registry / flexbiz-server / 12.8.5

flexbiz-server@12.8.5

Flexible Server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 1,126 file(s), 2.65 MB of source, external domains: api.flexzen.app, cdn.cdnservice.space, www.googleapis.com, zalo.cloud

Oversized source lightweight scan

server/data/sys/listinfo.js9.21 MB file, sampled 256 KB

HighEntropyStringsUrlStringsapi.flexzen.appzalo.cloud

Source & flagged code

6 flagged

configs-example.jsView file

Lines 13-53javascript

13//for web push: use tool of webPush to create a vapidkeys. just need to run: web-push generate-vapid-keys --json

14exports.vapidKeys = {"publicKey":"","privateKey":""}//require

15//recaptcha, require

16exports.GOOGLE_RECAPTCHA_SECRET_KEY = "";

17//google transtale api key

18exports.GOOGLE_TRANSLATE_API_KEY = "";

19//source code

20exports.paths={

21 modules:__dirname + "/modules",

22 templates: __dirname + "/templates",

23 admin: __dirname + "/admin",

24 images: __dirname + "/images",

25 videos: __dirname + "/videos",

26 uploads: __dirname + "/uploads",

27 log: __dirname + "/log",

28 maps:"",

29 workers:"",

30 menu:"/menu.js"

31}

32//limit request

33//limit or slowDown request

34const rateLimit = require("express-rate-limit");

35const slowDown = require('express-slow-down');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

configs-example.jsView on unpkg · L33

36const RedisStore = require('rate-limit-redis');

37exports.limitRequest={

38 api:rateLimit({

39 store: new RedisStore({

40 }),

41 windowMs: 10*60*1000,

42 max: 1000000

43 }),

44 sys:rateLimit({

45 store: new RedisStore({

46 }),

47 windowMs: 10*60*1000,

48 max: 1000000

49 }),

50 public:slowDown({

51 store: new RedisStore({

52 }),

53 windowMs: 10*60*1000,

server/_loader.jsView file

Lines 1-1javascript

1'use strict';var _0x3c14dc=_0xb8d8;(function(_0x1224d2,_0x325ed9){var _0x24e181=_0xb8d8,_0x81ec05=_0x1224d2();while(!![]){try{var _0x2abeca=parseInt

server/templates/excels/pc1.xlsxView file

•path = server/templates/excels/pc1.xlsx kind = compressed_blob sizeBytes = 12153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

server/templates/excels/pc1.xlsxView on unpkg

•path = server/templates/excels/pc1.xlsx kind = nested_archive_needs_inspection sizeBytes = 12153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

server/templates/excels/pc1.xlsxView on unpkg

server/route.jseView file

•path = server/route.jse kind = high_entropy_blob sizeBytes = 39150 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

server/route.jseView on unpkg

server/data/sys/listinfo.jsView file

•path = server/data/sys/listinfo.js kind = oversized_source_file sizeBytes = 9657799 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/data/sys/listinfo.jsView on unpkg

Source & flagged code

6 flagged · loading source

configs-example.jsView file

33//limit or slowDown request L34: const rateLimit = require("express-rate-limit"); L35: const slowDown = require('express-slow-down');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

configs-example.jsView on unpkg · L33

server/_loader.jsView file

1'use strict';var _0x3c14dc=_0xb8d8;(function(_0x1224d2,_0x325ed9){var _0x24e181=_0xb8d8,_0x81ec05=_0x1224d2();while(!![]){try{var _0x2abeca=parseInt(_0x24e181(0x1ae))/0x1+-parseInt...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

server/_loader.jsView on unpkg · L1

server/templates/excels/pc1.xlsxView file

Findings

4 High4 Medium5 Low

HighObfuscated Payload Loaderserver/_loader.js

HighObfuscated

HighShips High Entropy Blobserver/route.jse

HighOversized Source Fileserver/data/sys/listinfo.js

MediumDynamic Requireconfigs-example.js

MediumEnvironment Vars

MediumShips Compressed Blobserver/templates/excels/pc1.xlsx

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionserver/templates/excels/pc1.xlsx

LowNo License