registry / kafecms / 0.30.1

kafecms@0.30.1

Astro-native CMS with WordPress migration support

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 926 file(s), 6.35 MB of source, external domains: challenges.cloudflare.com, cloudflare-dns.com, cron.kafecms.internal, kafecms.com, marketplace.kafecms.com, schema.org, www.google.com, www.sitemaps.org, www.w3.org

Source & flagged code

2 flagged

dist/cli/index.mjsView file

Lines 965-1005javascript

965 if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");

966 const db = createDatabase({ url: `file:${dbPath}` });

967 try {

968 consola.start("Checking database migrations...");

969 const { applied } = await runMigrations(db);

970 if (applied.length > 0) consola.success(`Applied ${applied.length} migrations`);

971 else consola.info("Database up to date");

972 } catch (error) {

973 consola.error("Migration failed:", error);

974 await db.destroy();

975 process.exit(1);

976 }

977 await db.destroy();

978 if (args.types) {

979 const remoteUrl = pkg.kafecms?.url || process.env.KAFECMS_URL;

980 if (!remoteUrl) consola.warn("No remote URL configured. Set KAFECMS_URL or kafecms.url in package.json");

981 else try {

982 const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);

983 const client = createClientFromArgs({ url: remoteUrl });

984 const schema = await client.schemaExport();

985 const types = await client.schemaTypes();

986 const { writeFile, mkdir } = await import("node:fs/promises");

987 const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L985

988 const outputPath = resolvePath(cwd, ".kafecms/types.ts");

989 await mkdir(dirname(outputPath), { recursive: true });

990 await writeFile(outputPath, types, "utf-8");

991 await writeFile(resolvePath(dirname(outputPath), "schema.json"), JSON.stringify(schema, null, 2), "utf-8");

992 consola.success(`Generated types for ${schema.collections.length} collections`);

993 } catch (error) {

994 consola.warn("Type generation failed:", error instanceof Error ? error.message : error);

995 }

996 }

997 consola.start("Starting Astro dev server...");

998 const astroArgs = [

999 "astro",

1000 "dev",

1001 "--port",

1002 args.port

1003 ];

1004 const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));

1005 const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));

dist/ssrf-DWqC5Zi3.mjsView file

Lines 1-24javascript

1//#region src/security/ssrf.ts

2/**

3* SSRF protection for import URLs.

5* Validates that URLs don't target internal/private network addresses.

6* Applied before any fetch() call in the import pipeline.

7*/

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-DWqC5Zi3.mjsView on unpkg · L4

8const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(

Source & flagged code

2 flagged · loading source

dist/cli/index.mjsView file

985const types = await client.schemaTypes(); L986: const { writeFile, mkdir } = await import("node:fs/promises"); L987: const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L985

dist/ssrf-DWqC5Zi3.mjsView file

4* L5: * Validates that URLs don't target internal/private network addresses. L6: * Applied before any fetch() call in the import pipeline. L7: */ ... L196: if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) { L197: for (const entry of raw.Answer) if (hasProperty(entry, "data") && typeof entry.data === "string") answers.push({ data: entry.data }); L198: } ... L205: * Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA L206: * records. Works in both Workers and Node without requiring node:dns. L207: * ... L224: if (!response.ok) throw new Error(`DoH lookup failed: ${response.status}`); L225: const body = parseDohResponse(await response.json());

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-DWqC5Zi3.mjsView on unpkg · L4

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessdist/ssrf-DWqC5Zi3.mjs

MediumDynamic Requiredist/cli/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli/index.mjsView file

Lines 965-1005javascript

965 if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");

966 const db = createDatabase({ url: `file:${dbPath}` });

967 try {

968 consola.start("Checking database migrations...");

969 const { applied } = await runMigrations(db);

970 if (applied.length > 0) consola.success(`Applied ${applied.length} migrations`);

971 else consola.info("Database up to date");

972 } catch (error) {

973 consola.error("Migration failed:", error);

974 await db.destroy();

975 process.exit(1);

976 }

977 await db.destroy();

978 if (args.types) {

979 const remoteUrl = pkg.kafecms?.url || process.env.KAFECMS_URL;

980 if (!remoteUrl) consola.warn("No remote URL configured. Set KAFECMS_URL or kafecms.url in package.json");

981 else try {

982 const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);

983 const client = createClientFromArgs({ url: remoteUrl });

984 const schema = await client.schemaExport();

985 const types = await client.schemaTypes();

986 const { writeFile, mkdir } = await import("node:fs/promises");

987 const { resolve: resolvePath, dirname } = await import("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.mjsView on unpkg · L985

988 const outputPath = resolvePath(cwd, ".kafecms/types.ts");

989 await mkdir(dirname(outputPath), { recursive: true });

990 await writeFile(outputPath, types, "utf-8");

991 await writeFile(resolvePath(dirname(outputPath), "schema.json"), JSON.stringify(schema, null, 2), "utf-8");

992 consola.success(`Generated types for ${schema.collections.length} collections`);

993 } catch (error) {

994 consola.warn("Type generation failed:", error instanceof Error ? error.message : error);

995 }

996 }

997 consola.start("Starting Astro dev server...");

998 const astroArgs = [

999 "astro",

1000 "dev",

1001 "--port",

1002 args.port

1003 ];

1004 const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));

1005 const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));

dist/ssrf-DWqC5Zi3.mjsView file

Lines 1-24javascript

1//#region src/security/ssrf.ts

2/**

3* SSRF protection for import URLs.

5* Validates that URLs don't target internal/private network addresses.

6* Applied before any fetch() call in the import pipeline.

7*/

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ssrf-DWqC5Zi3.mjsView on unpkg · L4

8const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(