passed).l...
`);return o!==-1&&(r=kO(r,i,n,o)),n+r+i},ql,h2=(e,...r)=>{let[t]=r;if(!Jo(t)||!Jo(t.raw))return r.join(" ");let n=r.slice(1),i=[t.raw[0]];for(let o=1;o<t.length;o++)i.push(String(n...
`);});var F5=f((V6e,nne)=>{nne.exports={dots:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"]},dots2:{interval:80,fra...
\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMN
Findings
6 High3 Medium5 Low
HighChild Processdist/bin/cli.js
HighShell
HighSame File Env Network Executiondist/bin/cli.js
HighCredential Redirect Persistencedist/bin/cli.js
HighCommand Output Exfiltrationdist/bin/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to create-express-modular@3.3.6.
See all versions of create-express-modular for other recorded verdicts.
- Review the evidence and your use of create-express-modular@3.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.