Loading npm security reports…

keryx@0.38.0: Suspicious npm security report (Warn) | LPM Firewall

registry / keryx / 0.38.0

keryx@0.38.0

The fullstack TypeScript framework for MCP and APIs — write one action, serve HTTP, WebSocket, CLI, background tasks, and MCP tools.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 414 KB of source, external domains: biomejs.dev, cdn.jsdelivr.net, chatgpt.com, claude.ai, claude.com, github.dev, keryx.internal, vscode.dev

Source & flagged code

3 flagged

testing/http.tsView file

Lines 1-28typescript

1/**

2 * Default test user credentials. Matches the inline values used in the example

3 * backend tests prior to this helper.

4 */

5export const DEFAULT_TEST_USER = {

6 name: "Mario Mario",

7 email: "mario@example.com",

8 password: "mushroom1",

Medium

Secret Pattern

Package contains a possible secret pattern.

testing/http.tsView on unpkg · L8

9} as const;

11/**

12 * Create a test user via HTTP PUT `/api/user`. Defaults to the Mario credentials

13 * used across example backend tests; override any field per call.

14 *

15 * Returns the raw `Response` so callers can assert on status and parse the body

16 * into whatever response type they need.

17 *

18 * @param url - Base server URL (from `useTestServer()`'s getter).

19 * @param overrides - Override any of `name`, `email`, `password`.

20 */

21export async function createTestUser(

22 url: string,

23 overrides?: Partial<{ name: string; email: string; password: string }>,

24): Promise<Response> {

25 return fetch(url + "/api/user", {

26 method: "PUT",

27 headers: { "Content-Type": "application/json" },

28 body: JSON.stringify({ ...DEFAULT_TEST_USER, ...overrides }),

util/glob.tsView file

Lines 4-44typescript

4import { ErrorType, TypedError } from "../classes/TypedError";

6/**

7 * Auto-discover and instantiate all exported classes from `.ts`/`.tsx` files in a directory.

8 * Files prefixed with `.` are skipped. Used to load actions, initializers, and servers.

9 *

10 * @param searchDir - Absolute path or relative path (resolved from `api.rootDir`) to scan.

11 *

README.mdView file

Lines 44-84markdown

44**HTTP** — `PUT /api/user` with JSON body, query params, or form data:

45```bash

46curl -X PUT http://localhost:8080/api/user \

47 -H "Content-Type: application/json" \

48 -d '{"name":"Evan","email":"evan@example.com","password":"secret123"}'

49```

Source & flagged code

3 flagged · loading source

testing/http.tsView file

8patternName = generic_password severity = medium line = 8 matchedText = password...m1",

Medium

Secret Pattern

Package contains a possible secret pattern.

testing/http.tsView on unpkg · L8

util/glob.tsView file

24const fullPath = path.join(dir, file); L25: const modules = (await import(fullPath)) as Record<string, unknown>; L26:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

util/glob.tsView on unpkg · L24

README.mdView file

64patternName = generic_password severity = medium line = 64 matchedText = await ap... });

Medium

Secret Pattern

Hardcoded password in README.md

README.md

Findings

5 Medium6 Low

MediumSecret Patterntesting/http.ts

MediumDynamic Requireutil/glob.ts

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings