registry / fjall / 2.24.0

fjall@2.24.0

⚠ Under review

Fjall CLI

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

Manifest

NoLicense

scanned 17 file(s), 6.45 MB of source, external domains: docs.fjall.io, ejs.co, github.com, json-schema.org, www.apache.org

Oversized source lightweight scan

bin/fjall.bundle.js3.21 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsMinifiedUrlStringsProtestwaredocs.fjall.iogithub.com

Source & flagged code

5 flagged

bin/assets/generators/organisation/generator.jsView file

Lines 1-35javascript

1import { createRequire as __fjcreateRequire } from "module";

2const require = __fjcreateRequire(import.meta.url);

4var Ev=Object.defineProperty;var ve=(e,r)=>{for(var n in r)Ev(e,n,{get:r[n],enumerable:!0})};import{join as RE}from"path";import co from"node:fs"

5 "&": "&"

6 , "<": "<"

7 , ">": ">"

8 , '"': """

9 , "'": "'"

10 }

11 , _MATCH_HTML = /[&<>'"]/g;

12function encode_char(c) {

13 return _ENCODE_HTML_RULES[c] || c;

14};

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(Iv,Tv)};function pd(){return Function.prototype.toString.call(this)+`;

16`+Nv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:pd}):ee.escapeXML.toString=pd}catch{console.warn("Unable to set escapeXML.toString (is the Function prototype frozen?)")}ee.shallowCopy=function(e,r){if(r

17`),a=Math.max(o-3,0),c=Math.min(i.length,o+3),d=t(n),u=i.slice(a,c).map(function(m,g){let v=g+a+1;return(v==o?" >> ":" ")+v+"| "+m}).join(`

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

18`);throw e.path=d,e.message=(d||"ejs")+":"+o+`

19`+u+`

21`+e.message,e}function hd(e){return e.replace(/;(\s*$)/,"$1")}R.compile=function(r,n){let o;return n&&n.scope&&(console.warn("`scope` option is deprecated and will be removed in future EJS"),n.context||(n.context=n.scope),delete n.scope),o=new j(r,n),o.compile()};R.render=function(e,r,n){let o=r||w.createNullProtoObjWherePossible(),t=n||w.createNullProtoObjWherePossible();return arguments.length==2&&w.shallowCopyFromList(t,o,bd),Bt(t,e)(o)};R.renderFile=function(){let e=Array.prototype.slice.call(arguments),r=e.shift(),n,o={filename:r},t,i;return typeof arguments[arguments.length-1]=="function ...

22 function __append(s) { if (s !== undefined && s !== null) __output += s }

23`,n.outputFunctionName){if(!so.test(n.outputFunctionName))throw new Error("outputFunctionName is not a valid JS identifier.");o+=` ${Gr} `+n.outputFunctionName+` = __append;

24`}if(n.localsName&&!so.test(n.localsName))throw new Error("localsName is not a valid JS identifier.");if(n.destructuredLocals&&n.destructuredLocals.length){let u=` ${Gr} __locals = (`+n.localsName+` || {}),

25`;for(let m=0;m<n.destructuredLocals.length;m++){let g=n.destructuredLocals[m];if(!so.test(g))throw new Error("destructuredLocals["+m+"] is not a valid JS identifier.");m

26 `),u+=g+" = __locals."+g}o+=u+`;

27`}n._with!==!1&&(o+=" with ("+n.localsName+` || {}) {

28`,t+=` }

29`),t+=` return __output;

30`,this.source=o+this.source+t}n.compileDebug?e=`${Gr} __line = 1

31 , __lines = `+JSON.stringify(this.templateText)+`

32 , __filename = `+c+`;

33try {

34`+this.source+`} catch (e) {

35 rethrow(e, __lines, __filename, __line, escapeFn);

Long lines were clipped for display.

bin/fjall.bundle.jsView file

•path = bin/fjall.bundle.js kind = oversized_source_file sizeBytes = 3370280 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/fjall.bundle.jsView on unpkg

•path = bin/fjall.bundle.js kind = oversized_cli_entrypoint sizeBytes = 3370280 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/fjall.bundle.jsView on unpkg

bin/assets/generators/application/generator.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fjall@2.22.1 matchedIdentity = npm:ZmphbGw:2.22.1 similarity = 0.647 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/assets/generators/application/generator.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/assets/generators/organisation/generator.jsView file

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(Iv,Tv)};function pd(){return Function.prototype.toString.call(this)+`; L16: `+Nv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:pd}):ee.escapeXML.toString=pd}catch{console.warn("Unable to set escapeXML.toS... L17: `),a=Math.max(o-3,0),c=Math.min(i.length,o+3),d=t(n),u=i.slice(a,c).map(function(m,g){let v=g+a+1;return(v==o?" >> ":" ")+v+"| "+m}).join(` ... L42: `,u.message+=`If the above error is not helpful, you may want to try EJS-Lint: L43: `,u.message+="https://github.com/RyanZim/EJS-Lint",n.async||(u.message+=` L44: `,u.message+="Or, if you meant to create an async function, pass `async: true` as an option.")),u}let d=function(m){let g=function(_,$){let U=w.shallowC

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

1 Critical2 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/assets/generators/application/generator.js

HighObfuscated Payload Loaderbin/assets/generators/organisation/generator.js

HighOversized Source Filebin/fjall.bundle.js

MediumDynamic Require

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointbin/fjall.bundle.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbin/assets/generators/organisation/generator.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License