registry / soajs.controller / 4.3.14

soajs.controller@4.3.14

⚠ Under review

soajs multi tenant API gateway

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 311 KB of source, external domains: server.com

Source & flagged code

7 flagged

test/unit/mw/key/index.jsView file

Lines 1-37javascript

1"use strict";

3const helper = require("../../../helper.js");

4const mw = helper.requireModule('./mw/key/index');

6describe("Unit test for: mw - key", function () {

7 let req = {

8 "get": () => {

9 return null;

10 },

11 "soajs": {

12 "controller": {"serviceParams": {}},

13 "registry": {

14 "serviceConfig": {

15 "key": {

16 algorithm: "aes256",

17 password: "soajs key lal massa"

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

18 }

19 }

20 },

21 "log": {

22 "error": (err) => {

23 console.log(err);

24 }

25 }

26 }

27 };

28 let res = {};

29 let key = "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9";

30 let keyObj = {

31 "key": "a139786a6e6d18e48b4987e83789430b",

32 "extKey": "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9",

33 "tenant": {"id": "10d2cb5fc04ce51e06000001", "code": "DBTN", "locked": true},

34 "application": {

35 "product": "DSBRD",

36 "package": "DSBRD_GUEST",

37 "appId": "5c0e74ba9acc3c5a84a5125a",

Lines 158-198javascript

158 "users": {

159 "AVAPP_EXMPL": "AVAPP_ALTRN"

160 }

161 }

162 }

163 }

164 }

165 }

166 };

167

168

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

mw/cache/index.jsView file

112// Public APIs (no access_token required) return the same response for the whole L113: // tenant, so they are cached per tenant ("tenant"). Private APIs may return a L114: // different response per logged-in user, so they must be cached per tenant + user ... L151: res.writeHead(cached.response.statusCode, cached.response.headers); L152: res.end(cached.response.body); L153: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mw/cache/index.jsView on unpkg · L112

modules/driver/kubernetes/model/swagger/swagger.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

modules/driver/kubernetes/model/swagger/swagger.jsonView on unpkg

test/data/provision/urac/users/owner.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in test/data/provision/urac/users/owner.js

test/data/provision/urac/users/owner.jsView on unpkg · L6

modules/driver/kubernetes/model/index.jsView file

25patternName = generic_password severity = medium line = 25

Medium

Secret Pattern

Hardcoded password in modules/driver/kubernetes/model/index.js

modules/driver/kubernetes/model/index.jsView on unpkg · L25

Source & flagged code

7 flagged · loading source

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

Findings

1 High7 Medium5 Low

HighSemantic Analysis Limitedmodules/driver/kubernetes/model/swagger/swagger.json

MediumSecret Patterntest/unit/mw/key/index.js

MediumDynamic RequireGruntfile.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntest/unit/mw/key/index.js

MediumSecret Patterntest/data/provision/urac/users/owner.js

MediumSecret Patternmodules/driver/kubernetes/model/index.js

LowScripts Present

LowWeak Cryptomw/cache/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to soajs.controller@4.3.14.

See all versions of soajs.controller for other recorded verdicts.

Review the evidence and your use of soajs.controller@4.3.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 18:13:06.820Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.