registry / decocms / 3.85.0

decocms@3.85.0

⚠ Under review

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 214 file(s), 8.64 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.25 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com

dist/server/server.js4.79 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsai-site.deco.sitedecoims.comus.i.posthog.com

Source & flagged code

8 flagged

dist/client/assets/index-Bc8WGxSb.jsView file

Lines 1-22javascript

1import{bg as lu,bh as De,bi as Gs,C as P,ak as ve,aF as ct,bj as Yi,aC as oe,bk as qn,bl as Be,aD as $t,bm as hn,z as U,bn as Ji,bo as Ys,bp as cu,bq as uu,br as Na,bs as du,bt as fu,bu as mu,bv as Fa,bw as hu,b6 as st,bx as pu,aE as at,by as gu,c as Oe,r as N,l as Fr,j as f,aP as Pa,w as Zi,a as yu,t as gr,bz as Xi,bA as bu,bB as $a,bC as xu,bD as vu,bE as Su,bf as Da,bF as Qi,R as wu,bG as ju,bH as Ou,bI as Eu,a2 as Cu,V as Xt,U as Qn,Z as pn,ah as Au,ai as _u,bJ as Tu,X as Iu,bK as Nu,B as Pr,i as es,b as Fu,E as Pu,aa as $u}from"./index-BOEUnQ16.js";import{P as En}from"./index-AbZbF42n.js" ...

2`,g);const{allOf:m,...p}=c;return p}}return ie in c&&Ii in c&&(c=Object.keys(c.properties).reduce((g,m)=>{const p=Vl(g,m);return ye(p)||(g.properties[m]=Ee(t,{allOf:[g.properties[m],...Object.values(p)]},n,$(r,[m]),o)),g},{...c,properties:{...c.properties}})),Ii in c||en in c&&c.additionalProperties!==!1?Kb(t,c,n,r,o):c}):[{}]}function Xb(t,e,n,r,i){let s;const{oneOf:o,anyOf:a,...l}=e;if(Array.isArray(o)?s=o:Array.isArray(a)&&(s=a),s){const u=i===void 0&&r?{}:i,d=Qe(e);s=s.map(h=>on(h,n,[]));const c=As(t,u,s,n,d);if(r)return s.map(h=>lt(l,h));e=lt(l,s[c])}return[e]}function ql(t,e,n,r,i,s,o){c ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-Bc8WGxSb.jsView on unpkg · L2

3`,d),l}for(const d of[z,ee]){const c=u[d];if(!Array.isArray(c)||c.length===0)continue;const h=l[d],g=Array.isArray(h)?[...h]:[];let m=!1;for(let p=0;p<c.

4`&&p===`

5`&&!u&&h===0)return null;if(!u&&h===0){for(var b=0;l+b<t.length&&t[l+b]===r[0];)b++;if(b>=i&&(i!==1||r!=="*"&&r!=="_"||t[l-1]!==r&&t[l+1]!==r)){var O=[t.slice(0,l+b),s,g+t.slice(l+i,l+b)];return O.index=0,O.input=t,O}}g+=y,p=y,l++}else{var S=t[l+1],v=t.indexOf(">",l);if(v!==-1){var w=t.slice(l,v+1).endsWith("/>");S==="/"?h=Math.max(0,h-1):w||h++}d=!0,g+=y,p=y,l++}}else u=!u,g+=y,p=y,l++;else g+=y,m=!0,p=y,l++}return null}const Lx=["children","options"],ca=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&s++;const o=s;let a=s,l=1;const u=t.length;for(;l>0;){const c=t.indexOf("<",s);if(c===-1)return null;let h=-1,g=-

7`&&y!=="\r")break;m++}if(m+r.length>u)return null;let p=!0;for(let y=0;y<r.length;y++){const x=t[m+y];if(x!==r[y]&&

8`&&y!=="\r")break;m++}if(m>=u||t[m]!==">"){s=m;continue}a=g,s=m+1,l--}else s=c+1}let d=0;for(;s+d<u&&

9`;)d++;return[t.slice(0,s+d),n,e[2],t.slice(o,a)]}const iv=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi,ya=/^)/,sv=/^(data|aria|x)-[a-z_][a-z\d_.-]*$

10`).match(i),c=s.exec(d[0]),h=RegExp("^ {1,"+(c?c[0].length:0)+"}","gm");let g=!1;return{items:d.map(function(m,p){const y=m.replace(h,"").replace(s,""),x=p===d.length-1,b=ze(y,`

12`)||x&&g;g=b;const O=l.inline,S=l.list;let v;l.list=!0,b?(l.inline=!1,v=Wn(y)+`

14`):(l.inline=!0,v=Wn(y));const w=a(v,l);return l.inline=O,l.list=S,w}),ordered:n,start:u}}}}const Nv=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$|[^\\s\\\\]|\\\\.)*?)>?(?:\\s+['"]([

15`).map(function(u){return Sa(u,a,l,!0)})})(t[3],e,n):[],s=Sa(t[1],e,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:s,type:"25"}:{children:s,type:"21"}}function wa(t,e){return t.align[e]==null?{}:{textAlign:t.align[e]}}function xt(t){return t.inline=1,t}function ht(t){return xt(function(e,n){return n.inline?t.exec(e):null})}function hr(t){return xt(function(e,n){return n.inline||n.simple?t.exec(e):null})}function rt(t){return function(e,n){return n.inline||n.simple?null:t.exec(e)}}function ja(t){return xt(function(e){return t.exec(e)})}const kv=/(javascript|vbscript|data(?!:i ...

17`,{inline:p});if(e.ast)return y;const x=g(y);for(;va(x[x.length-1])&&!x[x.length-1].trim();)x.pop();if(u.length&&x.push(a("footer",{key:"footer"},u.map(function(S){return a("div",{id:n

18`);return p>0&&p<m.length-1&&(m[p+1]==="="||m[p+1]==="-")},o:rt(ga),u:1,i:(m,p,y)=>({children:Er(p,m[1],y),level:m[2]==="="?1:2,type:"9"})},11:{t:["<"],o:xt(rv),u:1,i(m,p,y){const[,x]=m[3].match(Ev),b=RegExp("^"+x,"gm"),O=m[3].replace(b,""),S=Oa(o,O)?Uv:Er,v=m[1].toLowerCase(),w=Bx.indexOf(v)!==-1,j=(w?v:m[1]).trim(),E={attrs:bi(j,m[2],r,l),noInnerParse:w,tag:j};if(y.inAnchor=y.inAnchor||v==="a",w)E.text=m[3];else{const A=y.inHTML;y.inHTML=!0,E.children=S(p,O,y),y.inHTML=A}return y.inAnchor=!1,E}},13:{t:["<"],o:ja(qi),u:1,i(m){const p=m[1].trim();return{attrs:bi(p,m[2]||"",r,l),tag:p}}},12:{t: ...

19`],o:rt(Jx),u:3,i:gi},21:{t:function(m,p){return!p.inline&&!p.simple},o:xt(function(m,p){if(p.inline||p.simple||p.inHTML&&!ze(m,`

21`)&&!ze(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-BOEUnQ16.jsView file

159|| (${P} === "string" && ${A} && ${A} == +${A} && !(${A} % 1))`).assign(L,(0,r._)`+${A}`);return;case"boolean":O.elseIf((0,r._)`${A} === "false" || ${A} === 0 || ${A} === null`).as... L160: || ${P} === "boolean" || ${A} === null`).assign(L,(0,r._)`[${A}]`)}}}function g({gen:E,parentData:T,parentDataProperty:R},O){E.if((0,r._)`${T} !== undefined`,()=>E.assign((0,r._)`$... L161: missingProperty: ${h},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-BOEUnQ16.jsView on unpkg · L159

dist/client/assets/file-type-icon-Pm9PbUF4.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-Pm9PbUF4.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5026856 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8654957 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

dist/client/assets/index-B6nON9DX.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = decocms@3.84.1 matchedIdentity = npm:ZGVjb2Ntcw:3.84.1 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/client/assets/index-B6nON9DX.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/client/assets/index-Bc8WGxSb.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = `,g);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-Bc8WGxSb.jsView on unpkg · L2

dist/client/assets/index-BOEUnQ16.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-BOEUnQ16.jsView on unpkg · L159

dist/client/assets/file-type-icon-Pm9PbUF4.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-Pm9PbUF4.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5026856 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8654957 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

dist/client/assets/index-B6nON9DX.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/client/assets/index-B6nON9DX.jsView on unpkg

Findings

1 Critical2 High8 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/client/assets/index-B6nON9DX.js

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/index-Bc8WGxSb.js

MediumDynamic Requiredist/client/assets/file-type-icon-Pm9PbUF4.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/index-BOEUnQ16.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings