registry / decocms / 3.91.0

decocms@3.91.0

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 216 file(s), 8.71 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.26 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoWebSocketObfuscatedHighEntropyStringsMinifiedUrlStringsdecocms.comgithub.comstudio.decocms.com

dist/server/server.js4.80 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsai-site.deco.sitedecoims.comus.i.posthog.com

Source & flagged code

7 flagged

dist/client/assets/index-DkuCmq2i.jsView file

Lines 1-22javascript

1import{bg as fd,bh as Be,bi as jo,s as $,ak as Ae,aF as gt,bj as Os,aC as me,bk as ar,bl as Ge,aD as Wt,bm as Cn,o as W,bn as Es,bo as Oo,bp as md,bq as hd,br as xl,bs as pd,bt as gd,bu as yd,bv as vl,bw as bd,b6 as ft,bx as xd,aE as ht,by as vd,c as Te,r as P,l as ei,j as h,aP as Sl,C as As,a as Sd,t as $r,bz as Cs,bA as wl,bB as wd,bC as jd,bf as jl,bD as _s,R as Od,bE as Ed,bF as Ad,bG as Cd,a2 as _d,V as fn,U as gr,Z as _n,ah as Id,ai as Td,bH as Pd,X as Nd,bI as kd,B as ti,i as Is,b as Fd,E as $d,aa as Rd}from"./index-CpYfLdbh.js";import{P as Mn}from"./index-DiDBx4Jd.js";import{E as Ol}fr ...

2`,y);const{allOf:f,...p}=d;return p}}return ue in d&&is in d&&(d=Object.keys(d.properties).reduce((y,f)=>{const p=kc(y,f);return we(p)||(y.properties[f]=Ne(e,{allOf:[y.properties[f],...Object.values(p)]},n,R(r,[f]),o)),y},{...d,properties:{...d.properties}})),is in d||hn in d&&d.additionalProperties!==!1?S0(e,d,n,r,o):d}):[{}]}function j0(e,t,n,r,i){let s;const{oneOf:o,anyOf:a,...l}=t;if(Array.isArray(o)?s=o:Array.isArray(a)&&(s=a),s){const c=i===void 0&&r?{}:i,u=Je(t);s=s.map(m=>Tt(m,n,[]));const d=Xr(e,c,s,n,u);if(r){const m=$c(s,!1,n);return Xr(e,c,m,n,u),s.map(y=>pt(l,y))}return[pt(l,s[d]) ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DkuCmq2i.jsView on unpkg · L2

3`,u),l}for(const u of[Q,ae]){const d=c[u];if(Array.isArray(d)&&d.length>0){const m=l[u],y=Array.isArray(m)?[...m]:[];let f=!1;for(let p=0;p<d.length;p++){const b=d[p],w=(i=b?.[er])!==null&&i!==void 0?i:b?.[pe];if(w&&w in o){const S=y[p]||{};y[p]=Jt(o[w],S),f=!0}}f&&(l[u]=y)}}}return l}function ir(e){if(e.const||e.enum&&e.enum.length===1&&e.enum[0]===!0)return!0;if(e.anyOf&&e.anyOf.length===1)return ir(e.anyOf[0]);if(e.oneOf&&e.oneOf.length===1)return ir(e.oneOf[0]);if(e.allOf){const t=n=>ir(n);return e.allOf.some(t)}return!1}function Fa(e,t){if(Object.is(e,t))return!0;if(e==null||t==null||type ...

4`&&p===`

5`&&!c&&m===0)return null;if(!c&&m===0){for(var S=0;l+S<e.length&&e[l+S]===r[0];)S++;if(S>=i&&(i!==1||r!=="*"&&r!=="_"||e[l-1]!==r&&e[l+1]!==r)){var E=[e.slice(0,l+S),s,y+e.slice(l+i,l+S)];return E.index=0,E.input=e,E}}y+=b,p=b,l++}else{var O=e[l+1],g=e.indexOf(">",l);if(g!==-1){var v=e.slice(l,g+1).endsWith("/>");O==="/"?m=Math.max(0,m-1):v||m++}u=!0,y+=b,p=b,l++}}else c=!c,y+=b,p=b,l++;else y+=b,f=!0,p=b,l++}return null}const g1=["children","options"],Wa=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&s++;const o=s;let a=s,l=1;const c=e.length;for(;l>0;){const d=e.indexOf("<",s);if(d===-1)return null;let m=-1,y=-1;if(e[d+1]==="/")y=d;else if(e[d+1]===r[0]||e[d+1]===n[0]){let f=!0;for(let p=0;p<r.length;p++){const b=e[d+1+p];if(b!==r[p]&&b!==n[p]){f=!1;break}}!f||e[d+i]!==" "&&e[d+i]!==">"||(m=d)}if(m!==-1||y!==-1)if(m!==-1&&(y===-1||m<y))s=m+i+1,l++;else{let f=y+2;for(;f<c;){const b=e[f];if(b!==" "&&b!==" "&&b!==`

7`&&b!=="\r")break;f++}if(f+r.length>c)return null;let p=!0;for(let b=0;b<r.length;b++){const w=e[f+b];if(w!==r[b]&&w!==n[b]){p=!1;break}}if(!p){s=f;continue}for(f+=r.length;f<c;){const b=e[f];if(b!==" "&&b!==" "&&b!==`

8`&&b!=="\r")break;f++}if(f>=c||e[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+1}let u=0;for(;s+u<c&&e[s+u]===`

9`;)u++;return[e.slice(0,s+u),n,t[2],e.slice(o,a)]}const F1=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi,Qa=/^)/,$1=/^(data|aria|x)-[a-z_][a-z\d_.-]*$/,bs=/^ *<([a-z][a-z0-9:]*)(?:\s+((?:<.*?>|[^>])*))?\/?>(?!<\/\1>)(\s*\n)?/i,R1=/^\{.*\}$/,D1=/^(https?:\/\/[^\s<]+[^<.,:;"')\]\s])/,M1=/^<([^ >]+[:@\/][^ >]+)>/,U1=/-([a-z])?/gi,el=/^(\|.*)\n(?: *(\|? *[-:]+ *\|[-| :]*)\n((?:.*\|.*\n)*))?\n?/,L1=/^[^\n]+(?: \n|

10`).match(i),d=s.exec(u[0]),m=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:u.map(function(f,p){const b=f.replace(m,"").replace(s,""),w=p===u.length-1,S=Xe(b,`

12`)||w&&y;y=S;const E=l.inline,O=l.list;let g;l.list=!0,S?(l.inline=!1,g=or(b)+`

14`):(l.inline=!0,g=or(b));const v=a(g,l);return l.inline=E,l.list=O,v}),ordered:n,start:c}}}}const aS=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$|[^\\s\\\\]|\\\\.)*?)>?(?:\\s+['"]([\\s\\S]*?)['"])?\\s*\\)`),lS=/^!\[(.*?)\]$ *((?:\([^)]*$|[^() ])*) *"?([^)"]*)?"?\)/;function nl(e){return typeof e=="string"}function or(e){let t=e.length;for(;t>0&&e[t-1]<=" ";)t--;return e.slice(0,t)}function xs(e,t){return e.startsWith(t)}function Xe(e,t){return e.indexOf(t)!==-1}function cS(e,t,n){if(Array.isArray(n)){for(let r=0;r<n.length;r++)if(xs( ...

15`).map(function(c){return rl(c,a,l,!0)})})(e[3],t,n):[],s=rl(e[1],t,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:s,type:"25"}:{children:s,type:"21"}}function il(e,t){return e.align[t]==null?{}:{textAlign:e.align[t]}}function _t(e){return e.inline=1,e}function wt(e){return _t(function(t,n){return n.inline?e.exec(t):null})}function Pr(e){return _t(function(t,n){return n.inline||n.simple?e.exec(t):null})}function ct(e){return function(t,n){return n.inline||n.simple?null:e.exec(t)}}function sl(e){return _t(function(t){return e.exec(t)})}const fS=/(javascript|vbscript|data(?!:i ...

17`,{inline:p});if(t.ast)return b;const w=y(b);for(;nl(w[w.length-1])&&!w[w.length-1].trim();)w.pop();if(c.length&&w.push(a("footer",{key:"footer"},c.map(function(O){return a("div",{id:n(O.identifier,qn),key:O.identifier},O.identifier,y(m(O.footnote,{inline:!0})))}))),t.wrapper===null)return w;const S=t.wrapper||(p?"span":"div");let E;if(w.length>1||t.forceWrapper)E=w;else{if(w.length===1)return E=w[0],typeof E=="string"?a("span",{key:"outer"},E):E;E=null}return i(S,tt({key:"outer"},t.wrapperProps),E)}const c=[],u={},d={0:{t:[">"],o:ct(Ga),u:1,i(f,p,b){const[,w,S]=f[0].replace(S1,"").match(w1);r ...

18`);return p>0&&p<f.length-1&&(f[p+1]==="="||f[p+1]==="-")},o:ct(Xa),u:1,i:(f,p,b)=>({children:qr(p,f[1],b),level:f[2]==="="?1:2,type:"9"})},11:{t:["<"],o:_t(k1),u:1,i(f,p,b){const[,w]=f[3].match(tS),S=RegExp("^"+w,"gm"),E=f[3].replace(S,""),O=ol(o,E)?pS:qr,g=f[1].toLowerCase(),v=y1.indexOf(g)!==-1,j=(v?g:f[1]).trim(),x={attrs:qi(j,f[2],r,l),noInnerParse:v,tag:j};if(b.inAnchor=b.inAnchor||g==="a",v)x.text=f[3];else{const A=b.inHTML;b.inHTML=!0,x.children=O(p,E,b),b.inHTML=A}return b.inAnchor=!1,x}},13:{t:["<"],o:sl(bs),u:1,i(f){const p=f[1].trim();return{attrs:qi(p,f[2]||"",r,l),tag:p}}},12:{t: ...

19`],o:ct(A1),u:3,i:zi},21:{t:function(f,p){return!p.inline&&!p.simple},o:_t(function(f,p){if(p.inline||p.simple||p.inHTML&&!Xe(f,`

21`)&&!Xe(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-CpYfLdbh.jsView file

159|| (${P} === "string" && ${A} && ${A} == +${A} && !(${A} % 1))`).assign(L,(0,r._)`+${A}`);return;case"boolean":O.elseIf((0,r._)`${A} === "false" || ${A} === 0 || ${A} === null`).as... L160: || ${P} === "boolean" || ${A} === null`).assign(L,(0,r._)`[${A}]`)}}}function g({gen:E,parentData:T,parentDataProperty:R},O){E.if((0,r._)`${T} !== undefined`,()=>E.assign((0,r._)`$... L161: missingProperty: ${h},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-CpYfLdbh.jsView on unpkg · L159

dist/client/assets/file-type-icon-BqeQzn3H.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-BqeQzn3H.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028754 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8659188 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/client/assets/index-DkuCmq2i.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = `,y);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DkuCmq2i.jsView on unpkg · L2

dist/client/assets/index-CpYfLdbh.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-CpYfLdbh.jsView on unpkg · L159

dist/client/assets/file-type-icon-BqeQzn3H.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-BqeQzn3H.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028754 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8659188 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Findings

2 High8 Medium8 Low

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/index-DkuCmq2i.js

MediumDynamic Requiredist/client/assets/file-type-icon-BqeQzn3H.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/index-CpYfLdbh.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/client/assets/index-DkuCmq2i.jsView file

Lines 1-22javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DkuCmq2i.jsView on unpkg · L2

4`&&p===`

8`&&b!=="\r")break;f++}if(f>=c||e[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+1}let u=0;for(;s+u<c&&e[s+u]===`

10`).match(i),d=s.exec(u[0]),m=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:u.map(function(f,p){const b=f.replace(m,"").replace(s,""),w=p===u.length-1,S=Xe(b,`

12`)||w&&y;y=S;const E=l.inline,O=l.list;let g;l.list=!0,S?(l.inline=!1,g=or(b)+`

19`],o:ct(A1),u:3,i:zi},21:{t:function(f,p){return!p.inline&&!p.simple},o:_t(function(f,p){if(p.inline||p.simple||p.inHTML&&!Xe(f,`

21`)&&!Xe(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-CpYfLdbh.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-CpYfLdbh.jsView on unpkg · L159

dist/client/assets/file-type-icon-BqeQzn3H.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-BqeQzn3H.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028754 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8659188 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg