registry / decocms / 4.18.1

decocms@4.18.1

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 221 file(s), 8.76 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, ph.studio.decocms.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.41 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com

dist/server/server.js4.83 MB file, sampled 256 KB

ChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsMinifiedTelemetryUrlStringsai-site.deco.sitedecoims.comgithub.comph.studio.decocms.com

Source & flagged code

7 flagged

dist/client/assets/index-Cz0FJt0x.jsView file

Lines 1-22javascript

1import{ba as _u,bb as ke,bc as io,s as D,ac as ve,az as ut,bd as ls,aw as ae,be as Jn,bf as qe,ax as Rt,bg as yn,o as B,bh as cs,bi as so,bj as Iu,bk as Tu,bl as Ya,bm as Nu,bn as Pu,bo as Fu,bp as Ja,bq as $u,a$ as ot,br as Du,ay as lt,bs as Ru,c as Oe,r as N,l as Lr,j as m,ae as Za,G as us,a as ku,t as wr,bt as ds,bu as Xa,bv as Mu,bw as Uu,bx as Lu,b9 as Qa,by as fs,bz as Bu,bA as Vu,bB as qu,bC as zu,a7 as Wu,aa as tn,a4 as sr,a8 as bn,a5 as Hu,a9 as Ku,bD as Gu,a6 as Yu,bE as Ju,B as Br,i as ms,b as Zu,E as Xu,Z as Qu}from"./index-Ch68t56x.js";import{P as _n}from"./index-Cos4I8N3.js";impo ...

2`,y);const{allOf:f,...p}=d;return p}}return se in d&&qi in d&&(d=Object.keys(d.properties).reduce((y,f)=>{const p=cc(y,f);return ye(p)||(y.properties[f]=_e(t,{allOf:[y.properties[f],...Object.values(p)]},n,R(r,[f]),o)),y},{...d,properties:{...d.properties}})),qi in d||rn in d&&d.additionalProperties!==!1?M0(t,d,n,r,o):d}):[{}]}function L0(t,e,n,r,i){let s;const{oneOf:o,anyOf:a,...l}=e;if(Array.isArray(o)?s=o:Array.isArray(a)&&(s=a),s){const u=i===void 0&&r?{}:i,c=He(e);s=s.map(h=>jt(h,n,[]));const d=Ur(t,u,s,n,c);if(r){const h=dc(s,!1,n);return Ur(t,u,h,n,c),s.map(y=>ct(l,y))}return[ct(l,s[d]) ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-Cz0FJt0x.jsView on unpkg · L2

3`,c),l}for(const c of[H,ee]){const d=u[c];if(Array.isArray(d)&&d.length>0){const h=l[c],y=Array.isArray(h)?[...h]:[];let f=!1;for(let p=0;p<d.length;p++){const b=d[p],v=(i

4`&&p===`

5`&&!u&&h===0)return null;if(!u&&h===0){for(var S=0;l+S<t.length&&t[l+S]===r[0];)S++;if(S>=i&&(i!==1||r!=="*"&&r!=="_"||t[l-1]!==r&&t[l+1]!==r)){var E=[t.slice(0,l+S),s,y+t.slice(l+i,l+S)];return E.index=0,E.input=t,E}}y+=b,p=b,l++}else{var j=t[l+1],g=t.indexOf(">",l);if(g!==-1){var x=t.slice(l,g+1).endsWith("/>");j==="/"?h=Math.max(0,h-1):x||h++}c=!0,y+=b,p=b,l++}}else u=!u,y+=b,p=b,l++;else y+=b,f=!0,p=b,l++}return null}const Fv=["children","options"],Ca=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&s++;const o=s;let a=s,l=1;const u=t.length;for(;l>0;){const d=t.indexOf("<",s);if(d===-1)return null;let h=-1,y=-1;if(t[d+1]==="/")y=d;else if(t[d

7`&&b!=="\r")break;f++}if(f+r.length>u)return null;let p=!0;for(let b=0;b<r.length;b++){const v=t[f+b];if(v!==r[b]&&

8`&&b!=="\r")break;f++}if(f>=u||t[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+1}let c=0;for(;s+c<u&&t[s+c]===

9`;)c++;return[t.slice(0,s+c),n,e[2],t.slice(o,a)]}const Zv=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi,Da=/^)/,Xv=/^(data|aria|x)-[a-z_][a-z\d_.-]*$/,rs=/^ *

10`).match(i),d=s.exec(c[0]),h=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:c.map(function(f,p){const b=f.replace(h,"").replace(s,""),v=p===c.length-1,S=Ke(b,`

12`)||v&&y;y=S;const E=l.inline,j=l.list;let g;l.list=!0,S?(l.inline=!1,g=Yn(b)+`

14`):(l.inline=!0,g=Yn(b));const x=a(g,l);return l.inline=E,l.list=j,x}),ordered:n,start:u}}}}const O1=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$|[^\\s\\\\]|\\\\.)*?)>?(?:\\s+['"]([

15`).map(function(u){return Ua(u,a,l,!0)})})(t[3],e,n):[],s=Ua(t[1],e,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:s,type:"25"}:{children:s,type:"21"}}function La(t,e){return t.align[e]==null?{}:{textAlign:t.align[e]}}function St(t){return t.inline=1,t}function gt(t){return St(function(e,n){return n.inline?t.exec(e):null})}function vr(t){return St(function(e,n){return n.inline||n.simple?t.exec(e):null})}function it(t){return function(e,n){return n.inline||n.simple?null:t.exec(e)}}function Ba(t){return St(function(e){return t.exec(e)})}const I1=/(javascript|vbscript|data(?!:i ...

17`,{inline:p});if(e.ast)return b;const v=y(b);for(;Ma(v[v.length-1])&&!v[v.length-1].trim();)v.pop();if(u.length&&v.push(a("footer",{key:"footer"},u.map(function(j){return a("div",{id:n

18`);return p>0&&p<f.length-1&&(f[p+1]==="="||f[p+1]==="-")},o:it($a),u:1,i:(f,p,b)=>({children:Nr(p,f[1],b),level:f[2]==="="?1:2,type:"9"})},11:{t:["<"],o:St(Jv),u:1,i(f,p,b){const[,v]=f[3].match(b1),S=RegExp("^"+v,"gm"),E=f[3].replace(S,""),j=Va(o,E)?P1:Nr,g=f[1].toLowerCase(),x=$v.indexOf(g)!==-1,w=(x?g:f[1]).trim(),O={attrs:Ti(w,f[2],r,l),noInnerParse:x,tag:w};if(b.inAnchor=b.inAnchor||g==="a",x)O.text=f[3];else{const A=b.inHTML;b.inHTML=!0,O.children=j(p,E,b),b.inHTML=A}return b.inAnchor=!1,O}},13:{t:["<"],o:Ba(rs),u:1,i(f){const p=f[1].trim();return{attrs:Ti(p,f[2]||"",r,l),tag:p}}},12:{t: ...

19`],o:it(qv),u:3,i:_i},21:{t:function(f,p){return!p.inline&&!p.simple},o:St(function(f,p){if(p.inline||p.simple||p.inHTML&&!Ke(f,`

21`)&&!Ke(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/index-Ch68t56x.jsView file

159|| (${P} === "string" && ${A} && ${A} == +${A} && !(${A} % 1))`).assign(L,(0,r._)`+${A}`);return;case"boolean":O.elseIf((0,r._)`${A} === "false" || ${A} === 0 || ${A} === null`).as... L160: || ${P} === "boolean" || ${A} === null`).assign(L,(0,r._)`[${A}]`)}}}function g({gen:E,parentData:T,parentDataProperty:R},O){E.if((0,r._)`${T} !== undefined`,()=>E.assign((0,r._)`$... L161: missingProperty: ${h},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-Ch68t56x.jsView on unpkg · L159

dist/client/assets/file-type-icon-CcvesTYr.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-CcvesTYr.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5059504 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8816677 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/client/assets/index-Cz0FJt0x.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = `,y);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-Cz0FJt0x.jsView on unpkg · L2

dist/client/assets/index-Ch68t56x.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/index-Ch68t56x.jsView on unpkg · L159

dist/client/assets/file-type-icon-CcvesTYr.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-CcvesTYr.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5059504 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8816677 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Findings

2 High8 Medium8 Low

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/index-Cz0FJt0x.js

MediumDynamic Requiredist/client/assets/file-type-icon-CcvesTYr.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/index-Ch68t56x.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings