registry / solarch / 0.15.2

solarch@0.15.2

Solarch - a TypeScript backend-as-a-service with SQLite, auth, realtime, and admin UI. Inspired by PocketBase.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 620 KB of source, external domains: accounts.google.com, api.anthropic.com, api.github.com, api.openai.com, appleid.apple.com, discord.com, github.com, graph.facebook.com, oauth2.googleapis.com, openidconnect.googleapis.com, reactjs.org, www.facebook.com, www.googleapis.com, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.15.2",

4 "description": "Solarch - a TypeScript backend-as-a-service with SQLite, auth, realtime, and admin UI. Inspired by PocketBase.",

5 "repository": "https://github.com/Jay-Suryawansh7/solarch",

6 "homepage": "https://solarch-docs.vercel.app/",

7 "bugs": "https://github.com/Jay-Suryawansh7/solarch/issues",

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cmd/superuser.jsView file

4exports.hasSuperuser = hasSuperuser; L5: const base_1 = require("../core/base"); L6: const crypto_1 = require("../tools/security/crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cmd/superuser.jsView on unpkg · L4

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cmd/superuser.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/cmd/superuser.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createSuperuser = createSuperuser;

4exports.hasSuperuser = hasSuperuser;

5const base_1 = require("../core/base");

6const crypto_1 = require("../tools/security/crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cmd/superuser.jsView on unpkg · L4

7const crypto_2 = require("crypto");

8// FIXED[M-4]: Mask password input with * characters

9async function silentQuestion(prompt) {

10 return new Promise((resolve) => {

11 process.stdout.write(prompt);

12 const stdin = process.stdin;

13 const wasRaw = stdin.isRaw;

14 stdin.setRawMode(true);

15 stdin.resume();

16 const buf = [];

17 const onData = (data) => {

18 const char = data.toString();

19 if (char === '\r' || char === '\n') {

20 stdin.setRawMode(wasRaw);

21 stdin.pause();

22 stdin.removeListener('data', onData);

23 process.stdout.write('\n');

24 resolve(buf.join(''));