registry / soajs.controller / 4.3.17

soajs.controller@4.3.17

soajs multi tenant API gateway

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The inspected source does not support a malicious verdict, but the Kubernetes client can send a configured bearer token with TLS verification disabled when CA configuration is absent. This warrants a warning for the conditional transport risk.

Static reason

One or more suspicious static signals were detected.

Trigger

A Kubernetes high availability service discovery lookup runs with deployment configuration that lacks a CA.

Impact

A network attacker able to intercept the connection could impersonate the API server and expose the token or alter the response.

Mechanism

The client sends the configured bearer token to the configured Kubernetes API URL while TLS verification is disabled.

AI rationale

Evidence

mw/awareness/index.jsmw/awareness/ha.jsmodules/driver/kubernetes/model/lib.jsmodules/driver/kubernetes/model/index.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest contains only a test script and no install lifecycle hook; the entry point starts the controller service.
In high availability mode, awareness uses the Kubernetes driver for service discovery.
The driver takes the API URL, bearer token, and optional CA from deployment configuration.
Without CA configuration, the client sends the bearer token with TLS verification disabled.

Evidence against

The Kubernetes URL and token come from deployment registry configuration, and the client is used for Kubernetes service discovery.
The source shows no unrelated credential recipient or malicious install behavior.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 318 KB of source, external domains: server.com

Source & flagged code

6 flagged

test/unit/mw/key/index.jsView file

Lines 1-37javascript

1"use strict";

3const helper = require("../../../helper.js");

4const mw = helper.requireModule('./mw/key/index');

6describe("Unit test for: mw - key", function () {

7 let req = {

8 "get": () => {

9 return null;

10 },

11 "soajs": {

12 "controller": {"serviceParams": {}},

13 "registry": {

14 "serviceConfig": {

15 "key": {

16 algorithm: "aes256",

17 password: "soajs key lal massa"

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

18 }

19 }

20 },

21 "log": {

22 "error": (err) => {

23 console.log(err);

24 }

25 }

26 }

27 };

28 let res = {};

29 let key = "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9";

30 let keyObj = {

31 "key": "a139786a6e6d18e48b4987e83789430b",

32 "extKey": "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9",

33 "tenant": {"id": "10d2cb5fc04ce51e06000001", "code": "DBTN", "locked": true},

34 "application": {

35 "product": "DSBRD",

36 "package": "DSBRD_GUEST",

37 "appId": "5c0e74ba9acc3c5a84a5125a",

Lines 158-198javascript

158 "users": {

159 "AVAPP_EXMPL": "AVAPP_ALTRN"

160 }

161 }

162 }

163 }

164 }

165 }

166 };

167

168

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

mw/cache/index.jsView file

Lines 92-132javascript

92 }

94 const serviceConfig = cacheConfig.services && cacheConfig.services[serviceName];

95 if (!serviceConfig || !serviceConfig.enabled) {

96 return next

test/data/provision/urac/users/owner.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in test/data/provision/urac/users/owner.js

test/data/provision/urac/users/owner.jsView on unpkg · L6

package.jsonView file

17"scripts": { "test": "grunt test" }, "dependencies": { "async": "3.2.6", "connect":

Medium

Suspicious Lifecycle Evidence

The manifest contains only a test script and no install lifecycle hook; the entry point starts the controller service.

package.jsonView on unpkg · L17

Source & flagged code

6 flagged · loading source

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

Findings

7 Medium5 Low

MediumSecret Patterntest/unit/mw/key/index.js

MediumDynamic RequireGruntfile.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntest/unit/mw/key/index.js

MediumSecret Patterntest/data/provision/urac/users/owner.js

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowWeak Cryptomw/cache/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to soajs.controller@4.3.17.

See all versions of soajs.controller for other recorded verdicts.

Review the evidence and your use of soajs.controller@4.3.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 21:36:15.133Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.