registry / decocms / 3.89.3

decocms@3.89.3

⚠ Under review

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 219 file(s), 8.66 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.26 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoWebSocketObfuscatedHighEntropyStringsMinifiedUrlStringsdecocms.comgithub.comstudio.decocms.com

dist/server/server.js4.79 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsai-site.deco.sitedecoims.comus.i.posthog.com

Source & flagged code

8 flagged

dist/client/assets/Form-DLIz5vwr.jsView file

Lines 1-22javascript

1import{bz as Zr,bA as Kl,r as I,j as p,bB as xs,bC as Wl,bD as zl,bE as ql,bf as Ss,bF as Qr,R as Gl,bG as Hl,bH as Yl,bI as Jl,a2 as Xl,V as Tt,U as vn,Z as Vt,ah as Zl,ai as Ql,bJ as ec,X as tc,bK as nc}from"./index-B37Lpv5S.js";import{R as zi}from"./index-CAIYCRJp.js";import{A as rc}from"./use-mcp-client-CX47WlCL.js";import{R as ic,I as oc,a as sc}from"./index-B7G40tVP.js";import{c as ws}from"./index-BdQq_4o_.js";import{_ as vt}from"./index-BHKcN4cC.js";function W(e){return typeof e!="object"||e===null||typeof e.lastModified=="number"&&typeof File<"u"&&e instanceof File||typeof e.getMonth== ...

2`,g);const{allOf:f,...h}=c;return h}}return ee in c&&Nr in c&&(c=Object.keys(c.properties).reduce((g,f)=>{const h=Oa(g,f);return fe(h)||(g.properties[f]=ye(e,{allOf:[g.properties[f],...Object.values(h)]},n,P(r,[f]),s)),g},{...c,properties:{...c.properties}})),Nr in c||_t in c&&c.additionalProperties!==!1?oh(e,c,n,r,s):c}):[{}]}function dh(e,t,n,r,i){let o;const{oneOf:s,anyOf:a,...l}=t;if(Array.isArray(s)?o=s:Array.isArray(a)&&(o=a),o){const d=i===void 0&&r?{}:i,u=Be(t);o=o.map(m=>$t(m,n,[]));const c=Ai(e,d,o,n,u);if(r)return o.map(m=>qe(l,m));t=qe(l,o[c])}return[t]}function ja(e,t,n,r,i,o,s){c ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/Form-DLIz5vwr.jsView on unpkg · L2

3`,u),l}for(const u of[K,J]){const c=d[u];if(!Array.isArray(c)||c.length===0)continue;const m=l[u],g=Array.isArray(m)?[...m]:[];let f=!1;for(let

4`&&h===`

5`&&!d&&m===0)return null;if(!d&&m===0){for(var S=0;l+S<e.length&&e[l+S]===r[0];)S++;if(S>=i&&(i!==1||r!=="*"&&r!=="_"||e[l-1]!==r&&e[l+1]!==r)){var A=[e.slice(0,l+S),o,g+e.slice(l+i,l+S)];return A.index=0,A.input=e,A}}g+=y,h=y,l++}else{var x=e[l+1],b=e.indexOf(">",l);if(b!==-1){var w=e.slice(l,b+1).endsWith("/>");x==="/"?m=Math.max(0,m-1):w||m++}u=!0,g+=y,h=y,l++}}else d=!d,g+=y,h=y,l++;else g+=y,f=!0,h=y,l++}return null}const Qg=["children","options"],Zo=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&o++;const s=o;let a=o,l=1;const d=e.length;for(;l>0;){const c=e.indexOf("<",o);if(c===-1)return null;let m=-1,g=-

7`&&y!=="\r")break;f++}if(f+r.length>d)return null;let h=!0;for(let y=0;y<r.length;y++){const v=e[f+y];if(v!==r[y]&&

8`&&y!=="\r")break;f++}if(f>=d||e[f]!==">"){o=f;continue}a=g,o=f+1,l--}else o=c+1}let u=0;for(;o+u<

9`;)u++;return[e.slice(0,o+u),n,t[2],e.slice(s,a)]}const yy=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi

10`).match(i),c=o.exec(u[0]),m=RegExp("^ {1,"+(c?c[0].length:0)+"}","gm");let g=!1;return{items:u.map(function(f,h){const y=f.replace(m,"").replace(o,""),v=h===u.length-1,S=Pe(y,`

12`)||v&&g;g=S;const A=l.inline,x=l.list;let b;l.list=!0,S?(l.inline=!1,b=dn(y)+`

14`):(l.inline=!0,b=dn(y));const w=a(b,l);return l.inline=A,l.list=x,w}),ordered:n,start:d}}}}const Wy=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$|[^\\s\\\\]|\\\\.)*?)>?(?:\\s+['"]([\\s\\S]*?)['"])?\\s*\\)`),zy=/^!\[(.*?)\]$ *((?:\([^)]*$|[^() ])*) *"?([^)"]*)?"

15`).map(function(d){return us(d,a,l,!0)})})(e[3],t,n):[],o=us(e[1],t,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:o,type:"25"}:{children:o,type:"21"}}function ds(e,t){return e.align[t]==null?{}:{textAlign:e.align[t]}}function tt(e){return e.inline=1,e}function Xe(e){return tt(function(t,n){return n.inline?e.exec(t):null})}function Nn(e){return tt(function(t,n){return n.inline||n.simple?e.exec(t):null})}function We(e){return function(t,n){return n.inline||n.simple?null:e.exec(t)}}function fs(e){return tt(function(t){return e.exec(t)})}const Yy=/(javascript|vbscript|data(?!:i ...

17`,{inline:h});if(t.ast)return y;const v=g(y);for(;cs(v[v.length-1])&&!v[v.length-1].trim();)v.pop();if(d.length&&v.push(a("footer",{key:"footer"},d.map(function(x){return a("div",{id:n

18`);return h>0&&h<f.length-1&&(f[h+1]==="="||f[h+1]==="-")},o:We(os),u:1,i:(f,h,y)=>({children:Ln(h,f[1],y),level:f[2]==="="?1:2,type:"9"})},11:{t:["<"],o:tt(gy),u:1,i(f,h,y){const[,v]=f[3].match(My),S=RegExp("^"+v,"gm"),A=f[3].replace(S,""),x=ms(s,A)?Zy:Ln,b=f[1].toLowerCase(),w=ey.indexOf(b)!==-1,O=(w?b:f[1]).trim(),j={attrs:Tr(O,f[2],r,l),noInnerParse:w,tag:O};if(y.inAnchor=y.inAnchor||b==="a",w)j.text=f[3];else{const E=y.inHTML;y.inHTML=!0,j.children=x(h,A,y),y.inHTML=E}return y.inAnchor=!1,j}},13:{t:["<"],o:fs(Gr),u:1,i(f){const h=f[1].trim();return{attrs:Tr(h,f[2]||"",r,l),tag:h}}},12:{t: ...

19`],o:We(cy),u:3,i:Fr},21:{t:function(f,h){return!h.inline&&!h.simple},o:tt(function(f,h){if(h.inline||h.simple||h.inHTML&&!Pe(f,`

21`)&&!Pe(h.prevCapture,`

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = decocms@3.84.1 matchedIdentity = npm:ZGVjb2Ntcw:3.84.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/client/assets/Form-DLIz5vwr.jsView on unpkg

dist/client/assets/index-B37Lpv5S.jsView file

159|| (${P} === "string" && ${A} && ${A} == +${A} && !(${A} % 1))`).assign(L,(0,r._)`+${A}`);return;case"boolean":O.elseIf((0,r._)`${A} === "false" || ${A} === 0 || ${A} === null`).as... L160: || ${P} === "boolean" || ${A} === null`).assign(L,(0,r._)`[${A}]`)}}}function g({gen:E,parentData:T,parentDataProperty:R},O){E.if((0,r._)`${T} !== undefined`,()=>E.assign((0,r._)`$... L161: missingProperty: ${h},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-B37Lpv5S.jsView on unpkg · L159

dist/client/assets/file-type-icon-DO4mmgEl.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-DO4mmgEl.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5027352 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8657321 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/client/assets/Form-DLIz5vwr.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/client/assets/Form-DLIz5vwr.jsView on unpkg

2patternName = generic_password severity = medium line = 2 matchedText = `,g);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/Form-DLIz5vwr.jsView on unpkg · L2

dist/client/assets/index-B37Lpv5S.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-B37Lpv5S.jsView on unpkg · L159

dist/client/assets/file-type-icon-DO4mmgEl.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-DO4mmgEl.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5027352 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8657321 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Findings

1 Critical2 High8 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/client/assets/Form-DLIz5vwr.js

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/Form-DLIz5vwr.js

MediumDynamic Requiredist/client/assets/file-type-icon-DO4mmgEl.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/index-B37Lpv5S.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings