registry / strapi-content-sync-pro / 1.0.8

strapi-content-sync-pro@1.0.8

Strapi v5 plugin to copy, migrate, and live-sync content, media, and data between multiple Strapi environments with bi-directional sync, field-level policies, scheduling, and alerts.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

An authenticated Strapi administrator can configure the media rsync executable, then invoke the media test or sync path. This is a package feature but provides local process execution through configuration.

Static reason

No blocking static signals were detected.

Trigger

Administrator updates media settings and calls the media test/sync endpoint.

Impact

Local command execution in the Strapi process context; remote-login can also create a persistent full-access token on the administrator-selected Strapi host.

Mechanism

Configured executable launched with child_process.spawn

Rationale

No covert malware chain was found, but administrator-controlled executable selection creates a concrete local process-execution capability. Flag for warning rather than block because activation is explicit runtime configuration, not install-time or stealth behavior.

Evidence

package.jsonserver/src/bootstrap.jsserver/src/routes/index.jsserver/src/services/sync-media.jsserver/src/controllers/config.jsserver/src/services/config.jsserver/src/services/alerts.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

strapi-content-sync-pro@1.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code