registry / kafecms / 0.29.3

kafecms@0.29.3

Astro-native CMS with WordPress migration support

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 923 file(s), 6.30 MB of source, external domains: challenges.cloudflare.com, cloudflare-dns.com, cron.kafecms.internal, kafecms.com, marketplace.kafecms.com, schema.org, www.google.com, www.sitemaps.org, www.w3.org

Source & flagged code

3 flagged

dist/cli/index.mjsView file

Lines 966-1006javascript

966 if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");

967 const db = createDatabase({ url: `file:${dbPath}` });

968 try {

969 consola.start("Checking database migrations...");

970 const { applied } = await runMigrations(db);

971 if (applied.length > 0) consola.success(`Applied ${applied.length} migrations`);

972 else consola.info("Database up to date");

973 } catch (error) {

974 consola.error("Migration failed:", error);

975 await db.destroy();

976 process.exit(1);

977 }

978 await db.destroy();

979 if (args.types) {

980 const remoteUrl = pkg.kafecms?.url || process.env.KAFECMS_URL;

981 if (!remoteUrl) consola.warn("No remote URL configured. Set KAFECMS_URL or kafecms.url in package.json");

982 else try {

983 const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);

984 const client = createClientFromArgs({ url: remoteUrl });

985 const schema = await client.schemaExport();

986 const types = await client.schemaTypes();

987 const { writeFile, mkdir } = await import("node:fs/promises");

988 const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L986

989 const outputPath = resolvePath(cwd, ".kafecms/types.ts");

990 await mkdir(dirname(outputPath), { recursive: true });

991 await writeFile(outputPath, types, "utf-8");

992 await writeFile(resolvePath(dirname(outputPath), "schema.json"), JSON.stringify(schema, null, 2), "utf-8");

993 consola.success(`Generated types for ${schema.collections.length} collections`);

994 } catch (error) {

995 consola.warn("Type generation failed:", error instanceof Error ? error.message : error);

996 }

997 }

998 consola.start("Starting Astro dev server...");

999 const astroArgs = [

1000 "astro",

1001 "dev",

1002 "--port",

1003 args.port

1004 ];

1005 const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));

1006 const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));

dist/ssrf-TrKYJAy0.mjsView file

Lines 1-24javascript

1//#region src/security/ssrf.ts

2/**

3* SSRF protection for import URLs.

5* Validates that URLs don't target internal/private network addresses.

6* Applied before any fetch() call in the import pipeline.

7*/

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-TrKYJAy0.mjsView on unpkg · L4

8const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(

dist/astro/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = kafecms@0.29.4 matchedIdentity = npm:a2FmZWNtcw:0.29.4 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/astro/index.mjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli/index.mjsView file

986const types = await client.schemaTypes(); L987: const { writeFile, mkdir } = await import("node:fs/promises"); L988: const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L986

dist/ssrf-TrKYJAy0.mjsView file

4* L5: * Validates that URLs don't target internal/private network addresses. L6: * Applied before any fetch() call in the import pipeline. L7: */ ... L196: if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) { L197: for (const entry of raw.Answer) if (hasProperty(entry, "data") && typeof entry.data === "string") answers.push({ data: entry.data }); L198: } ... L205: * Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA L206: * records. Works in both Workers and Node without requiring node:dns. L207: * ... L224: if (!response.ok) throw new Error(`DoH lookup failed: ${response.status}`); L225: const body = parseDohResponse(await response.json());

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-TrKYJAy0.mjsView on unpkg · L4

dist/astro/index.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/astro/index.mjsView on unpkg

Findings

2 High4 Medium4 Low

HighCloud Metadata Accessdist/ssrf-TrKYJAy0.mjs

HighPrevious Version Dangerous Deltadist/astro/index.mjs

MediumDynamic Requiredist/cli/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli/index.mjsView file

Lines 966-1006javascript

966 if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");

967 const db = createDatabase({ url: `file:${dbPath}` });

968 try {

969 consola.start("Checking database migrations...");

970 const { applied } = await runMigrations(db);

971 if (applied.length > 0) consola.success(`Applied ${applied.length} migrations`);

972 else consola.info("Database up to date");

973 } catch (error) {

974 consola.error("Migration failed:", error);

975 await db.destroy();

976 process.exit(1);

977 }

978 await db.destroy();

979 if (args.types) {

980 const remoteUrl = pkg.kafecms?.url || process.env.KAFECMS_URL;

981 if (!remoteUrl) consola.warn("No remote URL configured. Set KAFECMS_URL or kafecms.url in package.json");

982 else try {

983 const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);

984 const client = createClientFromArgs({ url: remoteUrl });

985 const schema = await client.schemaExport();

986 const types = await client.schemaTypes();

987 const { writeFile, mkdir } = await import("node:fs/promises");

988 const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L986

989 const outputPath = resolvePath(cwd, ".kafecms/types.ts");

990 await mkdir(dirname(outputPath), { recursive: true });

991 await writeFile(outputPath, types, "utf-8");

992 await writeFile(resolvePath(dirname(outputPath), "schema.json"), JSON.stringify(schema, null, 2), "utf-8");

993 consola.success(`Generated types for ${schema.collections.length} collections`);

994 } catch (error) {

995 consola.warn("Type generation failed:", error instanceof Error ? error.message : error);

996 }

997 }

998 consola.start("Starting Astro dev server...");

999 const astroArgs = [

1000 "astro",

1001 "dev",

1002 "--port",

1003 args.port

1004 ];

1005 const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));

1006 const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));

dist/ssrf-TrKYJAy0.mjsView file

Lines 1-24javascript

1//#region src/security/ssrf.ts

2/**

3* SSRF protection for import URLs.

5* Validates that URLs don't target internal/private network addresses.

6* Applied before any fetch() call in the import pipeline.

7*/

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-TrKYJAy0.mjsView on unpkg · L4

8const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(

dist/astro/index.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/astro/index.mjsView on unpkg