仓库静态检查
- 检查 Commit
dec45bf6132e- 证据分
- 76/100
- 静态风险
- 高风险
- 扫描文件
- 3
- 检查发现
- 19
证据分项
来源溯源25/25
安装文档25/25
维护状况12/20
兼容性证据11/20
安全信号3/10
兼容性置信度: 有限
安装期脚本 (1)
prepacknode --check lib/index.js
检查发现 (19)
- 高
install.scriptpackage.jsoninstall-time"prepack": "node --check lib/index.js" - 中
credentials.env-secretlib/index.js:786credential-accessconst secret = config.secret || process.env.DSH_AUTH_SECRET || randomBytes(32).toString("hex"); - 低
network.external-hostlib/index.js:182networkauthorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth", - 低
network.external-hostlib/index.js:183networktokenUrl: "https://oauth2.googleapis.com/token", - 低
network.external-hostlib/index.js:184networkuserInfoUrl: "https://www.googleapis.com/oauth2/v3/userinfo", - 低
network.external-hostlib/index.js:192networkauthorizeUrl: "https://discord.com/oauth2/authorize", - 低
network.external-hostlib/index.js:193networktokenUrl: "https://discord.com/api/oauth2/token", - 低
network.external-hostlib/index.js:194networkuserInfoUrl: "https://discord.com/api/users/@me", - 低
network.external-hostlib/index.js:202networkauthorizeUrl: "https://gitlab.com/oauth/authorize", - 低
network.external-hostlib/index.js:203networktokenUrl: "https://gitlab.com/oauth/token", - 低
network.external-hostlib/index.js:204networkuserInfoUrl: "https://gitlab.com/api/v4/user", - 低
network.external-hostlib/index.js:212networkauthorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", - 低
network.external-hostlib/index.js:213networktokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token", - 低
network.external-hostlib/index.js:214networkuserInfoUrl: "https://graph.microsoft.com/v1.0/me", - 低
network.external-hostlib/index.js:223networkauthorizeUrl: "https://bitbucket.org/site/oauth2/authorize", - 低
network.external-hostlib/index.js:224networktokenUrl: "https://bitbucket.org/site/oauth2/access_token", - 低
network.external-hostlib/index.js:225networkuserInfoUrl: "https://api.bitbucket.org/2.0/user", - 低
network.external-hostlib/index.js:568networkreturn new URL(req.url ?? "/", "http://dsh.local").pathname; - 低
network.external-hostlib/index.js:1161networkconst url = new URL(req.url, "http://dsh.local");
未执行的检查
- 依赖漏洞数据库扫描
- 实际安装测试
- 运行时行为验证
扫描器 1.0.0 · 评分器 1.0.0