registry / gencow / 0.1.166

gencow@0.1.166

Gencow — AI Backend Engine

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 99 file(s), 2.92 MB of source, external domains: 127.0.0.1, docs.gencow.com, example.com, foo.bar, gencow.app, json-schema.org, kapi.kakao.com, kauth.kakao.com, my-app.vercel.app, myapp.com, myapp.vercel.app, nid.naver.com, nodejs.org, openapi.naver.com, platform.openai.com, react.dev, www.postgresql.org, www.w3.org, yarnpkg.com

Oversized source lightweight scan

server/index.js4.63 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoDynamicRequireHighEntropyStringsUrlStringsexample.comfoo.barkapi.kakao.comkauth.kakao.comnid.naver.comnodejs.orgopenapi.naver.comyarnpkg.com

Source & flagged code

7 flagged

bin/gencow.mjsView file

Lines 1-38javascript

1#!/usr/bin/env bun

2/**

3 * @gencow/cli — Gencow CLI

4 *

5 * Commands:

6 * gencow dev — push schema → start server with hot-reload

7 * gencow db:push — push schema.ts changes to DB (instant, no migration files)

8 * gencow db:generate — generate SQL migration files from schema.ts

9 * gencow db:migrate — apply pending migrations

10 * gencow db:reset — backup + reset DB (safe reset)

11 * gencow db:restore — restore DB from backup

12 * gencow db:studio — open Drizzle Studio (visual DB browser)

13 * gencow dashboard — open /_admin in browser

14 * gencow backup — manage database backups (list/create/restore/restore-file/delete/download)

15 * gencow templates — publish/list/download/clone marketplace templates

16 * gencow help — show this help

17 */

19import { execSync, spawn } from "child_process";

20import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/gencow.mjsView on unpkg · L18

21import { resolve, dirname } from "path";

22import { fileURLToPath } from "url";

23import { createAddCommand } from "../lib/add-command.mjs";

24import { createAuthCommands } from "../lib/auth-command.mjs";

25import { createAppCommand } from "../lib/app-command.mjs";

26import { createBackupCommand } from "../lib/backup-command.mjs";

27import { createApiCodegenRuntime, resolveCoreImport } from "../lib/cli-dev-runtime.mjs";

28import {

29 buildDrizzleKitCommand,

30 buildEnv,

31 cleanupOldBackups,

32 findServerRoot,

33 isLocalDbTarget,

34 isMonorepo,

35 loadConfig,

36 runInServer,

37 spawnInServer,

38 updateEnvLocalUrl,

Lines 463-503javascript

463 // ── app (subcommands: create, list, delete) ────────

464 app: runAppCommand,

465

466 // ── remote:deploy — REMOVED (legacy, use `gencow deploy` instead) ──

467

468 // ── jobs (Cron/Scheduled Jobs Observability) ──────

469 jobs: runJobsCommand,

470

471 // ── logs ───────────────────────────────────────────

472 logs: runLogsCommand,

473

474 // ── env — 환경변수 관리 (Cloud only) ─────────

•matchType = previous_version_dangerous_delta matchedPackage = gencow@0.1.162 matchedIdentity = npm:Z2VuY293:0.1.162 similarity = 0.832 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gencow.mjsView on unpkg

lib/cli-project-runtime.mjsView file

Lines 120-160javascript

120 if (outDir !== null) codegen.outDir = outDir;

121 const serverOutDir = extractFrom(codegenBlock, "serverOutDir");

122 if (serverOutDir !== null) codegen.serverOutDir = serverOutDir;

123 const authSchema

lib/readme-codegen.mjsView file

Lines 257-297javascript

257 md += `- Do not call fetch("/api/query") or fetch("/api/mutation") directly.\n`;

258 md += `- Do not create apiPost() wrappers for procedures.\n`;

259 md += `- gencow/api.ts is generated. Do not create or edit it manually.\n`;

260 md += `- gencow/ai.ts is generated. Do not edit or bypass it.\n`;

261 md +=

lib/platform-client.mjsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";

2import { homedir } from "os";

3import { resolve } from "path";

4import { CYAN, RESET, error, info } from "./output.mjs";

5import { validatePlatformUrl } from "./domain-helpers.mjs";

server/index.jsView file

•path = server/index.js kind = oversized_source_file sizeBytes = 4859108 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/gencow.mjsView file

18L19: import { execSync, spawn } from "child_process"; L20: import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/gencow.mjsView on unpkg · L18

483stdio: "inherit", L484: shell: true, L485: });

High

Shell

Package source references shell execution.

bin/gencow.mjsView on unpkg · L483

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gencow.mjsView on unpkg

lib/cli-project-runtime.mjsView file

140const url = `${href}?t=${encodeURIComponent(String(mtimeMs))}`; L141: const mod = await import(url); L142: return mod && typeof mod === "object" && "default" in mod ? mod.default : mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/cli-project-runtime.mjsView on unpkg · L140

lib/readme-codegen.mjsView file

277md += `- Production backend deploy: npx gencow deploy --prod (Pro+ only)\n`; L278: md += `- Fullstack static deploy: VITE_API_URL=https://{appId}.{domain} npm run build, then npx gencow deploy --static dist/\n`; L279: md += `- If a backend is present, Gencow deploys the backend before frontend assets.\n`; L280: md += `- Set cloud env vars with npx gencow env set KEY=VALUE.\n`; L281: md += `- Read process.env inside handlers so hot-reloaded env values are current.\n\n`; L282: md += `Data modeling rules:\n`; ... L289: md += `- npm-installed third-party packages are installed during deploy.\n`; L290: md += `- child_process, vm, os, cluster, and worker_threads are blocked in deployed tenant apps.\n`; L291: md += `- Prefer SHA-256 with node:crypto or Web Crypto API instead of custom 32-bit hashes.\n`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/readme-codegen.mjsView on unpkg · L277

lib/platform-client.mjsView file

6L7: const CREDS_PATH = resolve(homedir(), ".gencow", "credentials.json"); L8: ... L10: try { L11: return JSON.parse(readFileSync(CREDS_PATH, "utf8")); L12: } catch { ... L25: L26: export function resolveCredsFromSources({ env = process.env, loadCredsImpl = loadCreds } = {}) { L27: const envToken = env.GENCOW_TOKEN || env.GENCOW_DEPLOY_TOKEN; L28: if (envToken) { L29: const platformUrl = env.GENCOW_PLATFORM_URL || "https://gencow.app"; L30: return { apiKey: envToken, platformUrl: validatePlatformUrl(platformUrl) };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/platform-client.mjsView on unpkg · L6

server/index.jsView file

•path = server/index.js kind = oversized_source_file sizeBytes = 4859108 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/index.jsView on unpkg

Findings

6 High4 Medium8 Low

HighChild Processbin/gencow.mjs

HighShellbin/gencow.mjs

HighSame File Env Network Executionlib/readme-codegen.mjs

HighSandbox Evasion Gated Capabilitylib/platform-client.mjs

HighOversized Source Fileserver/index.js

HighPrevious Version Dangerous Deltabin/gencow.mjs

MediumDynamic Requirelib/cli-project-runtime.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

bin/gencow.mjsView file

Lines 1-38javascript

1#!/usr/bin/env bun

2/**

3 * @gencow/cli — Gencow CLI

4 *

5 * Commands:

6 * gencow dev — push schema → start server with hot-reload

7 * gencow db:push — push schema.ts changes to DB (instant, no migration files)

8 * gencow db:generate — generate SQL migration files from schema.ts

9 * gencow db:migrate — apply pending migrations

10 * gencow db:reset — backup + reset DB (safe reset)

11 * gencow db:restore — restore DB from backup

12 * gencow db:studio — open Drizzle Studio (visual DB browser)

13 * gencow dashboard — open /_admin in browser

14 * gencow backup — manage database backups (list/create/restore/restore-file/delete/download)

15 * gencow templates — publish/list/download/clone marketplace templates

16 * gencow help — show this help

17 */

19import { execSync, spawn } from "child_process";

20import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/gencow.mjsView on unpkg · L18

21import { resolve, dirname } from "path";

22import { fileURLToPath } from "url";

23import { createAddCommand } from "../lib/add-command.mjs";

24import { createAuthCommands } from "../lib/auth-command.mjs";

25import { createAppCommand } from "../lib/app-command.mjs";

26import { createBackupCommand } from "../lib/backup-command.mjs";

27import { createApiCodegenRuntime, resolveCoreImport } from "../lib/cli-dev-runtime.mjs";

28import {

29 buildDrizzleKitCommand,

30 buildEnv,

31 cleanupOldBackups,

32 findServerRoot,

33 isLocalDbTarget,

34 isMonorepo,

35 loadConfig,

36 runInServer,

37 spawnInServer,

38 updateEnvLocalUrl,

Lines 463-503javascript

463 // ── app (subcommands: create, list, delete) ────────

464 app: runAppCommand,

465

466 // ── remote:deploy — REMOVED (legacy, use `gencow deploy` instead) ──

467

468 // ── jobs (Cron/Scheduled Jobs Observability) ──────

469 jobs: runJobsCommand,

470

471 // ── logs ───────────────────────────────────────────

472 logs: runLogsCommand,

473

474 // ── env — 환경변수 관리 (Cloud only) ─────────

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gencow.mjsView on unpkg

lib/cli-project-runtime.mjsView file

Lines 120-160javascript

120 if (outDir !== null) codegen.outDir = outDir;

121 const serverOutDir = extractFrom(codegenBlock, "serverOutDir");

122 if (serverOutDir !== null) codegen.serverOutDir = serverOutDir;

123 const authSchema

lib/readme-codegen.mjsView file

Lines 257-297javascript

257 md += `- Do not call fetch("/api/query") or fetch("/api/mutation") directly.\n`;

258 md += `- Do not create apiPost() wrappers for procedures.\n`;

259 md += `- gencow/api.ts is generated. Do not create or edit it manually.\n`;

260 md += `- gencow/ai.ts is generated. Do not edit or bypass it.\n`;

261 md +=

lib/platform-client.mjsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";

2import { homedir } from "os";

3import { resolve } from "path";

4import { CYAN, RESET, error, info } from "./output.mjs";

5import { validatePlatformUrl } from "./domain-helpers.mjs";

server/index.jsView file

•path = server/index.js kind = oversized_source_file sizeBytes = 4859108 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/index.jsView on unpkg