registry / gina / 0.5.18

gina@0.5.18

Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Install hooks perform local framework setup under the package's own configuration paths; no relevant network endpoint or credential collection was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install or explicit framework/CLI use

Impact

No concrete unconsented payload execution, exfiltration, or foreign control-surface mutation confirmed.

Mechanism

package-aligned local setup and user-invoked framework operations

Rationale

Static hints identify real lifecycle and dynamic-loading primitives, but direct source inspection shows package-aligned setup and framework features rather than a malicious chain. No install-time network activity, credential theft, remote payload execution, or foreign AI-agent control-surface mutation was found.

Evidence

package.jsonscript/pre_install.jsscript/post_install.jsframework/v0.5.18/core/controller/controller.jsframework/v0.5.18/core/connectors/postgresql/index.jsframework/v0.5.18/core/connectors/couchbase/index.jsindex.mjsframework/v0.5.18/core/gna.jsbin/ginabin/gina-containerbin/gina-init

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` runs `preinstall` and `postinstall`.
`script/post_install.js` creates framework-owned `~/.gina` state and may create a local `package.json`.
Lifecycle hooks invoke local `npm`/`git` commands for setup.

Evidence against

No lifecycle network, credential-harvesting, or exfiltration code found.
Postinstall writes are package-aligned framework configuration, not AI-agent or shell-profile mutation.
Git hook configuration is gated on a `.git` directory at the package's own clone root.
Couchbase's flagged `eval` is commented out and replaced by `JSON.parse`.
PostgreSQL dynamic loading is local bundle entity/module loading.
Controller outbound requests are explicit framework download functionality, not install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 320 file(s), 7.11 MB of source, external domains: api.deepseek.com, api.groq.com, api.mistral.ai, api.perplexity.ai, api.together.xyz, api.x.ai, blog.couchbase.com, blog.stevenlevithan.com, bundle-dev-scope-v1.docmain.com, dashscope.aliyuncs.com, developer.couchbase.com, developer.mozilla.org, developers.google.com, domain.local, en.wikipedia.org, example.com, generativelanguage.googleapis.com, gina.io, github.com, hstspreload.org, html.spec.whatwg.org, json-schema.org, modelcontextprotocol.io, nodejs.org, planetcalc.com, requirejs.org, stackoverflow.com, stuk.github.io, www.npmjs.com, www.w3.org

Source & flagged code

15 flagged

package.jsonView file

Lines 87-127json

87 },

88 "./package.json": "./package.json"

89 },

90 "types": "./types/index.d.ts",

91 "typesVersions": {

92 "*": {

93 "gna": [

94 "./types/gna.d.ts"

95 ]

96 }

97 },

98 "scripts": {

99 "test": "node --test test*.test.js",

100 "test:e2e": "playwright test test/e2e",

101 "smoke": "node script/smoke_test_tarball.js",

102 "types:gen": "node script/generate_gna_types.js",

103 "types:check": "node script/generate_gna_types.js --check && node script/check_types_consumer.js",

104 "prepare": "node script/prepare_version.js",

105 "prepack": "node script/check_no_local_leak.js",

106 "postpublish": "node script/post_publish.js",

107 "preinstall": "node script/pre_install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L107

108 "postinstall": "node script/post_install.js"

109 },

110 "license": "MIT",

111 "readmeFilename": "README.md",

112 "dependencies": {

113 "@rhinostone/swig": "^2.7.2",

114 "engine.io": "^6.6.7",

115 "psl": "^1.15.0",

116 "ws": "^8.21.0"

117 },

118 "devDependencies": {

119 "@playwright/test": "^1.48.0",

120 "@types/node": "^26.1.1",

121 "csso-cli": "4.0.2",

122 "engine.io-client": "^6.6.4",

123 "jsdom": "^29.1.1",

124 "nunjucks": "^3.2.4",

125 "requirejs": "^2.3.7",

126 "sass": "1.101.0",

127 "typescript": "^7.0.2"

framework/v0.5.18/core/controller/controller.jsView file

Lines 1-33javascript

1"use strict";

2/*

3 * This file is part of the gina package.

5 *

6 * For the full copyright and license information, please view the LICENSE

7 * file that was distributed with this source code.

8 */

10//Imports.

11var fs = require

framework/v0.5.18/lib/cmd/framework/tail.jsView file

Lines 259-299javascript

259 if (bundle) {

260 process.stdout.write('[MQTail] Not keeping alive bundle `'+ bundle +'`\n');

261 client.destroy();

262 return end()

263 }

264 }

framework/v0.5.18/core/connectors/couchbase/index.jsView file

Lines 374-414javascript

374 ||

375 // windows style location

376 /^[a-z]:(\\|\/\/)/i.test(filename)

377 ||

378 // not unix absolut

379 !/^\/

framework/v0.5.18/core/connectors/postgresql/index.jsView file

Lines 1-29javascript

1/*

2 * This file is part of the gina package.

4 *

5 * For the full copyright and license information, please view the LICENSE

6 * file that was distributed with this source code.

7 */

8'use strict';

10var fs = require('fs');

framework/v0.5.18/lib/release-watch/src/main.jsView file

Lines 86-126javascript

86 * ignored wherever it appears in the tree.

87 * @constant {string[]}

88 */

89var DEFAULT_IGNORE = [ 'node_modules', '.git', '.DS_Store', 'logs', 'tmp' ];

91/**

framework/v0.5.18/core/server.isaac.jsView file

Lines 1-26javascript

1"use strict";

2/**

3 * @module gina/core/server.isaac

4 */

5const fs = require('fs');

6const crypto = require('crypto');

framework/v0.5.18/core/gna.jsView file

Lines 8-48javascript

8 */

10/**

11 * @module gina/core/gna

12 */

13/**

14 * Gina core bootstrap. Initialises the framework process, mounts bundles, and

15 * exposes the `gna` / `process` lifecycle API to bundle code:

16 * - gna.onInitialize / gna.onStarted / gna.onRouting / gna.onError

17 * - gna.start / gna.stop / gna.restart / gna.status

18 * - gna.mount / gna.getProjectConfiguration

script/smoke_in_container.jsView file

225L226: // 1. Install the candidate globally. Node: `npm install -g` (exercises L227: // pre/post-install). Bun: `bun add -g` — note Bun blocks dependency ... L233: log('bun add -g ' + TARBALL + ' ...'); L234: inst = spawnSync('bun', ['add', '-g', TARBALL], { stdio: 'inherit', timeout: 600000 }); L235: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

script/smoke_in_container.jsView on unpkg · L225

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView file

•path = framework/v0.5.[redacted].min.css.br kind = compressed_blob sizeBytes = 660 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView on unpkg

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View file

•path = framework/v0.5.[redacted]have_heart_one-webfont.woff2 kind = high_entropy_blob sizeBytes = 144060 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View on unpkg

framework/v0.5.18/lib/secrets/src/main.jsView file

40patternName = generic_password severity = medium line = 40 matchedText = * var co...' };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L40

233patternName = generic_password severity = medium line = 233 matchedText = * var co...] };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L233

265patternName = generic_password severity = medium line = 265 matchedText = * db...' },

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L265

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node script/pre_install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

framework/v0.5.18/core/controller/controller.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gina@0.5.9 matchedIdentity = npm:Z2luYQ:0.5.9 similarity = 0.642 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

framework/v0.5.18/core/controller/controller.jsView on unpkg

13const { pipeline } = require('stream/promises'); L14: const exec = require('child_process').exec; L15: var util = require('util');

High

Child Process

Package source references child process execution.

framework/v0.5.18/core/controller/controller.jsView on unpkg · L13

framework/v0.5.18/lib/cmd/framework/tail.jsView file

279// exec the binary directly so no part of the parsed log content reaches L280: // `/bin/sh -c`. The saved argv always carries `bundle:start` (bin/gina L281: // rewrites restart->start), so the guard never blocks a legitimate restart.

High

Shell

Package source references shell execution.

framework/v0.5.18/lib/cmd/framework/tail.jsView on unpkg · L279

framework/v0.5.18/core/connectors/couchbase/index.jsView file

394if (optionsArr) { L395: // CB-QUAL-2 fix: replaced eval() with JSON.parse() for @options parsing. L396: // @options uses JavaScript object literal syntax with unquoted keys

Low

Eval

Package source references a known benign dynamic code generation pattern.

framework/v0.5.18/core/connectors/couchbase/index.jsView on unpkg · L394

framework/v0.5.18/core/connectors/postgresql/index.jsView file

9L10: var fs = require('fs'); L11: var sqlParser = require('./../sql-parser'); // #SQL1 state-machine comment stripper

Medium

Dynamic Require

Package source references dynamic require/import behavior.

framework/v0.5.18/core/connectors/postgresql/index.jsView on unpkg · L9

framework/v0.5.18/lib/release-watch/src/main.jsView file

106* @type {Object<string, function>} L107: * @private L108: */ ... L940: try { L941: _svc.emitter.emit('release', { type: type, data: data || {}, at: Date.now() }); L942: } catch (emitErr) { ... L969: try { L970: manifest = JSON.parse(raw); L971: } catch (parseErr) { ... L1184: * Default build spawner — `gina bundle:build <bundle> @<project> --env=… --scope=…` L1185: * as a detached-from-stdio child whose stdout/stderr lines feed progress. L1186: * @inner

Low

Weak Crypto

Package source references weak cryptographic algorithms.

framework/v0.5.18/lib/release-watch/src/main.jsView on unpkg · L106

framework/v0.5.18/core/server.isaac.jsView file

6const crypto = require('crypto'); L7: const { execSync, exec } = require('child_process'); L8: const {EventEmitter} = require('events'); L9: // #B10 fix: engine.io is only needed when options.ioServer is configured (WebSocket support). L10: // Require it lazily so bundles without WebSocket support don't crash if engine.io is absent. ... L17: var _isDebugLog = function() { L18: return process.env.LOG_LEVEL === 'debug' || process.env.LOG_LEVEL === 'trace'; L19: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

framework/v0.5.18/core/server.isaac.jsView on unpkg · L6

framework/v0.5.18/core/gna.jsView file

28Cross-file remote execution chain: framework/v0.5.18/core/gna.js spawns framework/v0.5.[redacted].js; helper contains network access plus dynamic code execution. L28: const os = require('os'); L29: process.env.UV_THREADPOOL_SIZE = (os.cpus().length); L30: // #P1 — V8 bytecode cache. Node.js >= 22.8 caches compiled modules to disk so ... L33: if (!process.env.NODE_COMPILE_CACHE) { L34: process.env.NODE_COMPILE_CACHE = os.homedir() + '/.gina/cache/v8'; L35: } ... L48: process.env.GINA_V8_POINTER_COMPRESSED = 'true'; L49: process.stdout.write('[gina] V8 pointer compression active — heap limit: ' L50: + Math.round(_heapLimit / (1024 * 1024)) + ' MB per isolate\n'); ... L138: L139: var importedContext = JSON.parse( fs.readFileSync(_(ctxFilename, true)) ); L140:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

framework/v0.5.18/core/gna.jsView on unpkg · L28

script/smoke_in_container.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

script/smoke_in_container.jsView on unpkg · L225

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView file

•path = framework/v0.5.[redacted].min.css.br kind = compressed_blob sizeBytes = 660 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView on unpkg

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View file

•path = framework/v0.5.[redacted]have_heart_one-webfont.woff2 kind = high_entropy_blob sizeBytes = 144060 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View on unpkg

framework/v0.5.18/lib/secrets/src/main.jsView file

40patternName = generic_password severity = medium line = 40 matchedText = * var co...' };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L40

233patternName = generic_password severity = medium line = 233 matchedText = * var co...] };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L233

265patternName = generic_password severity = medium line = 265 matchedText = * db...' },

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L265

Findings

1 Critical7 High8 Medium7 Low

CriticalPrevious Version Dangerous Deltaframework/v0.5.18/core/controller/controller.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processframework/v0.5.18/core/controller/controller.js

HighShellframework/v0.5.18/lib/cmd/framework/tail.js

HighSame File Env Network Executionframework/v0.5.18/core/server.isaac.js

HighCross File Remote Execution Contextframework/v0.5.18/core/gna.js

HighRuntime Package Installscript/smoke_in_container.js

HighShips High Entropy Blobframework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2

MediumDynamic Requireframework/v0.5.18/core/connectors/postgresql/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobframework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.br

MediumStructural Risk Force Deep Review

MediumSecret Patternframework/v0.5.18/lib/secrets/src/main.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalframework/v0.5.18/core/connectors/couchbase/index.js

LowWeak Cryptoframework/v0.5.18/lib/release-watch/src/main.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorMartin-Luther ETOUMAN

Maintainersbeemaster

Version0.5.18

PublishedJul 16, 2026

LicenseMIT

Dependencies4

Integrityverified

Package size2.60 MB

Files589

Keywordsnodejsframeworkmvchttp2rest-apifull-stackserver-side-renderingevent-driven

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./framework/v0.5.18/core/gnatypes → ./types/index.d.tsexports mapbin → gina, gina-container, gina-init

RuntimeNo engine / OS / CPU constraints

Artifact9.43 MB · 589 files1 signature(s)

Install lifecyclepostinstallpreinstallprepare

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedUrlStringsManifest: clean

Source & flagged code

15 flagged

package.jsonView file

Lines 87-127json

87 },

88 "./package.json": "./package.json"

89 },

90 "types": "./types/index.d.ts",

91 "typesVersions": {

92 "*": {

93 "gna": [

94 "./types/gna.d.ts"

95 ]

96 }

97 },

98 "scripts": {

99 "test": "node --test test*.test.js",

100 "test:e2e": "playwright test test/e2e",

101 "smoke": "node script/smoke_test_tarball.js",

102 "types:gen": "node script/generate_gna_types.js",

103 "types:check": "node script/generate_gna_types.js --check && node script/check_types_consumer.js",

104 "prepare": "node script/prepare_version.js",

105 "prepack": "node script/check_no_local_leak.js",

106 "postpublish": "node script/post_publish.js",

107 "preinstall": "node script/pre_install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L107

108 "postinstall": "node script/post_install.js"

109 },

110 "license": "MIT",

111 "readmeFilename": "README.md",

112 "dependencies": {

113 "@rhinostone/swig": "^2.7.2",

114 "engine.io": "^6.6.7",

115 "psl": "^1.15.0",

116 "ws": "^8.21.0"

117 },

118 "devDependencies": {

119 "@playwright/test": "^1.48.0",

120 "@types/node": "^26.1.1",

121 "csso-cli": "4.0.2",

122 "engine.io-client": "^6.6.4",

123 "jsdom": "^29.1.1",

124 "nunjucks": "^3.2.4",

125 "requirejs": "^2.3.7",

126 "sass": "1.101.0",

127 "typescript": "^7.0.2"

framework/v0.5.18/core/controller/controller.jsView file

Lines 1-33javascript

1"use strict";

2/*

3 * This file is part of the gina package.

5 *

6 * For the full copyright and license information, please view the LICENSE

7 * file that was distributed with this source code.

8 */

10//Imports.

11var fs = require

framework/v0.5.18/lib/cmd/framework/tail.jsView file

Lines 259-299javascript

259 if (bundle) {

260 process.stdout.write('[MQTail] Not keeping alive bundle `'+ bundle +'`\n');

261 client.destroy();

262 return end()

263 }

264 }

framework/v0.5.18/core/connectors/couchbase/index.jsView file

Lines 374-414javascript

374 ||

375 // windows style location

376 /^[a-z]:(\\|\/\/)/i.test(filename)

377 ||

378 // not unix absolut

379 !/^\/

framework/v0.5.18/core/connectors/postgresql/index.jsView file

Lines 1-29javascript

1/*

2 * This file is part of the gina package.

4 *

5 * For the full copyright and license information, please view the LICENSE

6 * file that was distributed with this source code.

7 */

8'use strict';

10var fs = require('fs');

framework/v0.5.18/lib/release-watch/src/main.jsView file

Lines 86-126javascript

86 * ignored wherever it appears in the tree.

87 * @constant {string[]}

88 */

89var DEFAULT_IGNORE = [ 'node_modules', '.git', '.DS_Store', 'logs', 'tmp' ];

91/**

framework/v0.5.18/core/server.isaac.jsView file

Lines 1-26javascript

1"use strict";

2/**

3 * @module gina/core/server.isaac

4 */

5const fs = require('fs');

6const crypto = require('crypto');

framework/v0.5.18/core/gna.jsView file

Lines 8-48javascript

8 */

10/**

11 * @module gina/core/gna

12 */

13/**

14 * Gina core bootstrap. Initialises the framework process, mounts bundles, and

15 * exposes the `gna` / `process` lifecycle API to bundle code:

16 * - gna.onInitialize / gna.onStarted / gna.onRouting / gna.onError

17 * - gna.start / gna.stop / gna.restart / gna.status

18 * - gna.mount / gna.getProjectConfiguration

script/smoke_in_container.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

script/smoke_in_container.jsView on unpkg · L225

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView file

•path = framework/v0.5.[redacted].min.css.br kind = compressed_blob sizeBytes = 660 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/css/gina.min.css.brView on unpkg

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View file

•path = framework/v0.5.[redacted]have_heart_one-webfont.woff2 kind = high_entropy_blob sizeBytes = 144060 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

framework/v0.5.18/core/asset/plugin/dist/vendor/gina/inspector/have_heart_one-webfont.woff2View on unpkg

framework/v0.5.18/lib/secrets/src/main.jsView file

40patternName = generic_password severity = medium line = 40 matchedText = * var co...' };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L40

233patternName = generic_password severity = medium line = 233 matchedText = * var co...] };

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L233

265patternName = generic_password severity = medium line = 265 matchedText = * db...' },

Medium

Secret Pattern

Hardcoded password in framework/v0.5.18/lib/secrets/src/main.js

framework/v0.5.18/lib/secrets/src/main.jsView on unpkg · L265