registry / payservedb / 9.5.1

payservedb@9.5.1

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVars

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 229 file(s), 502 KB of source, external domains: 102.217.144.50, example.com, www.zohoapis.com

Source & flagged code

2 flagged

.envView file

2patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L2: Password=<redacted:10 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L2

index.jsView file

Lines 1-21javascript

1const mongoose = require("mongoose");

2const whatsapp_conversation = require("./src/models/whatsapp_conversation");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3require("dotenv").config();

5// Maintain a record of open connections for each database

6const connections = {};

8// Utility function to connect to MongoDB

9async function connectToMongoDB(

10 dbName,

11 secured,

12 username,

13 password,

14 url,

15 port,

16) {

17 try {

18 if (secured === false) {

19 const url_ = url + ":" + port;

20 const connectionString = `mongodb://${url_}/${dbName}`;

21 await mongoose.connect(connectionString, {

Source & flagged code

2 flagged · loading source

.envView file

2patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L2: Password=<redacted:10 value>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L2

index.jsView file

1const mongoose = require("mongoose"); L2: const whatsapp_conversation = require("./src/models/whatsapp_conversation");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Findings

1 Critical2 Medium2 Low

CriticalCritical Secret.env

MediumDynamic Requireindex.js

MediumEnvironment Vars

LowScripts Present

LowUrl Strings