registry / streetjs / 1.0.27

streetjs@1.0.27

Production-grade TypeScript backend framework. Native PostgreSQL wire driver, JWT, WebSockets, clustering, runtime input validation, field-level encryption, abuse prevention, moderation & privacy controls. No Express. No pg. No Prisma. 3 dependencies.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 167 file(s), 1.58 MB of source, external domains: accounts.google.com, api.anthropic.com, api.github.com, api.openai.com, api.sendgrid.com, api.stripe.com, api.twilio.com, app.example.com, github.com, login.microsoftonline.com, oauth2.googleapis.com, registry.streetjs.dev, secretmanager.googleapis.com, www.googleapis.com

Source & flagged code

7 flagged

dist/database/sqlite/sqlite3-node.mjsView file

Lines 10388-10450javascript

10388 capi.SQLITE_MISUSE,

10389 'Do not call the Stmt constructor directly. Use DB.prepare().',

10390 );

10391 }

10392 this.db = arguments[0];

10393 __ptrMap.set(this, arguments[1]);

10394 this.parameterCount = capi.sqlite3_bind_parameter_count(this.pointer);

10395 };

10396

10397 const affirmDbOpen = function (db) {

10398 if (!db.pointer) toss3('DB has been closed.');

10399 return db;

10400 };

10401

10402 const affirmColIndex = function (stmt, ndx) {

10403 if (ndx !== (ndx | 0) || ndx < 0 || ndx >= stmt.columnCount) {

10404 toss3('Column index', ndx, 'is out of range.');

10405 }

10406 return stmt;

10407 };

10408

10409 const parseExecArgs = function (db, args) {

10410 const out = Object.create(null);

High

Shell

Package source references shell execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10408

10411 out.opt = Object.create(null);

10412 switch (args.length) {

10413 case 1:

10414 if (

10415 'string' === typeof args[0] ||

10416 util.isSQLableTypedArray(args[0])

10417 ) {

10418 out.sql = args[0];

10419 } else if (Array.isArray(args[0])) {

10420 out.sql = args[0];

10421 } else if (args[0] && 'object' === typeof args[0]) {

10422 out.opt = args[0];

10423 out.sql = out.opt.sql;

10424 }

10425 break;

10426 case 2:

10427 out.sql = args[0];

10428 out.opt = args[1];

10429 break;

10430 default:

10431 toss3('Invalid argument count for exec().');

10432 }

High

Child Process

Package source references child process execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10430

10433 out.sql = util.flexibleString(out.sql);

10434 if ('string' !== typeof out.sql) {

10435 toss3('Missing SQL argument or unsupported SQL value type.');

10436 }

10437 const opt = out.opt;

10438 switch (opt.returnValue) {

10439 case 'resultRows':

10440 if (!opt.resultRows) opt.resultRows = [];

10441 out.returnVal = () => opt.resultRows;

10442 break;

10443 case 'saveSql':

10444 if (!opt.saveSql) opt.saveSql = [];

10445 out.returnVal = () => opt.saveSql;

10446 break;

10447 case undefined:

10448 case 'this':

10449 out.returnVal = () => db;

10450 break;

dist/microservices/http2.jsView file

Lines 1-31javascript

1// src/microservices/http2.ts

2// HTTP/2 app wrapper using node:http2 createSecureServer.

3// Returns a StreetApp-compatible interface.

4import { createSecureServer } from 'node:http2';

5import { Router, notFoundHandler, errorHandler } from '../router/router.js';

6import { createContext } from '../core/context.js';

7import { container } from

dist/database/mysql/auth-scramble.jsView file

Lines 8-48javascript

8// password with SHA1/SHA256 to produce the handshake response. They are NOT

9// at-rest password storage, and the algorithms cannot be changed without breaking

10// authentication against a real MySQL server.

11//

12// CodeQL's `js/insufficient-password-hash` query flags these as a false positive

13// (it cannot distinguish a protocol challenge-response from credential storage).

14// These alerts are dismissed ("won't fix") in code scanning. Note that neither

15// inline `// codeql[...]` comments (github/codeql#11427) nor a config `paths-ignore`

16// can suppress them in code: inline comments are not honored, and paths-ignore does

17// not exclude a file that is imported by analyzed code (wire.ts imports this module).

dist/cloud/secret-providers.jsView file

Lines 1-28javascript

1// src/cloud/secret-providers.ts

2// Secret providers for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault,

3// and GCP Secret Manager. All providers share an in-memory cache with TTL, an

4// exponential-backoff startup retry, and never log raw secret values.

5//

6// All network access is over node:https (or node:http for plain-HTTP dev/test

7// endpoints such as a local Vault or LocalStack), with no cloud SDK dependency.

8import { createHmac } from 'node:crypto';

9import { request as httpsRequest }

dist/dev/watcher.jsView file

Lines 89-129javascript

89 return;

90 }

91 const ok = await this.compile();

92 if (ok) {

93 await this.restartServer();

94 }

dist/database/sqlite/sqlite3.wasmView file

•path = dist/database/sqlite/sqlite3.wasm kind = wasm_module sizeBytes = 850827 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/database/sqlite/sqlite3.wasmView on unpkg

Source & flagged code

7 flagged · loading source

dist/database/sqlite/sqlite3-node.mjsView file

10430default: L10431: toss3('Invalid argument count for exec().'); L10432: }

High

Child Process

Package source references child process execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10430

10408L10409: const parseExecArgs = function (db, args) { L10410: const out = Object.create(null);

High

Shell

Package source references shell execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10408

dist/microservices/http2.jsView file

11function buildFakeIncomingMessage(headers, stream, body) { L12: const { Readable } = require('node:stream'); L13: const readable = Readable.from([body]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/microservices/http2.jsView on unpkg · L11

dist/database/mysql/auth-scramble.jsView file

28const sha1 = (data) => createHash('sha1').update(data).digest(); L29: const pw = Buffer.from(password, 'utf8'); L30: const hash1 = sha1(pw); // SHA1(password)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/database/mysql/auth-scramble.jsView on unpkg · L28

dist/cloud/secret-providers.jsView file

8import { createHmac } from 'node:crypto'; L9: import { request as httpsRequest } from 'node:https'; L10: import { request as httpRequest } from 'node:http'; ... L48: res.on('end', () => { L49: resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }); L50: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cloud/secret-providers.jsView on unpkg · L8

dist/dev/watcher.jsView file

109return new Promise((resolve) => { L110: const tsc = spawn('npx', ['tsc', '--incremental'], { L111: stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev/watcher.jsView on unpkg · L109

dist/database/sqlite/sqlite3.wasmView file

•path = dist/database/sqlite/sqlite3.wasm kind = wasm_module sizeBytes = 850827 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/database/sqlite/sqlite3.wasmView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processdist/database/sqlite/sqlite3-node.mjs

HighShelldist/database/sqlite/sqlite3-node.mjs

HighCloud Metadata Accessdist/cloud/secret-providers.js

HighRuntime Package Installdist/dev/watcher.js

MediumDynamic Requiredist/microservices/http2.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/database/sqlite/sqlite3.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/database/mysql/auth-scramble.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/database/sqlite/sqlite3-node.mjsView file

Lines 10388-10450javascript

10388 capi.SQLITE_MISUSE,

10389 'Do not call the Stmt constructor directly. Use DB.prepare().',

10390 );

10391 }

10392 this.db = arguments[0];

10393 __ptrMap.set(this, arguments[1]);

10394 this.parameterCount = capi.sqlite3_bind_parameter_count(this.pointer);

10395 };

10396

10397 const affirmDbOpen = function (db) {

10398 if (!db.pointer) toss3('DB has been closed.');

10399 return db;

10400 };

10401

10402 const affirmColIndex = function (stmt, ndx) {

10403 if (ndx !== (ndx | 0) || ndx < 0 || ndx >= stmt.columnCount) {

10404 toss3('Column index', ndx, 'is out of range.');

10405 }

10406 return stmt;

10407 };

10408

10409 const parseExecArgs = function (db, args) {

10410 const out = Object.create(null);

High

Shell

Package source references shell execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10408

10411 out.opt = Object.create(null);

10412 switch (args.length) {

10413 case 1:

10414 if (

10415 'string' === typeof args[0] ||

10416 util.isSQLableTypedArray(args[0])

10417 ) {

10418 out.sql = args[0];

10419 } else if (Array.isArray(args[0])) {

10420 out.sql = args[0];

10421 } else if (args[0] && 'object' === typeof args[0]) {

10422 out.opt = args[0];

10423 out.sql = out.opt.sql;

10424 }

10425 break;

10426 case 2:

10427 out.sql = args[0];

10428 out.opt = args[1];

10429 break;

10430 default:

10431 toss3('Invalid argument count for exec().');

10432 }

High

Child Process

Package source references child process execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10430

10433 out.sql = util.flexibleString(out.sql);

10434 if ('string' !== typeof out.sql) {

10435 toss3('Missing SQL argument or unsupported SQL value type.');

10436 }

10437 const opt = out.opt;

10438 switch (opt.returnValue) {

10439 case 'resultRows':

10440 if (!opt.resultRows) opt.resultRows = [];

10441 out.returnVal = () => opt.resultRows;

10442 break;

10443 case 'saveSql':

10444 if (!opt.saveSql) opt.saveSql = [];

10445 out.returnVal = () => opt.saveSql;

10446 break;

10447 case undefined:

10448 case 'this':

10449 out.returnVal = () => db;

10450 break;

dist/microservices/http2.jsView file

Lines 1-31javascript

1// src/microservices/http2.ts

2// HTTP/2 app wrapper using node:http2 createSecureServer.

3// Returns a StreetApp-compatible interface.

4import { createSecureServer } from 'node:http2';

5import { Router, notFoundHandler, errorHandler } from '../router/router.js';

6import { createContext } from '../core/context.js';

7import { container } from

dist/database/mysql/auth-scramble.jsView file

Lines 8-48javascript

8// password with SHA1/SHA256 to produce the handshake response. They are NOT

9// at-rest password storage, and the algorithms cannot be changed without breaking

10// authentication against a real MySQL server.

11//

12// CodeQL's `js/insufficient-password-hash` query flags these as a false positive

13// (it cannot distinguish a protocol challenge-response from credential storage).

14// These alerts are dismissed ("won't fix") in code scanning. Note that neither

15// inline `// codeql[...]` comments (github/codeql#11427) nor a config `paths-ignore`

16// can suppress them in code: inline comments are not honored, and paths-ignore does

17// not exclude a file that is imported by analyzed code (wire.ts imports this module).

dist/cloud/secret-providers.jsView file

Lines 1-28javascript

1// src/cloud/secret-providers.ts

2// Secret providers for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault,

3// and GCP Secret Manager. All providers share an in-memory cache with TTL, an

4// exponential-backoff startup retry, and never log raw secret values.

5//

6// All network access is over node:https (or node:http for plain-HTTP dev/test

7// endpoints such as a local Vault or LocalStack), with no cloud SDK dependency.

8import { createHmac } from 'node:crypto';

9import { request as httpsRequest }

dist/dev/watcher.jsView file

Lines 89-129javascript

89 return;

90 }

91 const ok = await this.compile();

92 if (ok) {

93 await this.restartServer();

94 }

dist/database/sqlite/sqlite3.wasmView file

•path = dist/database/sqlite/sqlite3.wasm kind = wasm_module sizeBytes = 850827 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/database/sqlite/sqlite3.wasmView on unpkg