forgedock@1.5.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

forgedock@1.5.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

examples/forgedock-demo/src/db.jsView file

36// eslint-disable-next-line no-new-func L37: const predicate = new Function('row', `with (row) { return (${whereClause}); }`); L38: return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L36

examples/forgedock-demo/scripts/smoke.jsView file

4L5: const http = require('http'); L6: const assert = require('assert');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/forgedock-demo/scripts/smoke.jsView on unpkg · L4

bin/runner.mjsView file

553contains invisible/control Unicode U+202A (left-to-right embedding) * - Unicode bidirectional-override/format characters (`<U+202A>`-`<U+202E>`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

bin/runner.mjsView on unpkg · L553

•Trigger-reachable chain: manifest.bin -> bin/forgedock.mjs -> bin/runner.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/runner.mjsView on unpkg

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

bin/forgedock.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = forgedock@1.3.0 matchedIdentity = npm:Zm9yZ2Vkb2Nr:1.3.0 similarity = 0.691 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/forgedock.mjsView on unpkg

docs/CONFIG.mdView file

590patternName = generic_password severity = medium line = 590 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L590

599patternName = generic_password severity = medium line = 599 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L599

Source & flagged code

8 flagged

examples/forgedock-demo/src/db.jsView file

Lines 16-56javascript

16 { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false, tags: ['fitness', 'errand'], archived: false, createdAt: '2024-01-03T00:00:00.000Z' },

17];

18

19let notes = SEED.map((n) => ({ ...n }));

20

21let nextId = 4;

22

23function all() {

24 return notes;

25}

26

27function findById(id) {

28 return notes.find((n) => n.id === Number(id));

29}

30

31// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".

32// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject

33// arbitrary expressions (e.g. "true || secret"). A real fix would use a

34// parameterized filter instead of evaluating untrusted strings.

35function query(whereClause) {

36 // eslint-disable-next-line no-new-func

37 const predicate = new Function('row', `with (row) { return (${whereClause}); }`);

38 return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L36

39 try {

40 return predicate(row);

41 } catch {

42 return false;

43 }

44 });

45}

46

47function insert(note) {

48 const record = { id: nextId++, secret: false, tags: [], archived: false, createdAt: new Date().toISOString() };

49 // Only override a default when the caller actually supplied the key — a

50 // spread of an object containing an explicit `undefined` would otherwise

51 // silently clobber the default (e.g. `tags: undefined`).

52 for (const [key, value] of Object.entries(note)) {

53 if (value !== undefined) record[key] = value;

54 }

55 notes.push(record);

56 return record;

examples/forgedock-demo/scripts/smoke.jsView file

Lines 1-24javascript

1// Tiny smoke test for the demo Notes API. No test framework, no deps.

2// Starts the server on a random port, hits a few endpoints, and asserts.

3// Run with: npm run smoke

4

5const http = require('http');

6const assert =

bin/runner.mjsView file

Lines 533-573javascript

533 * `userMessage` is built from untrusted third-party content (issue/PR bodies

534 * fetched via `gh` — see the SECURITY note in `bin/engine.mjs`). The

535 * non

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

bin/forgedock.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = forgedock@1.3.0 matchedIdentity = npm:Zm9yZ2Vkb2Nr:1.3.0 similarity = 0.691 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/forgedock.mjsView on unpkg

docs/CONFIG.mdView file

Lines 570-619markdown

570|-------|------|----------|-------------|

571| `health_endpoint` | string | No | Primary health-check URL that should return HTTP 200 |

572| `health_patterns` | array of strings | No | Strings that must appear in the health endpoint response body |

573| `services` | array | No | Named services to verify as part of deployment validation |

574| `services[].name` | string | **Yes (per entry)** | Human-readable service name |

575| `services[].container`