registry / decocms / 3.94.1

decocms@3.94.1

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 216 file(s), 8.69 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.26 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com

dist/server/server.js4.80 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsai-site.deco.sitedecoims.comus.i.posthog.com

Source & flagged code

7 flagged

dist/client/assets/index-DYYBsO5B.jsView file

Lines 1-22javascript

1import{bg as _u,bh as ke,bi as io,s as D,ak as ve,aF as ut,bj as ls,aC as ae,bk as Jn,bl as qe,aD as Rt,bm as yn,o as B,bn as cs,bo as so,bp as Iu,bq as Tu,br as Ya,bs as Nu,bt as Pu,bu as Fu,bv as Ja,bw as $u,b6 as ot,bx as Du,aE as lt,by as Ru,c as Oe,r as N,l as Lr,j as m,aP as Za,C as us,a as ku,t as wr,bz as ds,bA as Xa,bB as Mu,bC as Uu,bD as Lu,bf as Qa,bE as fs,R as Bu,bF as Vu,bG as qu,bH as zu,a2 as Wu,V as tn,U as sr,Z as bn,ah as Hu,ai as Ku,bI as Gu,X as Yu,bJ as Ju,B as Br,i as ms,b as Zu,E as Xu,aa as Qu}from"./index-BO3O1WS7.js";import{P as _n}from"./index-C4EnQ1i0.js";import{E ...

2`,y);const{allOf:f,...p}=d;return p}}return se in d&&qi in d&&(d=Object.keys(d.properties).reduce((y,f)=>{const p=cc(y,f);return ye(p)||(y.properties[f]=_e(t,{allOf:[y.properties[f],...Object.values(p)]},n,R(r,[f]),o)),y},{...d,properties:{...d.properties}})),qi in d||rn in d&&d.additionalProperties!==!1?M0(t,d,n,r,o):d}):[{}]}function L0(t,e,n,r,i){let s;const{oneOf:o,anyOf:a,...l}=e;if(Array.isArray(o)?s=o:Array.isArray(a)&&(s=a),s){const u=i===void 0&&r?{}:i,c=He(e);s=s.map(h=>jt(h,n,[]));const d=Ur(t,u,s,n,c);if(r){const h=dc(s,!1,n);return Ur(t,u,h,n,c),s.map(y=>ct(l,y))}return[ct(l,s[d]) ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DYYBsO5B.jsView on unpkg · L2

3`,c),l}for(const c of[H,ee]){const d=u[c];if(Array.isArray(d)&&d.length>0){const h=l[c],y=Array.isArray(h)?[...h]:[];let f=!1;for(let p=0;p<d.length;p++){const b=d[p],v=(i=b?.[qn])!==null&&i!==void 0?i:b?.[de];if(v&&v in o){const S=y[p]||{};y[p]=Bt(o[v],S),f=!0}}f&&(l[c]=y)}}}return l}function Kn(t){if(t.const||t.enum&&t.enum.length===1&&t.enum[0]===!0)return!0;if(t.anyOf&&t.anyOf.length===1)return Kn(t.anyOf[0]);if(t.oneOf&&t.oneOf.length===1)return Kn(t.oneOf[0]);if(t.allOf){const e=n=>Kn(n);return t.allOf.some(e)}return!1}function ga(t,e){if(Object.is(t,e))return!0;if(t==null||e==null||type ...

4`&&p===`

5`&&!u&&h===0)return null;if(!u&&h===0){for(var S=0;l+S<t.length&&t[l+S]===r[0];)S++;if(S>=i&&(i!==1||r!=="*"&&r!=="_"||t[l-1]!==r&&t[l+1]!==r)){var E=[t.slice(0,l+S),s,y+t.slice(l+i,l+S)];return E.index=0,E.input=t,E}}y+=b,p=b,l++}else{var j=t[l+1],g=t.indexOf(">",l);if(g!==-1){var x=t.slice(l,g+1).endsWith("/>");j==="/"?h=Math.max(0,h-1):x||h++}c=!0,y+=b,p=b,l++}}else u=!u,y+=b,p=b,l++;else y+=b,f=!0,p=b,l++}return null}const Fv=["children","options"],Ca=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&s++;const o=s;let a=s,l=1;const u=t.length;for(;l>0;){const d=t.indexOf("<",s);if(d===-1)return null;let h=-1,y=-1;if(t[d+1]==="/")y=d;else if(t[d+1]===r[0]||t[d+1]===n[0]){let f=!0;for(let p=0;p<r.length;p++){const b=t[d+1+p];if(b!==r[p]&&b!==n[p]){f=!1;break}}!f||t[d+i]!==" "&&t[d+i]!==">"||(h=d)}if(h!==-1||y!==-1)if(h!==-1&&(y===-1||h<y))s=h+i+1,l++;else{let f=y+2;for(;f<u;){const b=t[f];if(b!==" "&&b!==" "&&b!==`

7`&&b!=="\r")break;f++}if(f+r.length>u)return null;let p=!0;for(let b=0;b<r.length;b++){const v=t[f+b];if(v!==r[b]&&v!==n[b]){p=!1;break}}if(!p){s=f;continue}for(f+=r.length;f<u;){const b=t[f];if(b!==" "&&b!==" "&&b!==`

8`&&b!=="\r")break;f++}if(f>=u||t[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+1}let c=0;for(;s+c<u&&t[s+c]===`

9`;)c++;return[t.slice(0,s+c),n,e[2],t.slice(o,a)]}const Zv=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi,Da=/^)/,Xv=/^(data|aria|x)-[a-z_][a-z\d_.-]*$/,rs=/^ *<([a-z][a-z0-9:]*)(?:\s+((?:<.*?>|[^>])*))?\/?>(?!<\/\1>)(\s*\n)?/i,Qv=/^\{.*\}$/,e1=/^(https?:\/\/[^\s<]+[^<.,:;"')\]\s])/,t1=/^<([^ >]+[:@\/][^ >]+)>/,n1=/-([a-z])?/gi,Ra=/^(\|.*)\n(?: *(\|? *[-:]+ *\|[-| :]*)\n((?:.*\|.*\n)*))?\n?/,r1=/^[^\n]+(?: \n|

10`).match(i),d=s.exec(c[0]),h=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:c.map(function(f,p){const b=f.replace(h,"").replace(s,""),v=p===c.length-1,S=Ke(b,`

12`)||v&&y;y=S;const E=l.inline,j=l.list;let g;l.list=!0,S?(l.inline=!1,g=Yn(b)+`

14`):(l.inline=!0,g=Yn(b));const x=a(g,l);return l.inline=E,l.list=j,x}),ordered:n,start:u}}}}const O1=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$|[^\\s\\\\]|\\\\.)*?)>?(?:\\s+['"]([\\s\\S]*?)['"])?\\s*\\)`),E1=/^!\[(.*?)\]$ *((?:\([^)]*$|[^() ])*) *"?([^)"]*)?"?\)/;function Ma(t){return typeof t=="string"}function Yn(t){let e=t.length;for(;e>0&&t[e-1]<=" ";)e--;return t.slice(0,e)}function is(t,e){return t.startsWith(e)}function Ke(t,e){return t.indexOf(e)!==-1}function A1(t,e,n){if(Array.isArray(n)){for(let r=0;r<n.length;r++)if(is( ...

15`).map(function(u){return Ua(u,a,l,!0)})})(t[3],e,n):[],s=Ua(t[1],e,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:s,type:"25"}:{children:s,type:"21"}}function La(t,e){return t.align[e]==null?{}:{textAlign:t.align[e]}}function St(t){return t.inline=1,t}function gt(t){return St(function(e,n){return n.inline?t.exec(e):null})}function vr(t){return St(function(e,n){return n.inline||n.simple?t.exec(e):null})}function it(t){return function(e,n){return n.inline||n.simple?null:t.exec(e)}}function Ba(t){return St(function(e){return t.exec(e)})}const I1=/(javascript|vbscript|data(?!:i ...

17`,{inline:p});if(e.ast)return b;const v=y(b);for(;Ma(v[v.length-1])&&!v[v.length-1].trim();)v.pop();if(u.length&&v.push(a("footer",{key:"footer"},u.map(function(j){return a("div",{id:n(j.identifier,$n),key:j.identifier},j.identifier,y(h(j.footnote,{inline:!0})))}))),e.wrapper===null)return v;const S=e.wrapper||(p?"span":"div");let E;if(v.length>1||e.forceWrapper)E=v;else{if(v.length===1)return E=v[0],typeof E=="string"?a("span",{key:"outer"},E):E;E=null}return i(S,Je({key:"outer"},e.wrapperProps),E)}const u=[],c={},d={0:{t:[">"],o:it(Ia),u:1,i(f,p,b){const[,v,S]=f[0].replace(Mv,"").match(Uv);r ...

18`);return p>0&&p<f.length-1&&(f[p+1]==="="||f[p+1]==="-")},o:it($a),u:1,i:(f,p,b)=>({children:Nr(p,f[1],b),level:f[2]==="="?1:2,type:"9"})},11:{t:["<"],o:St(Jv),u:1,i(f,p,b){const[,v]=f[3].match(b1),S=RegExp("^"+v,"gm"),E=f[3].replace(S,""),j=Va(o,E)?P1:Nr,g=f[1].toLowerCase(),x=$v.indexOf(g)!==-1,w=(x?g:f[1]).trim(),O={attrs:Ti(w,f[2],r,l),noInnerParse:x,tag:w};if(b.inAnchor=b.inAnchor||g==="a",x)O.text=f[3];else{const A=b.inHTML;b.inHTML=!0,O.children=j(p,E,b),b.inHTML=A}return b.inAnchor=!1,O}},13:{t:["<"],o:Ba(rs),u:1,i(f){const p=f[1].trim();return{attrs:Ti(p,f[2]||"",r,l),tag:p}}},12:{t: ...

19`],o:it(qv),u:3,i:_i},21:{t:function(f,p){return!p.inline&&!p.simple},o:St(function(f,p){if(p.inline||p.simple||p.inHTML&&!Ke(f,`

21`)&&!Ke(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-BO3O1WS7.jsView file

159|| (${P} === "string" && ${A} && ${A} == +${A} && !(${A} % 1))`).assign(L,(0,r._)`+${A}`);return;case"boolean":O.elseIf((0,r._)`${A} === "false" || ${A} === 0 || ${A} === null`).as... L160: || ${P} === "boolean" || ${A} === null`).assign(L,(0,r._)`[${A}]`)}}}function g({gen:E,parentData:T,parentDataProperty:R},O){E.if((0,r._)`${T} !== undefined`,()=>E.assign((0,r._)`$... L161: missingProperty: ${h},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-BO3O1WS7.jsView on unpkg · L159

dist/client/assets/file-type-icon-DWrGM_42.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-DWrGM_42.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8662250 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/client/assets/index-DYYBsO5B.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = `,y);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DYYBsO5B.jsView on unpkg · L2

dist/client/assets/index-BO3O1WS7.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-BO3O1WS7.jsView on unpkg · L159

dist/client/assets/file-type-icon-DWrGM_42.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-DWrGM_42.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8662250 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Findings

2 High8 Medium8 Low

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/index-DYYBsO5B.js

MediumDynamic Requiredist/client/assets/file-type-icon-DWrGM_42.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/index-BO3O1WS7.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/client/assets/index-DYYBsO5B.jsView file

Lines 1-22javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-DYYBsO5B.jsView on unpkg · L2

4`&&p===`

8`&&b!=="\r")break;f++}if(f>=u||t[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+1}let c=0;for(;s+c<u&&t[s+c]===`

10`).match(i),d=s.exec(c[0]),h=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:c.map(function(f,p){const b=f.replace(h,"").replace(s,""),v=p===c.length-1,S=Ke(b,`

12`)||v&&y;y=S;const E=l.inline,j=l.list;let g;l.list=!0,S?(l.inline=!1,g=Yn(b)+`

19`],o:it(qv),u:3,i:_i},21:{t:function(f,p){return!p.inline&&!p.simple},o:St(function(f,p){if(p.inline||p.simple||p.inHTML&&!Ke(f,`

21`)&&!Ke(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-BO3O1WS7.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-BO3O1WS7.jsView on unpkg · L159

dist/client/assets/file-type-icon-DWrGM_42.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-DWrGM_42.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5028817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8662250 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg