registry / secureauth-nodejs / 2.1.0

secureauth-nodejs@2.1.0

SecureAuth - Enterprise Two-Factor Authentication System with Application Flood Protection (Node.js/Express)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 176 KB of source, external domains: cdn.jsdelivr.net, cdn.tailwindcss.com, fonts.googleapis.com, fonts.gstatic.com, secureauth106293.netlify.app, unpkg.com

Source & flagged code

5 flagged

cli/src/installer.jsView file

Lines 1-41javascript

1const { execSync } = require('child_process');

2const { logger } = require('./logger');

High

Child Process

Package source references child process execution.

cli/src/installer.jsView on unpkg · L1

4const DB_DRIVERS = {

5 sqlite: 'better-sqlite3',

6 postgres: 'pg'

7};

9function install(cwd, missingDeps, answers) {

10 const dbDriver = DB_DRIVERS[answers.database];

11 const allDeps = [...missingDeps];

13 if (dbDriver && !allDeps.includes(dbDriver)) {

14 allDeps.push(dbDriver);

15 }

17 if (allDeps.length === 0) {

18 logger.success('All dependencies already installed');

19 return Promise.resolve();

20 }

22 logger.info(`Installing ${allDeps.length} packages: ${allDeps.join(', ')}`);

24 try {

25 execSync(`npm install ${allDeps.join(' ')} --save --progress=false`, {

26 cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/installer.jsView on unpkg · L24

27 stdio: 'inherit',

28 shell: true

29 });

30 logger.info('');

31 logger.success('Dependencies installed successfully');

32 return Promise.resolve();

33 } catch (err) {

34 logger.error('npm install failed');

35 logger.error(`Exit code: ${err.status}`);

36 return Promise.reject(err);

37 }

38}

40module.exports = { install };

SecureAuth_DDoS_Protection.zipView file

•path = SecureAuth_DDoS_Protection.zip kind = high_entropy_blob sizeBytes = 13063 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = compressed_blob sizeBytes = 13063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = nested_archive_needs_inspection sizeBytes = 13063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

SecureAuth_DDoS_Protection.zipView on unpkg

Source & flagged code

5 flagged · loading source

cli/src/installer.jsView file

1const { execSync } = require('child_process'); L2: const { logger } = require('./logger');

High

Child Process

Package source references child process execution.

cli/src/installer.jsView on unpkg · L1

24try { L25: execSync(`npm install ${allDeps.join(' ')} --save --progress=false`, { L26: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/installer.jsView on unpkg · L24

SecureAuth_DDoS_Protection.zipView file

•path = SecureAuth_DDoS_Protection.zip kind = high_entropy_blob sizeBytes = 13063 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = compressed_blob sizeBytes = 13063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = nested_archive_needs_inspection sizeBytes = 13063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

SecureAuth_DDoS_Protection.zipView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processcli/src/installer.js

HighShell

HighRuntime Package Installcli/src/installer.js

HighShips High Entropy BlobSecureAuth_DDoS_Protection.zip

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed BlobSecureAuth_DDoS_Protection.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs InspectionSecureAuth_DDoS_Protection.zip

Source & flagged code

5 flagged

cli/src/installer.jsView file

Lines 1-41javascript

1const { execSync } = require('child_process');

2const { logger } = require('./logger');

High

Child Process

Package source references child process execution.

cli/src/installer.jsView on unpkg · L1

4const DB_DRIVERS = {

5 sqlite: 'better-sqlite3',

6 postgres: 'pg'

7};

9function install(cwd, missingDeps, answers) {

10 const dbDriver = DB_DRIVERS[answers.database];

11 const allDeps = [...missingDeps];

13 if (dbDriver && !allDeps.includes(dbDriver)) {

14 allDeps.push(dbDriver);

15 }

17 if (allDeps.length === 0) {

18 logger.success('All dependencies already installed');

19 return Promise.resolve();

20 }

22 logger.info(`Installing ${allDeps.length} packages: ${allDeps.join(', ')}`);

24 try {

25 execSync(`npm install ${allDeps.join(' ')} --save --progress=false`, {

26 cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/installer.jsView on unpkg · L24

27 stdio: 'inherit',

28 shell: true

29 });

30 logger.info('');

31 logger.success('Dependencies installed successfully');

32 return Promise.resolve();

33 } catch (err) {

34 logger.error('npm install failed');

35 logger.error(`Exit code: ${err.status}`);

36 return Promise.reject(err);

37 }

38}

40module.exports = { install };

SecureAuth_DDoS_Protection.zipView file

•path = SecureAuth_DDoS_Protection.zip kind = high_entropy_blob sizeBytes = 13063 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = compressed_blob sizeBytes = 13063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

SecureAuth_DDoS_Protection.zipView on unpkg

•path = SecureAuth_DDoS_Protection.zip kind = nested_archive_needs_inspection sizeBytes = 13063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

SecureAuth_DDoS_Protection.zipView on unpkg