registry / streetjs / 1.1.3

streetjs@1.1.3

Production-grade TypeScript backend framework. Native PostgreSQL wire driver, JWT, WebSockets, clustering, runtime input validation, field-level encryption, abuse prevention, moderation & privacy controls. No Express. No pg. No Prisma. 3 dependencies.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 167 file(s), 1.58 MB of source, external domains: accounts.google.com, api.anthropic.com, api.github.com, api.openai.com, api.sendgrid.com, api.stripe.com, api.twilio.com, app.example.com, github.com, login.microsoftonline.com, oauth2.googleapis.com, registry.streetjs.dev, secretmanager.googleapis.com, www.googleapis.com

Source & flagged code

7 flagged

dist/database/sqlite/sqlite3-node.mjsView file

Lines 10388-10450javascript

10388 capi.SQLITE_MISUSE,

10389 'Do not call the Stmt constructor directly. Use DB.prepare().',

10390 );

10391 }

10392 this.db = arguments[0];

10393 __ptrMap.set(this

Source & flagged code

7 flagged · loading source

dist/database/sqlite/sqlite3-node.mjsView file

10430default: L10431: toss3('Invalid argument count for exec().'); L10432: }

High

Child Process

Package source references child process execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10430

10408L10409: const parseExecArgs = function (db, args) { L10410: const out = Object.create(null);

High

Shell

Package source references shell execution.

dist/database/sqlite/sqlite3-node.mjsView on unpkg · L10408

dist/microservices/http2.jsView file

11function buildFakeIncomingMessage(headers, stream, body) { L12: const { Readable } = require('node:stream'); L13: const readable = Readable.from([body]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/microservices/http2.jsView on unpkg · L11

dist/database/mysql/auth-scramble.jsView file

28const sha1 = (data) => createHash('sha1').update(data).digest(); L29: const pw = Buffer.from(password, 'utf8'); L30: const hash1 = sha1(pw); // SHA1(password)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/database/mysql/auth-scramble.jsView on unpkg · L28

dist/cloud/secret-providers.jsView file

8import { createHmac } from 'node:crypto'; L9: import { request as httpsRequest } from 'node:https'; L10: import { request as httpRequest } from 'node:http'; ... L48: res.on('end', () => { L49: resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }); L50: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cloud/secret-providers.jsView on unpkg · L8

dist/dev/watcher.jsView file

109return new Promise((resolve) => { L110: const tsc = spawn('npx', ['tsc', '--incremental'], { L111: stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev/watcher.jsView on unpkg · L109

dist/database/sqlite/sqlite3.wasmView file

•path = dist/database/sqlite/sqlite3.wasm kind = wasm_module sizeBytes = 850827 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/database/sqlite/sqlite3.wasmView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processdist/database/sqlite/sqlite3-node.mjs

HighShelldist/database/sqlite/sqlite3-node.mjs

HighCloud Metadata Accessdist/cloud/secret-providers.js

HighRuntime Package Installdist/dev/watcher.js

MediumDynamic Requiredist/microservices/http2.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/database/sqlite/sqlite3.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/database/mysql/auth-scramble.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/microservices/http2.jsView file

Lines 1-31javascript

1// src/microservices/http2.ts

2// HTTP/2 app wrapper using node:http2 createSecureServer.

3// Returns a StreetApp-compatible interface.

4import { createSecureServer } from 'node:http2';

5import { Router, notFoundHandler, errorHandler } from '../router/router.js';

6import { createContext } from '../core/context.js';

7import { container } from '../core/container.js';

8import { getControllerMeta, getRoutesMeta } from '../core/decorators.js';

9import { generateOpenApi } from '../http/openapi.js';

10// ── Adapter: Http2Stream → IncomingMessage-like ────────────────────────────────

11function buildFakeIncomingMessage(headers, stream, body) {

12 const { Readable } = require('node:stream');

13 const readable = Readable.from([body]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/microservices/http2.jsView on unpkg · L11

14 Object.defineProperties(readable, {

15 method: { value: String(headers[':method'] ?? 'GET').toUpperCase(), writable: false },

16 url: { value: String(headers[':path'] ?? '/'), writable: false },

17 headers: { value: headers, writable: false },

18 socket: { value: stream.session?.socket ?? null, writable: false },

19 });

20 return readable;

21}

22function buildFakeServerResponse(stream) {

23 let statusCode = 200;

24 const resHeaders = {};

25 let ended = false;

26 const fakeRes = {

27 statusCode,

28 writableEnded: false,

29 setHeader(name, value) {

30 resHeaders[name.toLowerCase()] = value;

31 },

dist/database/mysql/auth-scramble.jsView file

Lines 8-48javascript

8// password with SHA1/SHA256 to produce the handshake response. They are NOT

9// at-rest password storage, and the algorithms cannot be changed without breaking

10// authentication against a real MySQL server.

11//

12// CodeQL's `js/insufficient-password-hash` query flags these as a false positive

13// (it cannot distinguish a protocol challenge-response from credential storage).

14// These alerts are dismissed ("won't fix") in code scanning. Note that neither

15// inline `// codeql[...]` comments (github/codeql#11427) nor a config `paths-ignore`

16// can suppress them in code: inline comments are not honored, and paths-ignore does

17// not exclude a file that is imported by analyzed code (wire.ts imports this module).

18// The js/insufficient-password-hash rule therefore stays active repo-wide, so it

19// still protects real password storage (e.g. the PBKDF2 hashing in

20// packages/core/src/services/user.service.ts) and any future insecure additions.

21import { createHash } from 'node:crypto';

22/**

23 * Compute mysql_native_password response:

24 * SHA1(password) XOR SHA1(seed + SHA1(SHA1(password)))

25 * @internal

26 */

27export function nativePasswordHash(password, seed) {

28 const sha1 = (data) => createHash('sha1').update(data).digest();

29 const pw = Buffer.from(password, 'utf8');

30 const hash1 = sha1(pw); // SHA1(password)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/database/mysql/auth-scramble.jsView on unpkg · L28

31 const hash2 = sha1(hash1); // SHA1(SHA1(password))

32 const combined = Buffer.concat([seed, hash2]); // seed + SHA1(SHA1(password))

33 const hash3 = sha1(combined); // SHA1(seed + SHA1(SHA1(password)))

34 // XOR hash1 with hash3

35 const result = Buffer.allocUnsafe(20);

36 for (let i = 0; i < 20; i++) {

37 result[i] = hash1[i] ^ hash3[i];

38 }

39 return result;

40}

41/**

42 * Compute caching_sha2_password challenge response:

43 * XOR(SHA256(password), SHA256(SHA256(SHA256(password)) + seed))

44 *

45 * An empty password yields an empty (zero-length) response, matching the

46 * MySQL client protocol — the server treats an empty scramble as "no password".

47 * @internal

48 */

dist/cloud/secret-providers.jsView file

Lines 1-28javascript

1// src/cloud/secret-providers.ts

2// Secret providers for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault,

3// and GCP Secret Manager. All providers share an in-memory cache with TTL, an

4// exponential-backoff startup retry, and never log raw secret values.

5//

6// All network access is over node:https (or node:http for plain-HTTP dev/test

7// endpoints such as a local Vault or LocalStack), with no cloud SDK dependency.

8import { createHmac } from 'node:crypto';

9import { request as httpsRequest } from 'node:https';

10import { request as httpRequest } from 'node:http';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cloud/secret-providers.jsView on unpkg · L8

11import { EventEmitter } from 'node:events';

12const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes

13// A fetch error that knows whether retrying could help. 4xx responses (auth,

14// not-found, bad request) are not retried; network errors and 5xx/429 are.

15class SecretFetchError extends Error {

16 retryable;

17 constructor(message, retryable) {

18 super(message);

19 this.retryable = retryable;

20 this.name = 'SecretFetchError';

21 }

22}

23function isRetryable(err) {

24 if (err instanceof SecretFetchError)

25 return err.retryable;

26 return true; // network/transport errors are retryable

27}

28function httpRequestRaw(method, url, extraHeaders, body, tls) {

dist/dev/watcher.jsView file

Lines 89-129javascript

89 return;

90 }

91 const ok = await this.compile();

92 if (ok) {

93 await this.restartServer();

94 }

95 }

96 /**

97 * Run `tsc --incremental` as a child process.

98 * Streams stdout/stderr to the terminal.

99 *

100 * @returns `true` on exit code 0, `false` otherwise.

101 * When compilation fails the previous server is intentionally kept

102 * running so the developer can continue to use it.

103 */

104 async compile() {

105 if (this.compiling)

106 return false;

107 this.compiling = true;

108 process.stderr.write('[dev] Compiling TypeScript (--incremental)…\n');

109 return new Promise((resolve) => {

110 const tsc = spawn('npx', ['tsc', '--incremental'], {

111 stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev/watcher.jsView on unpkg · L109

112 shell: false,

113 });

114 tsc.stdout?.on('data', (chunk) => {

115 process.stdout.write(chunk);

116 });

117 tsc.stderr?.on('data', (chunk) => {

118 process.stderr.write(chunk);

119 });

120 tsc.on('close', (code) => {

121 this.compiling = false;

122 const success = code === 0;

123 if (success) {

124 process.stderr.write('[dev] Compilation succeeded.\n');

125 }

126 else {

127 process.stderr.write(`[dev] Compilation failed (exit ${code ?? 'null'}) — keeping previous server alive.\n`);

128 }

129 resolve(success);