registry / qwykz / 1.4.2

qwykz@1.4.2

Fast Express + TypeScript + Prisma boilerplate generator built with Bun

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 75 file(s), 158 KB of source, external domains: bun.sh, github.com, registry.npmjs.org, your-endpoint.upstash.io, your-project.supabase.co

Source & flagged code

8 flagged

test-qwykz.shView file

Lines 1-40shell

1#!/bin/bash

2set -e

4echo "======================================"

5echo "🚀 Qwykz CLI Automated Testing Suite 🚀"

6echo "======================================"

8# Target directory

9TEST_DIR="qwykz-tests"

10mkdir -p $TEST_DIR

12# Credentials

13SUPABASE_URL="https://uycyiwnzikslmkjiqwyd.supabase.co"

14SUPABASE_ANON_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV5Y3lpd256aWtzbG1ramlxd3lkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODIyODYxMjQsImV4cCI6MjA5Nzg2MjEyNH0.EJfqKnhh73wW7aJuJYnzoRvdIyDkAQ_7YTC5pJN77mo"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test-qwykz.shView on unpkg · L14

Critical

Secret Pattern

Supabase service role key (JWT) in test-qwykz.sh

test-qwykz.shView on unpkg · L14

15SUPABASE_DB_URL="postgresql://postgres.uycyiwnzikslmkjiqwyd:aGg2aY9vC9CvocXm@aws-1-ap-southeast-2.pooler.supabase.com:5432/postgres?pgbouncer=true"

16SUPABASE_DIRECT_URL="postgresql://postgres.uycyiwnzikslmkjiqwyd:aGg2aY9vC9CvocXm@aws-1-ap-southeast-2.pooler.supabase.com:5432/postgres"

17UPSTASH_URL="https://casual-macaque-155325.upstash.io"

18UPSTASH_TOKEN="gQAAAAAAAl69AAIgcDE4MGQwNDhmZGNkYmI0N2Q1OGE5ZjU1ZWM0YjlhOTVjYQ"

19CLERK_PUB_KEY="pk_test_bHVja3ktamF5YmlyZC02Mi5jbGVyay5hY2NvdW50cy5kZXYk"

20CLERK_SECRET_KEY="sk_test_dLa6ZN7GkUZ0UAgCfRBtU0w9zR074riqh8MfVolKKo"

High

Secret Pattern

Stripe test secret key in test-qwykz.sh

test-qwykz.shView on unpkg · L20

22PASS_COUNT=0

23FAIL_COUNT=0

24SKIP_COUNT=0

25RESULTS=""

27inject_credentials() {

28 local env_file=$1

29 if [ -f "$env_file" ]; then

30 sed -i "s|https://your-project.supabase.co|$SUPABASE_URL|g" "$env_file"

31 sed -i "s|your-anon-key|$SUPABASE_ANON_KEY|g" "$env_file"

32 sed -i "s|https://YOUR_PROJECT_REF.supabase.co|$SUPABASE_URL|g" "$env_file"

33 sed -i "s|YOUR_ANON_KEY|$SUPABASE_ANON_KEY|g" "$env_file"

35 sed -i "s|postgresql://johndoe:randompassword@localhost:5432/mydb?schema=public|$SUPABASE_DB_URL|g" "$env_file"

36 sed -i "s|DATABASE_URL=.*|DATABASE_URL=\"$SUPABASE_DB_URL\"|g" "$env_file"

37 sed -i "s|DIRECT_URL=.*|DIRECT_URL=\"$SUPABASE_DIRECT_URL\"|g" "$env_file"

39 sed -i "s|https://your-endpoint.upstash.io|$UPSTASH_URL|g" "$env_file"

40 sed -i "s|your-token|$UPSTASH_TOKEN|g" "$env_file"

•path = test-qwykz.sh kind = build_helper sizeBytes = 11961 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-qwykz.shView on unpkg

test-matrix.shView file

Lines 1-38shell

1#!/bin/bash

2set -e

4echo "======================================================"

5echo "🚀 Qwykz Exhaustive Matrix Test (ALL BACKENDS)"

6echo "======================================================"

8TEST_DIR="qwykz-matrix-tests"

9mkdir -p $TEST_DIR

run-all-maximized.tsView file

Lines 1-28typescript

1import { execSync } from "child_process";

2import { readFileSync, writeFileSync, rmSync, existsSync } from "fs";

3import { join } from "path";

5const SUPABASE_DB = 'postgresql://postgres.uycyiwnzikslmkjiqwyd:aGg2aY9vC9CvocXm@aws-1-ap-southeast-2.pooler.supabase.com:5432/postgres?pgbouncer=true';

6const SUPABASE_DIRECT

test-rust-endpoints.shView file

Lines 1-39shell

1#!/bin/bash

2set -e

4echo "======================================================"

5echo "🦀 Qwykz Targeted Test: RUST COMPILATION & ENDPOINTS"

6echo "======================================================"

8TEST_DIR="qwykz-rust-test"

9rm -rf $TEST_DIR

Source & flagged code

8 flagged · loading source

test-qwykz.shView file

14patternName = supabase_service_key severity = critical line = 14 matchedText = SUPABASE...7mo"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test-qwykz.shView on unpkg · L14

14patternName = supabase_service_key severity = critical line = 14 matchedText = SUPABASE...7mo"

Critical

Secret Pattern

Supabase service role key (JWT) in test-qwykz.sh

test-qwykz.shView on unpkg · L14

20patternName = stripe_test_secret severity = high line = 20 matchedText = CLERK_SE...KKo"

High

Secret Pattern

Stripe test secret key in test-qwykz.sh

test-qwykz.shView on unpkg · L20

•path = test-qwykz.sh kind = build_helper sizeBytes = 11961 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-qwykz.shView on unpkg

test-matrix.shView file

12patternName = supabase_service_key severity = critical line = 12 matchedText = SUPABASE...7mo"

Critical

Secret Pattern

Supabase service role key (JWT) in test-matrix.sh

test-matrix.shView on unpkg · L12

18patternName = stripe_test_secret severity = high line = 18 matchedText = CLERK_SE...KKo"

High

Secret Pattern

Stripe test secret key in test-matrix.sh

test-matrix.shView on unpkg · L18

run-all-maximized.tsView file

8patternName = stripe_test_secret severity = high line = 8 matchedText = const CL...Ko';

High

Secret Pattern

Stripe test secret key in run-all-maximized.ts

run-all-maximized.tsView on unpkg · L8

test-rust-endpoints.shView file

19patternName = supabase_service_key severity = critical line = 19 matchedText = SUPABASE...7mo"

Critical

Secret Pattern

Supabase service role key (JWT) in test-rust-endpoints.sh

test-rust-endpoints.shView on unpkg · L19

Findings

4 Critical3 High5 Medium4 Low

CriticalCritical Secrettest-qwykz.sh

CriticalSecret Patterntest-qwykz.sh

CriticalSecret Patterntest-matrix.sh

CriticalSecret Patterntest-rust-endpoints.sh

HighSecret Patterntest-qwykz.sh

HighSecret Patterntest-matrix.sh

HighSecret Patternrun-all-maximized.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertest-qwykz.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings