registry / decocms / 4.63.1

decocms@4.63.1

Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 235 file(s), 9.99 MB of source, external domains: admin.example.com, ai-site.deco.site, api.decocms.com, api.githubcopilot.com, api.openai.com, app.posthog.com, assets.decocache.com, cdn.captchafox.com, cdn.example.com, cdn.jsdelivr.net, challenges.cloudflare.com, deco.cx, decocms.com, decoims.com, destination-url.com, example.com, example2.com, fb.me, github.com, gravatar.com, images.weserv.nl, js.hcaptcha.com, json-schema.org, login.microsoftonline.com, player.vimeo.com, policies.google.com, posthog.com, prettier.io, prosemirror.net, pub-xxxx.r2.dev, radix-ui.com, raw.githubusercontent.com, react.dev, registry.example.com, sentry.io, studio.decocms.com, typescript-eslint.io, us.i.posthog.com, us.posthog.com, www.anthropic.com, www.decocms.com, www.google.com, www.ibm.com, www.w3.org, www.youtube.com, yandex.com, youtube.com

Oversized source lightweight scan

dist/server/cli.js8.47 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com

dist/server/server.js4.87 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsai-site.deco.sitedecoims.com

Source & flagged code

7 flagged

dist/client/assets/index-BxnZ68Vo.jsView file

Lines 1-22javascript

1import{be as _u,bf as ke,bg as io,I as D,aW as ve,af as ut,bh as ls,ac as ae,bi as Jn,bj as qe,ad as Rt,bk as yn,H as B,bl as cs,bm as so,bn as Iu,bo as Tu,bp as Ya,bq as Nu,br as Pu,bs as Fu,bt as Ja,bu as $u,b3 as ot,bv as Du,ae as lt,bw as Ru,c as Oe,r as N,l as Lr,j as m,at as Za,C as us,a as ku,t as wr,bx as ds,by as Xa,bz as Mu,bA as Uu,bB as Lu,bd as Qa,bC as fs,bD as Bu,bE as Vu,bF as qu,bG as zu,aR as Wu,aU as tn,aO as sr,aS as bn,aP as Hu,aT as Ku,bH as Gu,aQ as Yu,bI as Ju,B as Br,i as ms,b as Zu,E as Xu,aI as Qu}from"./index-M1LF9ch0.js";import{P as _n}from"./index-4ezL4OlH.js";imp ...

2`,y);const{allOf:f,...p}=d;return p}}return se in d&&qi in d&&(d=Object.keys(d.properties).reduce((y,f)=>{const p=cc(y,f);return ye(p)||(y.properties[f]=_e(t,{allOf:[y.properties[f],...Object.values(p)]},n,R(r,[f]),o)),y},{...d,properties:{...d.properties}})),qi in d||rn in d&&d.additionalProperties!==!1?M0(t,d,n,r,o):d}):[{}]}function L0(t,e,n,r,i){let s;const{oneOf:o,anyOf:a,...l}=e;if(Array.isArray(o)?s=o:Array.isArray(a)&&(s=a),s){const u=i===void 0&&r?{}:i,c=He(e);s=s.map(h=>jt(h,n,[]));const d=Ur(t,u,s,n,c);if(r){const h=dc(s,!1,n);return Ur(t,u,h,n,c),s.map(y=>ct(l,y))}return[ct(l,s[d]) ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-BxnZ68Vo.jsView on unpkg · L2

3`,c),l}for(const c of[H,ee]){const d=u[c];if(Array.isArray(d)&&d.length>0){const h=l[c],y=Array.isArray(h)?[...h]:[];let f=!1

4`&&p===`

5`&&!u&&h===0)return null;if(!u&&h===0){for(var S=0;l+S<t.length&&t[l+S]===r[0];)S++;if(S>=i&&(i!==1||r!=="*"&&r!=="_"||t[l-1]!==r&&t[l+1]!==r)){var E=[t.slice(0,l+S),s,y+t.slice(l+i,l+S)];return E.index=0,E.input=t,E}}y+=b,p=b,l++}else{var j=t[l+1],g=t.indexOf(">",l);if(g!==-1){var x=t.slice(l,g+1).endsWith("/>");j==="/"?h=Math.max(0,h-1):x||h++}c=!0,y+=b,p=b,l++}}else u=!u,y+=b,p=b,l++;else y+=b,f=!0,p=b,l++}return null}const Fv=["children","options"],Ca=["allowFullScreen","allowTransparency","autoComplete","autoFocus","autoPlay","cellPadding","cellSpacing","charSet","classId","colSpan","cont ...

6`&&s++;const o=s;let a=s,l=1;const u=t.length;for(;l>0;){const d=t.indexOf("<",s);if(d===-1)return null;let h=-1

7`&&b!=="\r")break;f++}if(f+r.length>u)return null;let p=!0;for(let b=0;b<r.

8`&&b!=="\r")break;f++}if(f>=u||t[f]!==">"){s=f;continue}a=y,s=f+1,l--}else s=d+

9`;)c++;return[t.slice(0,s+c),n,e[2],t.slice(o,a)]}const Zv=/&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/gi,Da=/^)/,Xv=/^(data|aria|x)-[a-z_][a-z\d_.-]

10`).match(i),d=s.exec(c[0]),h=RegExp("^ {1,"+(d?d[0].length:0)+"}","gm");let y=!1;return{items:c.map(function(f,p){const b=f.replace(h,"").replace(s,""),v=p===c.length-1,S=Ke(b,`

12`)||v&&y;y=S;const E=l.inline,j=l.list;let g;l.list=!0,S?(l.inline=!1,g=Yn(b)+`

14`):(l.inline=!0,g=Yn(b));const x=a(g,l);return l.inline=E,l.list=j,x}),ordered:n,start:u}}}}const O1=RegExp(`^\\[((?:\\[[^\\[\\]]*(?:\\[[^\\[\\]]*\\][^\\[\\]]*)*\\]|[^\\[\\]])*)\\]\$\\s*<?((?:\\([^)]*\$

15`).map(function(u){return Ua(u,a,l,!0)})})(t[3],e,n):[],s=Ua(t[1],e,n,!!i.length);return n.inline=!1,i.length?{align:r,cells:i,header:s,type:"25"}:{children:s,type:"21"}}function La(t,e){return t.align[e]==null?{}:{textAlign:t.align[e]}}function St(t){return t.inline=1,t}function gt(t){return St(function(e,n){return n.inline?t.exec(e):null})}function vr(t){return St(function(e,n){return n.inline||n.simple?t.exec(e):null})}function it(t){return function(e,n){return n.inline||n.simple?null:t.exec(e)}}function Ba(t){return St(function(e){return t.exec(e)})}const I1=/(javascript|vbscript|data(?!:i ...

17`,{inline:p});if(e.ast)return b;const v=y(b);for(;Ma(v[v.length-1])&&!v[v.length-1].trim();)v.pop();if(u.length&&v.push(a("footer",{key:

18`);return p>0&&p<f.length-1&&(f[p+1]==="="||f[p+1]==="-")},o:it($a),u:1,i:(f,p,b)=>({children:Nr(p,f[1],b),level:f[2]==="="?1:2,type:"9"})},11:{t:["<"],o:St(Jv),u:1,i(f,p,b){const[,v]=f[3].match(b1),S=RegExp("^"+v,"gm"),E=f[3].replace(S,""),j=Va(o,E)?P1:Nr,g=f[1].toLowerCase(),x=$v.indexOf(g)!==-1,w=(x?g:f[1]).trim(),O={attrs:Ti(w,f[2],r,l),noInnerParse:x,tag:w};if(b.inAnchor=b.inAnchor||g==="a",x)O.text=f[3];else{const A=b.inHTML;b.inHTML=!0,O.children=j(p,E,b),b.inHTML=A}return b.inAnchor=!1,O}},13:{t:["<"],o:Ba(rs),u:1,i(f){const p=f[1].trim();return{attrs:Ti(p,f[2]||"",r,l),tag:p}}},12:{t: ...

19`],o:it(qv),u:3,i:_i},21:{t:function(f,p){return!p.inline&&!p.simple},o:St(function(f,p){if(p.inline

21`)&&!Ke(p.prevCapture,`

Long lines were clipped for display.

dist/client/assets/reports-CfYsBbGy.jsView file

17`+g.message)}var n=new ue;n.add(a),n.isGeoSVGGraphicRoot=!0;var i=t.width,o=t.height,s=t.viewBoxRect,l=this._boundingRect;if(!l){var u=void 0,c=void 0,f=void 0,h=void 0;if(i!=null?... L18: `+i.message)}return xV(t,n),L(n,function(i){var o=i.name;bV(t,i),wV(t,i);var s=this._specialAreas&&this._specialAreas[o];s&&i.transformTo(s.left,s.top,s.width,s.height)},this),n},r... L19: `))}),e.join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/reports-CfYsBbGy.jsView on unpkg · L17

dist/client/assets/file-type-icon-LUi593th.jsView file

89`);O.forEach(function(C,M){var $=r&&p.length+i,W={type:"text",value:"".concat(C,` L90: `)};if(M===0){var z=d.slice(f+1,g).concat($n({children:[W],className:h.properties.className})),G=R(z,$);p.push(G)}else if(M===O.length-1){var X=d[g+1]&&d[g+1].children&&d[g+1].chil... L91: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-LUi593th.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5110327 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8878380 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/client/assets/index-BxnZ68Vo.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = `,y);con...ema:

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/index-BxnZ68Vo.jsView on unpkg · L2

dist/client/assets/reports-CfYsBbGy.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/reports-CfYsBbGy.jsView on unpkg · L17

dist/client/assets/file-type-icon-LUi593th.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/file-type-icon-LUi593th.jsView on unpkg · L89

dist/server/emscripten-module.wasmView file

•path = dist/server/emscripten-module.wasm kind = wasm_module sizeBytes = 518880 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/emscripten-module.wasmView on unpkg

dist/client/sounds/notification.mp3View file

•path = dist/client/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 61101 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/notification.mp3View on unpkg

dist/server/server.jsView file

•path = dist/server/server.js kind = oversized_source_file sizeBytes = 5110327 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/server.jsView on unpkg

dist/server/cli.jsView file

•path = dist/server/cli.js kind = oversized_cli_entrypoint sizeBytes = 8878380 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server/cli.jsView on unpkg

Findings

3 High8 Medium7 Low

HighObfuscated

HighShips High Entropy Blobdist/client/sounds/notification.mp3

HighOversized Source Filedist/server/server.js

MediumSecret Patterndist/client/assets/index-BxnZ68Vo.js

MediumDynamic Requiredist/client/assets/file-type-icon-LUi593th.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/server/emscripten-module.wasm

MediumOversized Cli Entrypointdist/server/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client/assets/reports-CfYsBbGy.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings