registry / soajs.controller / 4.3.19
soajs.controller@4.3.19
soajs multi tenant API gateway
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe no-CA Kubernetes connection path disables TLS verification while transmitting a bearer token, creating a concrete security risk. This supports a warning for a critical vulnerability, but the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The application connects to a configured Kubernetes cluster without CA configuration.
Impact
A party able to intercept the connection could impersonate the cluster endpoint and capture the token.
Mechanism
The driver attaches the bearer token to a request and sets insecureSkipTlsVerify to true.
AI rationale
The no-CA Kubernetes connection path disables TLS verification while transmitting a bearer token, creating a concrete security risk. This supports a warning for a critical vulnerability, but the inspected source does not establish malicious behavior.
Evidence
modules/registry/mongo.jsmodules/driver/kubernetes/model/index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The package manifest defines only a test script and declares the Kubernetes client dependency.
- Registry configuration supplies a Kubernetes URL and bearer token to the driver.
- When CA configuration is absent, the driver sends the bearer token with TLS verification disabled.
Evidence against
- The flagged registry code loads configured container deployment settings; the manifest shows no install lifecycle hook.
- The insecure transport branch is part of the package’s Kubernetes integration, not evidence of credential theft or unrelated code execution.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcetest/unit/mw/key/index.jsView file
17patternName = generic_password
severity = medium
line = 17
Medium
Secret Pattern
Package contains a possible secret pattern.
test/unit/mw/key/index.jsView on unpkg · L17178patternName = generic_password
severity = medium
line = 178
Medium
Secret Pattern
Hardcoded password in test/unit/mw/key/index.js
test/unit/mw/key/index.jsView on unpkg · L178Gruntfile.jsView file
10L11: const fs = require('fs');
L12: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Gruntfile.jsView on unpkg · L10Findings
1 High6 Medium5 Low
HighKnown Malware Source Similaritymodules/registry/mongo.js
MediumSecret Patterntest/unit/mw/key/index.js
MediumDynamic RequireGruntfile.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterntest/unit/mw/key/index.js
MediumSecret Patterntest/data/provision/urac/users/owner.js
LowScripts Present
LowWeak Cryptomw/cache/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to soajs.controller@4.3.19.
See all versions of soajs.controller for other recorded verdicts.
- Review the evidence and your use of soajs.controller@4.3.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.