registry / torollo / 1.2.0

torollo@1.2.0

Interactive visual system design learning lab and container supervisor.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 1.39 MB of source, external domains: example.com, get.docker.com, github.com, react.dev, reactflow.dev, socket.io, www.docker.com, www.w3.org

Source & flagged code

5 flagged

roadmaps/example-first-architecture.jsonView file

Lines 60-101json

60 }

61 ]

62 },

63 {

64 "id": "lock-down-database",

65 "title": "Lock down the database",

66 "instruction": "A database should only ever be reachable on its own port. Make sure `web` **cannot** reach `db` on port **80**.",

67 "hints": [

68 "Check the inbound rules on `db`: is there anything broader than port 5432, like an ALLOW on all ports or on 0.0.0.0/0?"

69 ],

70 "validators": [

71 {

72 "type": "port_denied",

73 "params": { "source": "web", "target": "db", "port": 80 }

74 }

75 ]

76 },

77 {

78 "id": "run-web-server",

79 "title": "Run a web server querying the database",

80 "instruction": "Connect to the terminal of your `web` node and run the following commands:\n\n1. Install PostgreSQL drivers:\n```bash\napt-get update && apt-get install -y python3-psycopg2\n```\n\n2. Write the server script (`server.py`):\n```bash\ncat << 'EOF' > server.py\nfrom http.server import SimpleHTTPRequestHandler, HTTPServer\nimport psycopg2\nclass DBHandler(SimpleHTTPRequestHandler):\n def do_GET(self):\n self.send_response(200)\n self.send_header('Content-type', 'text/html')\n self.end_headers()\n try:\n conn = psycopg2.connect(host='d ...

Medium

Secret Pattern

Package contains a possible secret pattern.

roadmaps/example-first-architecture.jsonView on unpkg · L80

81 "hints": [

82 "Double-click 'web' and use the Terminal tab to run commands.",

83 "Write your Python web server script using Python's http.server and psycopg2. Connect using host='db', database='postgres', user='postgres', password='postgres'. Example script:\n\n```python\nfrom http.server

84 "Don't forget to open port 80 in inbound rules for the 'web' security group!"

85 ],

86 "solution": "Write the Python script server.py, run 'python3 server.py &', and add an inbound security group rule on 'web' allowing TCP port 80 from 0.0.0.0/0.",

87 "validators": [

88 {

89 "type": "http_get_contains",

90 "params": {

91 "node": "web",

92 "port": 80,

93 "path": "/",

94 "expectedText": "Users List"

95 }

96 }

97 ]

98 }

99 ]

100}

101

Long lines were clipped for display.

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execSync, exec } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5const fs

Source & flagged code

5 flagged · loading source

roadmaps/example-first-architecture.jsonView file

80patternName = generic_password severity = medium line = 80 matchedText = "instruc...).",

Medium

Secret Pattern

Package contains a possible secret pattern.

roadmaps/example-first-architecture.jsonView on unpkg · L80

83patternName = generic_password severity = medium line = 83 matchedText = "Write y...``",

Medium

Secret Pattern

Hardcoded password in roadmaps/example-first-architecture.json

roadmaps/example-first-architecture.jsonView on unpkg · L83

bin/cli.jsView file

2L3: const { execSync, exec } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

115L116: const { spawn } = require('child_process'); L117: L118: const backendProcess = spawn('node', [path.join(backendPath, 'dist/server.js')], { L119: env: { ...process.env, PORT: backendPort }, L120: stdio: 'ignore' ... L130: console.log(`${colors.green}${colors.bold}[*] Torollo System Lab is ready!${colors.reset}`); L131: console.log(`${colors.cyan}[>] Access it here: ${colors.reset}${colors.bold}http://localhost:${frontendPort}${colors.reset}`); L132: console.log(`${colors.cyan}================================================${colors.reset}\n`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L115

2L3: const { execSync, exec } = require('child_process'); L4: const path = require('path'); L5: const fs = require('fs'); L6: const net = require('net'); L7: // concurrently removed ... L13: function openUrl(url) { L14: const start = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start ""' : 'xdg-open'; L15: exec(`${start} ${url}`); ... L94: L95: const backendPath = path.join(__dirname, '../backend'); L96: const frontendPath = path.join(__dirname, '../frontend');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L2

Findings

4 High5 Medium5 Low

HighChild Processbin/cli.js

HighShell

HighSame File Env Network Executionbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

MediumSecret Patternroadmaps/example-first-architecture.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternroadmaps/example-first-architecture.json

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

roadmaps/example-first-architecture.jsonView file

Lines 60-101json

60 }

61 ]

62 },

63 {

64 "id": "lock-down-database",

65 "title": "Lock down the database",

66 "instruction": "A database should only ever be reachable on its own port. Make sure `web` **cannot** reach `db` on port **80**.",

67 "hints": [

68 "Check the inbound rules on `db`: is there anything broader than port 5432, like an ALLOW on all ports or on 0.0.0.0/0?"

69 ],

70 "validators": [

71 {

72 "type": "port_denied",

73 "params": { "source": "web", "target": "db", "port": 80 }

74 }

75 ]

76 },

77 {

78 "id": "run-web-server",

79 "title": "Run a web server querying the database",

Medium

Secret Pattern

Package contains a possible secret pattern.

roadmaps/example-first-architecture.jsonView on unpkg · L80

81 "hints": [

82 "Double-click 'web' and use the Terminal tab to run commands.",

84 "Don't forget to open port 80 in inbound rules for the 'web' security group!"

85 ],

86 "solution": "Write the Python script server.py, run 'python3 server.py &', and add an inbound security group rule on 'web' allowing TCP port 80 from 0.0.0.0/0.",

87 "validators": [

88 {

89 "type": "http_get_contains",

90 "params": {

91 "node": "web",

92 "port": 80,

93 "path": "/",

94 "expectedText": "Users List"

95 }

96 }

97 ]

98 }

99 ]

100}

101

Long lines were clipped for display.

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execSync, exec } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5const fs

Lines 95-135javascript

95 const backendPath = path.join(__dirname, '../backend');

96 const frontendPath = path.join(__dirname, '../frontend');

98 (async () => {

99 try {

100 const frontendPort = await findAvailablePort(23232);

101 const backendPort = await findAvailablePort(frontendPort + 1);

102

103 const envContent = `window.TOROLLO_BACKEND_PORT = ${backendPort};`;

104

105 // Ensure directory structures exist before writing env.js

106 const publicPath = path.join(frontendPath, 'public');

107 if (fs.existsSync(publicPath)) {

108 fs.writeFileSync(path.join(publicPath, 'env.js'), envContent);

109 }

110

111 const distPath = path.join(frontendPath, 'dist');

112 if (fs.existsSync(distPath)) {

113 fs.writeFileSync(path.join(distPath, 'env.js'), envContent);

114 }

115

116 const { spawn } = require('child_process');

117

118 const backendProcess = spawn('node', [path.join(backendPath, 'dist/server.js')], {

119 env: { ...process.env, PORT: backendPort },

120 stdio: 'ignore'

121 });

122

123 const servePath = require.resolve('serve/build/main.js');

124 const frontendProcess = spawn('node', [servePath, '-s', 'dist', '-l', frontendPort], {

125 cwd: frontendPath,

126 stdio: 'ignore'

127 });

128

129 console.log(`${colors.cyan}================================================${colors.reset}`);

130 console.log(`${colors.green}${colors.bold}[*] Torollo System Lab is ready!${colors.reset}`);

131 console.log(`${colors.cyan}[>] Access it here: ${colors.reset}${colors.bold}http://localhost:${frontendPort}${colors.reset}`);

132 console.log(`${colors.cyan}================================================${colors.reset}\n`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L115

133

134 // Automatically open browser tab

135 setTimeout(() => {