registry / solarch / 0.15.0

solarch@0.15.0

Solarch - a TypeScript backend-as-a-service with SQLite, auth, realtime, and admin UI. Inspired by PocketBase.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 78 file(s), 619 KB of source, external domains: accounts.google.com, api.anthropic.com, api.github.com, api.openai.com, appleid.apple.com, discord.com, github.com, graph.facebook.com, oauth2.googleapis.com, openidconnect.googleapis.com, reactjs.org, www.facebook.com, www.googleapis.com, www.w3.org

Source & flagged code

1 flagged

dist/cmd/superuser.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createSuperuser = createSuperuser;

4exports.hasSuperuser = hasSuperuser;

5const base_1 = require("../core/base");

6const crypto_1 = require("../tools/security/crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cmd/superuser.jsView on unpkg · L4

7const crypto_2 = require("crypto");

8// FIXED[M-4]: Mask password input with * characters

9async function silentQuestion(prompt) {

10 return new Promise((resolve) => {

11 process.stdout.write(prompt);

12 const stdin = process.stdin;

13 const wasRaw = stdin.isRaw;

14 stdin.setRawMode(true);

15 stdin.resume();

16 const buf = [];

17 const onData = (data) => {

18 const char = data.toString();

19 if (char === '\r' || char === '\n') {

20 stdin.setRawMode(wasRaw);

21 stdin.pause();

22 stdin.removeListener('data', onData);

23 process.stdout.write('\n');

24 resolve(buf.join(''));

Source & flagged code

1 flagged · loading source

dist/cmd/superuser.jsView file

4exports.hasSuperuser = hasSuperuser; L5: const base_1 = require("../core/base"); L6: const crypto_1 = require("../tools/security/crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cmd/superuser.jsView on unpkg · L4

Findings

4 Medium5 Low

MediumDynamic Requiredist/cmd/superuser.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/cmd/superuser.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createSuperuser = createSuperuser;

4exports.hasSuperuser = hasSuperuser;

5const base_1 = require("../core/base");

6const crypto_1 = require("../tools/security/crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cmd/superuser.jsView on unpkg · L4

7const crypto_2 = require("crypto");

8// FIXED[M-4]: Mask password input with * characters

9async function silentQuestion(prompt) {

10 return new Promise((resolve) => {

11 process.stdout.write(prompt);

12 const stdin = process.stdin;

13 const wasRaw = stdin.isRaw;

14 stdin.setRawMode(true);

15 stdin.resume();

16 const buf = [];

17 const onData = (data) => {

18 const char = data.toString();

19 if (char === '\r' || char === '\n') {

20 stdin.setRawMode(wasRaw);

21 stdin.pause();

22 stdin.removeListener('data', onData);

23 process.stdout.write('\n');

24 resolve(buf.join(''));