registry / @adobe/spacecat-shared-tokowaka-client / 1.21.0

@adobe/spacecat-shared-tokowaka-client@1.21.0

Tokowaka Client for SpaceCat - Edge optimization config management

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an explicit CDN and edge-optimization management client that can mutate configured AWS/Fastly resources when its exported methods are called with caller-provided credentials.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit application calls to Tokowaka, CloudFront, or Fastly client methods after import.

Impact

Intended privileged cloud changes are limited to configured resources; no unconsented install-time, credential-exfiltration, or persistence path was found.

Mechanism

Caller-configured CDN cache, S3 configuration, and CloudFront edge-control management.

Rationale

Source inspection shows package-aligned, explicitly invoked edge/CDN management functionality. Scanner network and secret signals resolve to expected API usage and AWS placeholder credentials in tests.

Evidence

package.jsonsrc/index.jssrc/fastly-kv-client.jssrc/cdn/cloudfront/index.jssrc/cdn/cloudfront/edge-code.jstest/cdn/cloudfront-cdn-client.test.jssrc/cdn/cloudfront-cdn-client.jssrc/cdn/fastly-cdn-client.jssrc/utils/custom-html-utils.jssrc/utils/s3-utils.jssrc/utils/waf-probe-utils.js

Network endpoints3

api.fastly.com/resources/stores/kvapi.fastly.com/service/${serviceId}/purgelive.edgeoptimize.net

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall hooks or bin entrypoint.
`src/index.js` exports a client; import only defines classes/functions.
`src/cdn/cloudfront/index.js` performs named CloudFront/IAM/Lambda control-plane actions only through explicit exported calls.
`src/fastly-kv-client.js` and `src/cdn/fastly-cdn-client.js` call Fastly APIs using caller-supplied configuration.
`test/cdn/cloudfront-cdn-client.test.js` contains documented AWS EXAMPLE test credentials, not live package secrets.
No source use of shell execution, eval/vm, filesystem harvesting, or local persistence was found.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 261 KB of source, external domains: api.fastly.com, live.edgeoptimize.net

Source & flagged code

4 flagged

test/cdn/cloudfront-cdn-client.test.jsView file

Lines 84-160javascript

84 it('should return true for valid config with only distributionId', () => {

85 const env = {

86 TOKOWAKA_CDN_CONFIG: JSON.stringify({

87 cloudfront: {

88 distributionId: 'E123456',

89 region: 'us-east-1',

90 },

91 }),

92 };

93 client = new CloudFrontCdnClient(env, log);

95 expect(client.validateConfig()).to.be.true;

96 });

98 it('should return true for valid config with credentials', () => {

99 const env = {

100 TOKOWAKA_CDN_CONFIG: JSON.stringify({

101 cloudfront: {

102 distributionId: 'E123456',

103 region: 'us-east-1',

104 accessKeyId: 'AKIAIOSFODNN7EXAMPLE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

105 secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',

106 },

107 }),

108 };

109 client = new CloudFrontCdnClient(env, log);

110

111 expect(client.validateConfig()).to.be.true;

112 });

113

114 it('should return false if distributionId is missing', () => {

115 const env = {

116 TOKOWAKA_CDN_CONFIG: JSON.stringify({

117 cloudfront: {

118 region: 'us-east-1',

119 },

120 }),

121 };

122 client = new CloudFrontCdnClient(env, log);

123

124 const result = client.validateConfig();

125

126 expect(result).to.be.false;

127 expect(log.error).to.have.been.calledWith(

128 'CloudFront CDN config missing required fields: distributionId and region',

129 );

130 });

131 });

132

133 describe('invalidateCache', () => {

134 beforeEach(() => {

135 const env = {

136 TOKOWAKA_CDN_CONFIG: JSON.stringify({

137 cloudfront: {

138 distributionId: 'E123456',

139 region: 'us-east-1',

140 accessKeyId: 'AKIAIOSFODNN7EXAMPLE',

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L140

141 secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',

142 },

143 }),

144 };

145 client = new CloudFrontCdnClient(env, log);

146 });

147

148 it('should invalidate cache successfully', async () => {

149 const mockResponse = {

150 Invalidation: {

151 Id: 'I2J4EXAMPLE',

152 Status: 'InProgress',

153 CreateTime: new Date('2025-01-15T10:30:00.000Z'),

154 },

155 };

156 cloudFrontMock.on(CreateInvalidationCommand).resolves(mockResponse);

157

158 const paths = ['/path1', '/path2'];

159 const result = await client.invalidateCache(paths);

160

Lines 232-272javascript

232 it('should throw error on CloudFront API failure', async () => {

233 cloudFrontMock.on(CreateInvalidationCommand).rejects(new Error('CloudFront API error'));

234

235 try {

236 await client.invalidateCache(['/path1']);

237 expect.fail(

Source & flagged code

4 flagged · loading source

test/cdn/cloudfront-cdn-client.test.jsView file

104patternName = aws_access_key severity = critical line = 104 matchedText = accessKe...LE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

104patternName = aws_access_key severity = critical line = 104 matchedText = accessKe...LE',

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

140patternName = aws_access_key severity = critical line = 140 matchedText = accessKe...LE',

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L140

252patternName = aws_access_key severity = critical line = 252 matchedText = accessKe...LE',

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L252

Findings

4 Critical1 Medium3 Low

CriticalCritical Secrettest/cdn/cloudfront-cdn-client.test.js

CriticalSecret Patterntest/cdn/cloudfront-cdn-client.test.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

test/cdn/cloudfront-cdn-client.test.jsView file

Lines 84-160javascript

84 it('should return true for valid config with only distributionId', () => {

85 const env = {

86 TOKOWAKA_CDN_CONFIG: JSON.stringify({

87 cloudfront: {

88 distributionId: 'E123456',

89 region: 'us-east-1',

90 },

91 }),

92 };

93 client = new CloudFrontCdnClient(env, log);

95 expect(client.validateConfig()).to.be.true;

96 });

98 it('should return true for valid config with credentials', () => {

99 const env = {

100 TOKOWAKA_CDN_CONFIG: JSON.stringify({

101 cloudfront: {

102 distributionId: 'E123456',

103 region: 'us-east-1',

104 accessKeyId: 'AKIAIOSFODNN7EXAMPLE',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L104

105 secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',

106 },

107 }),

108 };

109 client = new CloudFrontCdnClient(env, log);

110

111 expect(client.validateConfig()).to.be.true;

112 });

113

114 it('should return false if distributionId is missing', () => {

115 const env = {

116 TOKOWAKA_CDN_CONFIG: JSON.stringify({

117 cloudfront: {

118 region: 'us-east-1',

119 },

120 }),

121 };

122 client = new CloudFrontCdnClient(env, log);

123

124 const result = client.validateConfig();

125

126 expect(result).to.be.false;

127 expect(log.error).to.have.been.calledWith(

128 'CloudFront CDN config missing required fields: distributionId and region',

129 );

130 });

131 });

132

133 describe('invalidateCache', () => {

134 beforeEach(() => {

135 const env = {

136 TOKOWAKA_CDN_CONFIG: JSON.stringify({

137 cloudfront: {

138 distributionId: 'E123456',

139 region: 'us-east-1',

140 accessKeyId: 'AKIAIOSFODNN7EXAMPLE',

Critical

Secret Pattern

AWS access key ID in test/cdn/cloudfront-cdn-client.test.js

test/cdn/cloudfront-cdn-client.test.jsView on unpkg · L140

141 secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',

142 },

143 }),

144 };

145 client = new CloudFrontCdnClient(env, log);

146 });

147

148 it('should invalidate cache successfully', async () => {

149 const mockResponse = {

150 Invalidation: {

151 Id: 'I2J4EXAMPLE',

152 Status: 'InProgress',

153 CreateTime: new Date('2025-01-15T10:30:00.000Z'),

154 },

155 };

156 cloudFrontMock.on(CreateInvalidationCommand).resolves(mockResponse);

157

158 const paths = ['/path1', '/path2'];

159 const result = await client.invalidateCache(paths);

160

Lines 232-272javascript

232 it('should throw error on CloudFront API failure', async () => {

233 cloudFrontMock.on(CreateInvalidationCommand).rejects(new Error('CloudFront API error'));

234

235 try {

236 await client.invalidateCache(['/path1']);

237 expect.fail(