registry / storemw-core-api / 1.0.180

storemw-core-api@1.0.180

Storemw Core Api

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 396 file(s), 1.51 MB of source, external domains: storage.googleapis.com

Source & flagged code

6 flagged

dist/services/one_time_code/OneTimeCodeService.jsView file

Lines 2-42javascript

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.OneTimeCodeService = exports.oneTimeCodePurposeTypes = exports.oneTimeCodeStatus = exports.oneTimeCodeTypes = void 0;

7const models_1 = require("../../models");

8const crypto_1 = __importDefault(require("crypto"));

9const utils_1 = require("../../utils");

10const lib_1 = require("../../lib");

11const utils_2 = require("../../utils");

12exports.oneTimeCodeTypes = {

13 token: "token",

14 otp: "otp"

15};

16exports.oneTimeCodeStatus = {

17 active: "active",

18 used: "used",

19 revoked: "revoked"

20};

21exports.oneTimeCodePurposeTypes = {

22 reset_password: "reset_password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/one_time_code/OneTimeCodeService.jsView on unpkg · L22

23 signup_account: "signup_account"

24};

25const getCreatePayload = async (fieldRef, fieldModule, data, code) => {

26 let expiredAt = data?.expiredAt ?? "";

27 if (!expiredAt) {

28 // Set expiration 15 minutes from now - Default

29 expiredAt = (0, utils_1.dayjs)().add(15, "minute").toDate(); // convert to JS Date

30 }

31 return {

32 [`${models_1.ModelOneTimeCodeFields.code_type}`]: data.codeType,

33 [`${models_1.ModelOneTimeCodeFields.code}`]: code,

34 [`${models_1.ModelOneTimeCodeFields.expires_at}`]: expiredAt,

35 [`${models_1.ModelOneTimeCodeFields.mobile_number}`]: data.mobileNumber ?? "",

36 [`${models_1.ModelOneTimeCodeFields.email_address}`]: data.emailAddress ?? "",

37 [`${models_1.ModelOneTimeCodeFields.field_ref}`]: fieldRef,

38 [`${models_1.ModelOneTimeCodeFields.field_module}`]: fieldModule,

39 [`${models_1.ModelOneTimeCodeFields.user_id}`]: data?.userId ?? 0,

40 [`${models_1.ModelOneTimeCodeFields.user_type}`]: data?.userType ?? "",

41 [`${models_1.ModelOneTimeCodeFields.code_status}`]: exports.oneTimeCodeStatus.active,

42 [`${models_1.ModelOneTimeCodeFields.purpose_type}`]: data.purposeType ?? ""

dist/scripts/migrate_core.jsView file

Lines 1-41javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

package.jsonView file

Lines 103-143json

103 "./schema/middleware/request": {

104 "import": "./dist/schema/middleware/request/index.js",

105 "require": "./dist/schema/middleware/request/index.js",

106 "types": "./dist/schema/middleware/request/index.d.ts"

107 },

108 "./schema/middleware/route": {

109 "import": "./dist/schema/middleware/route/index.js"

dist/models/user/UserModel.d.tsView file

Lines 1-36typescript

1import { users, Prisma } from "@prisma/client";

2import { DefaultOmitFields } from "../../lib";

3import { DefaultServiceProps } from "../../utils";

4declare const primaryKey = "user_id";

5export declare

dist/services/one_time_code/OneTimeCodeService.d.tsView file

Lines 1-38typescript

1import { QueryList, QueryGet } from "../../schema/common";

2import { InjectionFieldModuleRef } from "../../services";

3import { DefaultServiceProps } from "../../utils";

4export type OneTimeCodeModuleRef = InjectionFieldModuleRef;

5export

Source & flagged code

6 flagged · loading source

dist/services/one_time_code/OneTimeCodeService.jsView file

22patternName = generic_password severity = medium line = 22 matchedText = reset_pa...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/one_time_code/OneTimeCodeService.jsView on unpkg · L22

dist/scripts/migrate_core.jsView file

5Object.defineProperty(exports, "__esModule", { value: true }); L6: const child_process_1 = require("child_process"); L7: const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/scripts/migrate_core.jsView on unpkg · L5

24// 2. generate SQL from core schema — no DB needed L25: (0, child_process_1.execSync)(`npx prisma migrate diff --from-empty --to-schema-datamodel "${corePrismaSchema}" --script > "${migrationFile}"`, { L26: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/migrate_core.jsView on unpkg · L24

package.jsonView file

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/models/user/UserModel.d.tsView file

16patternName = generic_password severity = medium line = 16 matchedText = login_pa...rd";

Medium

Secret Pattern

Hardcoded password in dist/models/user/UserModel.d.ts

dist/models/user/UserModel.d.tsView on unpkg · L16

dist/services/one_time_code/OneTimeCodeService.d.tsView file

18patternName = generic_password severity = medium line = 18 matchedText = readonly...rd";

Medium

Secret Pattern

Hardcoded password in dist/services/one_time_code/OneTimeCodeService.d.ts

dist/services/one_time_code/OneTimeCodeService.d.tsView on unpkg · L18

Findings

3 High5 Medium4 Low

HighChild Processdist/scripts/migrate_core.js

HighRuntime Package Installdist/scripts/migrate_core.js

HighNode Builtin Dependency Squatpackage.json

MediumSecret Patterndist/services/one_time_code/OneTimeCodeService.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/models/user/UserModel.d.ts

MediumSecret Patterndist/services/one_time_code/OneTimeCodeService.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings