registry / legispro-cli / 1.0.45

legispro-cli@1.0.45

LegisPro CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 50 file(s), 174 KB of source, external domains: axschema.org, exist-db.org, exist.sourceforge.net, www.w3.org, www.xcential.com

Source & flagged code

2 flagged

dist/commands/mapped-user/create.jsView file

Lines 95-135javascript

95 {

96 type: 'password',

97 name: 'deploymentSSHPassword',

98 message: 'Confirm SSH password',

99 initial: config.deploymentSSHPassword,

100 },

101 ]);

102 config.deploymentSSHAccount = tokenPrompt.deploymentSSHAccount;

103 config.deploymentSSHPassword = tokenPrompt.deploymentSSHPassword;

104 }

105 const emailIds = flags.ids.split(',').map(id => id.trim());

106 const groupList = flags.groups.split(',').map(g => g.trim());

107 const results = [];

108 const spinner = ora('Creating users in eXist-db...').start();

109 for (const id of emailIds) {

110 const username = deriveUsername(id);

111 const password = generateRandomPassword();

112 // 1. Check if user exists

113 const userRes = await client.getUser(username);

114 if (userRes.status === 200) {

115 results.push({ id, username, password: '[EXISTING]', status: 'skipped' });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/mapped-user/create.jsView on unpkg · L115

116 continue;

117 }

118 // 2. Create user with hashed password

119 const hashedPassword = new RIPEMD160().update(password).digest('base64');

120 const userObj = {

121 userName: username,

122 password: hashedPassword,

123 groups: groupList,

124 enabled: true,

125 };

126 await client.createUser(userObj);

127 // 3. Create home collection

128 const homeUri = `/db/repository/${username}`;

129 const homeColl = { uri: homeUri, owner: username, group: config.group, mode: 'rwxr-x---' };

130 await client.createCollection(homeColl);

131 await client.modifyCollection(homeColl);

132 results.push({ id, username, password, status: 'created' });

133 }

134 spinner.succeed('eXist-db users processed.');

135 // Prepare new mappings

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

Source & flagged code

2 flagged · loading source

dist/commands/mapped-user/create.jsView file

115patternName = generic_password severity = medium line = 115 matchedText = results.... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/mapped-user/create.jsView on unpkg · L115

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

Findings

5 Medium5 Low

MediumSecret Patterndist/commands/mapped-user/create.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/dev.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/commands/mapped-user/create.jsView file

Lines 95-135javascript

95 {

96 type: 'password',

97 name: 'deploymentSSHPassword',

98 message: 'Confirm SSH password',

99 initial: config.deploymentSSHPassword,

100 },

101 ]);

102 config.deploymentSSHAccount = tokenPrompt.deploymentSSHAccount;

103 config.deploymentSSHPassword = tokenPrompt.deploymentSSHPassword;

104 }

105 const emailIds = flags.ids.split(',').map(id => id.trim());

106 const groupList = flags.groups.split(',').map(g => g.trim());

107 const results = [];

108 const spinner = ora('Creating users in eXist-db...').start();

109 for (const id of emailIds) {

110 const username = deriveUsername(id);

111 const password = generateRandomPassword();

112 // 1. Check if user exists

113 const userRes = await client.getUser(username);

114 if (userRes.status === 200) {

115 results.push({ id, username, password: '[EXISTING]', status: 'skipped' });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/mapped-user/create.jsView on unpkg · L115

116 continue;

117 }

118 // 2. Create user with hashed password

119 const hashedPassword = new RIPEMD160().update(password).digest('base64');

120 const userObj = {

121 userName: username,

122 password: hashedPassword,

123 groups: groupList,

124 enabled: true,

125 };

126 await client.createUser(userObj);

127 // 3. Create home collection

128 const homeUri = `/db/repository/${username}`;

129 const homeColl = { uri: homeUri, owner: username, group: config.group, mode: 'rwxr-x---' };

130 await client.createCollection(homeColl);

131 await client.modifyCollection(homeColl);

132 results.push({ id, username, password, status: 'created' });

133 }

134 spinner.succeed('eXist-db users processed.');

135 // Prepare new mappings

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg