registry / waforge / 2.15.3

waforge@2.15.3

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 120 file(s), 286 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.cohere.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, graph.facebook.com, host.docker.internal, huggingface.co, openrouter.ai

Source & flagged code

5 flagged

package.jsonView file

Lines 1-35json

2 "name": "waforge",

3 "version": "2.15.3",

4 "private": false,

5 "engines": {

6 "node": ">=20.0.0",

7 "bun": ">=1.1.0"

8 },

9 "scripts": {

10 "dev": "nuxt dev",

11 "build": "nuxt build",

12 "preview": "nuxt preview",

13 "start": "node .output/server/index.mjs",

14 "lint": "eslint .",

15 "postinstall": "nuxt prepare && prisma generate",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "test": "bun test",

17 "test:e2e": "playwright test",

18 "db:generate": "prisma generate",

19 "db:migrate": "prisma migrate dev",

20 "db:push": "prisma db push",

21 "db:studio": "prisma studio",

22 "admin:reset-password": "bun run bin/reset-admin-password.ts"

23 },

24 "dependencies": {

25 "@aejkatappaja/phantom-ui": "latest",

26 "@modelcontextprotocol/sdk": "^1.29.0",

27 "@prisma/client": "5.22.0",

28 "@vueuse/core": "^14.3.0",

29 "bcryptjs": "^2.4.3",

30 "bullmq": "^5.79.1",

31 "ioredis": "^5.11.1",

32 "jose": "^5.3.0",

33 "libphonenumber-js": "^1.13.7",

34 "mime": "^4.1.0",

35 "nodemailer": "^9.0.1",

bin/reset-admin-password.tsView file

Lines 57-85typescript

57 where: { email }

58 })

60 if (!existingUser) {

61 console.error(`\n❌ Errore: Nessun utente trovato con l'email "${email}".`)

62 process.exit(1)

63 }

server/utils/job-queue.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = waforge@2.9.1 matchedIdentity = npm:d2Fmb3JnZQ:2.9.1 similarity = 0.734 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/utils/job-queue.tsView on unpkg

test-register.jsView file

Lines 1-7javascript

1const res = await fetch('http://localhost:3000/api/auth/register', {

2 method: 'POST',

3 headers: { 'Content-Type': 'application/json' },

4 body: JSON.stringify({ email: 'test@example.com', password: 'password123', name: 'Test User', teamName: 'Test Team' })

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = nuxt prepare && prisma generate

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = nuxt prepare && prisma generate

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/reset-admin-password.tsView file

77patternName = generic_password severity = medium line = 77 matchedText = console....age)

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/reset-admin-password.tsView on unpkg · L77

server/utils/job-queue.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/utils/job-queue.tsView on unpkg

test-register.jsView file

4patternName = generic_password severity = medium line = 4 matchedText = body: JS...' })

Medium

Secret Pattern

Hardcoded password in test-register.js

test-register.jsView on unpkg · L4

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaserver/utils/job-queue.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternbin/reset-admin-password.ts

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

MediumSecret Patterntest-register.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 1-35json

2 "name": "waforge",

3 "version": "2.15.3",

4 "private": false,

5 "engines": {

6 "node": ">=20.0.0",

7 "bun": ">=1.1.0"

8 },

9 "scripts": {

10 "dev": "nuxt dev",

11 "build": "nuxt build",

12 "preview": "nuxt preview",

13 "start": "node .output/server/index.mjs",

14 "lint": "eslint .",

15 "postinstall": "nuxt prepare && prisma generate",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "test": "bun test",

17 "test:e2e": "playwright test",

18 "db:generate": "prisma generate",

19 "db:migrate": "prisma migrate dev",

20 "db:push": "prisma db push",

21 "db:studio": "prisma studio",

22 "admin:reset-password": "bun run bin/reset-admin-password.ts"

23 },

24 "dependencies": {

25 "@aejkatappaja/phantom-ui": "latest",

26 "@modelcontextprotocol/sdk": "^1.29.0",

27 "@prisma/client": "5.22.0",

28 "@vueuse/core": "^14.3.0",

29 "bcryptjs": "^2.4.3",

30 "bullmq": "^5.79.1",

31 "ioredis": "^5.11.1",

32 "jose": "^5.3.0",

33 "libphonenumber-js": "^1.13.7",

34 "mime": "^4.1.0",

35 "nodemailer": "^9.0.1",

bin/reset-admin-password.tsView file

Lines 57-85typescript

57 where: { email }

58 })

60 if (!existingUser) {

61 console.error(`\n❌ Errore: Nessun utente trovato con l'email "${email}".`)

62 process.exit(1)

63 }

server/utils/job-queue.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/utils/job-queue.tsView on unpkg

test-register.jsView file

Lines 1-7javascript

1const res = await fetch('http://localhost:3000/api/auth/register', {

2 method: 'POST',

3 headers: { 'Content-Type': 'application/json' },

4 body: JSON.stringify({ email: 'test@example.com', password: 'password123', name: 'Test User', teamName: 'Test Team' })