registry / thelounge / 4.5.2

thelounge@4.5.2

The self-hosted Web IRC client

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 114 file(s), 916 KB of source, external domains: api.github.com, en.wikipedia.org, github.com, modern.ircdocs.horse, next.vuex.vuejs.org, thelounge.chat, user-images.githubusercontent.com, vuejs.org, www.w3.org

Source & flagged code

3 flagged

dist/server/client.jsView file

Lines 8-48javascript

8 Object.defineProperty(o, k2, desc);

9}) : (function(o, m, k, k2) {

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v) {

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || function (mod) {

19 if (mod && mod.__esModule) return mod;

20 var result = {};

21 if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);

22 __setModuleDefault(result, mod);

23 return result;

24};

25var __importDefault = (this && this.__importDefault) || function (mod) {

26 return (mod && mod.__esModule) ? mod : { "default": mod };

27};

28Object.defineProperty(exports, "__esModule", { value: true });

29const lodash_1 = __importDefault(require("lodash"));

30const ua_parser_js_1 = __importDefault(require("ua-parser-js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/client.jsView on unpkg · L28

31const escapeRegExp_1 = __importDefault(require("lodash/escapeRegExp"));

32const crypto_1 = __importDefault(require("crypto"));

33const chalk_1 = __importDefault(require("chalk"));

34const log_1 = __importDefault(require("./log"));

35const chan_1 = __importDefault(require("./models/chan"));

36const msg_1 = __importDefault(require("./models/msg"));

37const config_1 = __importDefault(require("./config"));

38const irc_1 = require("../shared/irc");

39const msg_2 = require("../shared/types/msg");

40const inputs_1 = __importDefault(require("./plugins/inputs"));

41const publicClient_1 = __importDefault(require("./plugins/packages/publicClient"));

42const sqlite_1 = __importDefault(require("./plugins/messageStorage/sqlite"));

43const text_1 = __importDefault(require("./plugins/messageStorage/text"));

44const network_1 = __importDefault(require("./models/network"));

45const storageCleaner_1 = require("./storageCleaner");

46const chan_2 = require("../shared/types/chan");

47const events = [

48 "away",

public/assets/fa-solid-900-BUswJgRo.woff2View file

•path = public/assets/fa-solid-900-BUswJgRo.woff2 kind = high_entropy_blob sizeBytes = 78268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/fa-solid-900-BUswJgRo.woff2View on unpkg

dist/defaults/config.jsView file

Lines 313-353javascript

313 // There are 2 ways to configure the `webirc` setting:

314 //

315 // - **Basic**: an object where keys are IRC hosts and values are passwords.

316 // For example:

317 //

318 // ```json

319 // webirc: {

320 // "irc.example.net": "thisiswebircpassword1",

321 // "irc.example.org": "thisiswebircpassword2",

322

Source & flagged code

3 flagged · loading source

dist/server/client.jsView file

28Object.defineProperty(exports, "__esModule", { value: true }); L29: const lodash_1 = __importDefault(require("lodash")); L30: const ua_parser_js_1 = __importDefault(require("ua-parser-js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/client.jsView on unpkg · L28

public/assets/fa-solid-900-BUswJgRo.woff2View file

•path = public/assets/fa-solid-900-BUswJgRo.woff2 kind = high_entropy_blob sizeBytes = 78268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/fa-solid-900-BUswJgRo.woff2View on unpkg

dist/defaults/config.jsView file

333patternName = generic_password severity = medium line = 333 matchedText = // ...rd";

Medium

Secret Pattern

Hardcoded password in dist/defaults/config.js

dist/defaults/config.jsView on unpkg · L333

Findings

1 High6 Medium4 Low

HighShips High Entropy Blobpublic/assets/fa-solid-900-BUswJgRo.woff2

MediumDynamic Requiredist/server/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumGit Dependency

MediumSecret Patterndist/defaults/config.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/server/client.jsView file

Lines 8-48javascript

8 Object.defineProperty(o, k2, desc);

9}) : (function(o, m, k, k2) {

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v) {

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || function (mod) {

19 if (mod && mod.__esModule) return mod;

20 var result = {};

21 if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);

22 __setModuleDefault(result, mod);

23 return result;

24};

25var __importDefault = (this && this.__importDefault) || function (mod) {

26 return (mod && mod.__esModule) ? mod : { "default": mod };

27};

28Object.defineProperty(exports, "__esModule", { value: true });

29const lodash_1 = __importDefault(require("lodash"));

30const ua_parser_js_1 = __importDefault(require("ua-parser-js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/client.jsView on unpkg · L28

31const escapeRegExp_1 = __importDefault(require("lodash/escapeRegExp"));

32const crypto_1 = __importDefault(require("crypto"));

33const chalk_1 = __importDefault(require("chalk"));

34const log_1 = __importDefault(require("./log"));

35const chan_1 = __importDefault(require("./models/chan"));

36const msg_1 = __importDefault(require("./models/msg"));

37const config_1 = __importDefault(require("./config"));

38const irc_1 = require("../shared/irc");

39const msg_2 = require("../shared/types/msg");

40const inputs_1 = __importDefault(require("./plugins/inputs"));

41const publicClient_1 = __importDefault(require("./plugins/packages/publicClient"));

42const sqlite_1 = __importDefault(require("./plugins/messageStorage/sqlite"));

43const text_1 = __importDefault(require("./plugins/messageStorage/text"));

44const network_1 = __importDefault(require("./models/network"));

45const storageCleaner_1 = require("./storageCleaner");

46const chan_2 = require("../shared/types/chan");

47const events = [

48 "away",

public/assets/fa-solid-900-BUswJgRo.woff2View file

•path = public/assets/fa-solid-900-BUswJgRo.woff2 kind = high_entropy_blob sizeBytes = 78268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/fa-solid-900-BUswJgRo.woff2View on unpkg

dist/defaults/config.jsView file

Lines 313-353javascript

313 // There are 2 ways to configure the `webirc` setting:

314 //

315 // - **Basic**: an object where keys are IRC hosts and values are passwords.

316 // For example:

317 //

318 // ```json

319 // webirc: {

320 // "irc.example.net": "thisiswebircpassword1",

321 // "irc.example.org": "thisiswebircpassword2",

322