registry / dokkimi / 0.5.6

dokkimi@0.5.6

CLI for isolated Docker environments for microservice testing

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 223 file(s), 2.05 MB of source, external domains: 0.0.0.0, ct.internal, docs.docker.com, gcr.io, ghcr.io, host.docker.internal, index.docker.io, json-schema.org, nodejs.org, registry.example.com, registry.npmjs.org, www.docker.com

Source & flagged code

5 flagged

package.jsonView file

Lines 21-61json

21 "mock",

22 "docker",

23 "devops",

24 "api-testing",

25 "cli",

26 "test-automation"

27 ],

28 "license": "Elastic-2.0",

29 "overrides": {

30 "lodash": "4.18.1",

31 "glob": "^11.0.0",

32 "multer": "^2.2.0",

33 "@hono/node-server": "^1.19.13"

34 },

35 "os": [

36 "darwin",

37 "linux",

38 "win32"

39 ],

40 "scripts": {

41 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "files": [

44 "apps/cli/dist/",

45 "apps/mcp/dist/",

46 "apps/mcp/package.json",

47 "services/control-tower/dist/",

48 "services/control-tower/package.json",

49 "shared/prisma/sqlite/schema.prisma",

50 "shared/prisma/prisma.config.ts",

51 "shared/prisma/migrations/",

52 "shared/docs/",

53 "config/config.yaml",

54 "scripts/postinstall.js",

55 "README.md",

56 "LICENSE",

57 "shared/config/dist/",

58 "shared/config/package.json",

59 "shared/definition-resolver/dist/",

60 "shared/definition-resolver/package.json",

61 "shared/definition-validator/dist/",

shared/config/dist/index.jsView file

Lines 1-26javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

shared/definition-resolver/dist/resolve.spec.jsView file

Lines 182-222javascript

182 {

183 type: 'SERVICE',

184 name: 'svc',

185 port: 3000,

186 healthCheck: '/health',

apps/cli/dist/lib/registry-credentials.spec.jsView file

Lines 95-135javascript

95 ],

96 });

97 const result = resolveRegistryCredentials();

98 expect(mockedFs.readFileSync).toHaveBeenCalledWith('/projects/my-app/.dokkimi/registries.yaml', 'utf-8');

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

shared/config/dist/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./config.types"), exports); L18: __exportStar(require("./config.loader"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

shared/config/dist/index.jsView on unpkg · L16

Findings

1 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireshared/config/dist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternshared/definition-resolver/dist/resolve.spec.js

MediumSecret Patternapps/cli/dist/lib/registry-credentials.spec.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings