soajs.controller@4.3.7

soajs multi tenant API gateway

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 303 KB of source, external domains: server.com

Source & flagged code

6 flagged

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...ssa"

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178 matchedText = password...ssa"

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

mw/cache/index.jsView file

110// Public APIs (no access_token required) return the same response for the whole L111: // tenant, so they are cached per tenant ("tenant"). Private APIs may return a L112: // different response per logged-in user, so they must be cached per tenant + user ... L148: res.writeHead(cached.response.statusCode, cached.response.headers); L149: res.end(cached.response.body); L150: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mw/cache/index.jsView on unpkg · L110

test/data/provision/urac/users/owner.jsView file

6patternName = generic_password severity = medium line = 6 matchedText = password...Pq",

Medium

Secret Pattern

Hardcoded password in test/data/provision/urac/users/owner.js

test/data/provision/urac/users/owner.jsView on unpkg · L6

modules/driver/kubernetes/model/index.jsView file

25patternName = generic_password severity = medium line = 25 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in modules/driver/kubernetes/model/index.js

modules/driver/kubernetes/model/index.jsView on unpkg · L25

Source & flagged code

6 flagged · loading source

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...ssa"

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178 matchedText = password...ssa"

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

Findings

7 Medium5 Low

MediumSecret Patterntest/unit/mw/key/index.js

MediumDynamic RequireGruntfile.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntest/unit/mw/key/index.js

MediumSecret Patterntest/data/provision/urac/users/owner.js

MediumSecret Patternmodules/driver/kubernetes/model/index.js

LowScripts Present

LowWeak Cryptomw/cache/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to soajs.controller@4.3.7.

See all versions of soajs.controller for other recorded verdicts.

Review the evidence and your use of soajs.controller@4.3.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-02 13:09:33.565Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.