registry / soajs.controller / 4.3.16

soajs.controller@4.3.16

soajs multi tenant API gateway

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 318 KB of source, external domains: server.com

Source & flagged code

7 flagged

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

mw/cache/index.jsView file

112// Public APIs (no access_token required) return the same response for the whole L113: // tenant, so they are cached per tenant ("tenant"). Private APIs may return a L114: // different response per logged-in user, so they must be cached per tenant + user ... L151: res.writeHead(cached.response.statusCode, cached.response.headers); L152: res.end(cached.response.body); L153: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mw/cache/index.jsView on unpkg · L112

modules/driver/kubernetes/model/swagger/swagger.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

modules/driver/kubernetes/model/swagger/swagger.jsonView on unpkg

test/data/provision/urac/users/owner.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in test/data/provision/urac/users/owner.js

test/data/provision/urac/users/owner.jsView on unpkg · L6

modules/driver/kubernetes/model/index.jsView file

25patternName = generic_password severity = medium line = 25

Medium

Secret Pattern

Hardcoded password in modules/driver/kubernetes/model/index.js

modules/driver/kubernetes/model/index.jsView on unpkg · L25

Source & flagged code

7 flagged · loading source

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

Findings

1 High7 Medium5 Low

HighSemantic Analysis Limitedmodules/driver/kubernetes/model/swagger/swagger.json

MediumSecret Patterntest/unit/mw/key/index.js

MediumDynamic RequireGruntfile.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntest/unit/mw/key/index.js

MediumSecret Patterntest/data/provision/urac/users/owner.js

MediumSecret Patternmodules/driver/kubernetes/model/index.js

LowScripts Present

LowWeak Cryptomw/cache/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to soajs.controller@4.3.16.

See all versions of soajs.controller for other recorded verdicts.

Review the evidence and your use of soajs.controller@4.3.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 09:50:34.558Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.