registry / @arduino/react-native-mqtt-client / 0.3.4

@arduino/react-native-mqtt-client@0.3.4

MQTT client for React Native

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 22.7 KB of source

Source & flagged code

12 flagged

ios/ECPrivateKey.swiftView file

Lines 15-133text

15import Foundation

16#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)

17import CommonCrypto

18#elseif os(Linux)

19import OpenSSL

20#endif

23/**

24 Represents an elliptic curve private key.

25 Supported curves are:

26 - prime256v1

27 - secp384r1

28 - NID_secp521r1

29 You can generate an elliptic curve Key using OpenSSL:

30 https://wiki.openssl.org/index.php/Command_Line_Elliptic_Curve_Operations#Generating_EC_Keys_and_Parameters

32 ### Usage Example:

33 ```swift

34 let pemKey = """

35 -----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ios/ECPrivateKey.swiftView on unpkg · L35

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L35

36 MHcCAQEEIJX+87WJ7Gh19sohyZnhxZeXYNOcuGv4Q+8MLge4UkaZoAoGCCqGSM49

37 AwEHoUQDQgAEikc5m6C2xtDWeeAeT18WElO37zvFOz8p4kAlhvgIHN23XIClNESg

38 KVmLgSSq2asqiwdrU5YHbcHFkgdABM1SPA==

39 -----END EC PRIVATE KEY-----

40 """

41 let privateKey = try ECPrivateKey(key: pemKey)

42 let signature = "Hello world".sign(with: privateKey)

43 ```

44 */

45@available(macOS 10.13, iOS 11, watchOS 4.0, tvOS 11.0, *)

46public class ECPrivateKey {

47 /// A String description of the curve this key was generated from.

48 public let curveId: String

50 /// The `EllipticCurve` this key was generated from.

51 public let curve: EllipticCurve

53 /// The private key represented as a PEM String.

54 public let pemString: String

56 #if os(Linux)

57 typealias NativeKey = OpaquePointer?

58 deinit { EC_KEY_free(.make(optional: self.nativeKey)) }

59 #else

60 typealias NativeKey = SecKey

61 #endif

62 public var nativeKey: SecKey?

63 let pubKeyBytes: Data

64 private var stripped: Bool = false

67 /**

68 Initialize an ECPrivateKey from a PEM String.

69 This can either be from a `.p8` file with the header "-----BEGIN PRIVATE KEY-----",

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L69

70 or from a `.pem` file with the header "-----BEGIN EC PRIVATE KEY-----".

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L70

71 ### Usage Example: ###

72 ```swift

73 let privateKeyString = """

74 -----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L74

75 MHcCAQEEIJX+87WJ7Gh19sohyZnhxZeXYNOcuGv4Q+8MLge4UkaZoAoGCCqGSM49

76 AwEHoUQDQgAEikc5m6C2xtDWeeAeT18WElO37zvFOz8p4kAlhvgIHN23XIClNESg

77 KVmLgSSq2asqiwdrU5YHbcHFkgdABM1SPA==

78 -----END EC PRIVATE KEY-----

79 """

80 let key = try ECPrivateKey(key: privateKeyString)

81 ```

82 - Parameter key: The elliptic curve private key as a PEM string.

83 - Returns: An ECPrivateKey.

84 - Throws: An ECError if the PEM string can't be decoded or is not a valid key.

85 */

86 public convenience init(key: String) throws {

87 // Strip whitespace characters

88 let strippedKey = String(key.filter { !" \n\t\r".contains($0) })

89 var pemComponents = strippedKey.components(separatedBy: "-----")

90 guard pemComponents.count >= 5 else {

91 throw ECError.invalidPEMString

92 }

93 // Remove any EC parameters since Curve is determined by OID

94 if pemComponents[1] == "BEGINECPARAMETERS" {

95 pemComponents.removeFirst(5)

96 guard pemComponents.count >= 5 else {

97 throw ECError.invalidPEMString

98 }

99 }

100 guard let der = Data(base64Encoded: pemComponents[2]) else {

101 throw ECError.failedBase64Encoding

102 }

103 if pemComponents[1] == "BEGINECPRIVATEKEY" {

104 try self.init(sec1DER: der)

105 } else if pemComponents[1] == "BEGINPRIVATEKEY" {

106 try self.init(pkcs8DER: der)

107 } else {

108 throw ECError.unknownPEMHeader

109 }

110 }

111

112 /// Initialize an ECPrivateKey from a PKCS8 `.der` file data.

113 /// This is equivalent to a PEM String that has had the "-----BEGIN PRIVATE KEY-----"

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L113

114 /// header and footer stripped and been base64 encoded to ASN1 Data.

115 /// - Parameter pkcs8DER: The elliptic curve private key Data.

116 /// - Returns: An ECPrivateKey.

117 /// - Throws: An ECError if the Data can't be decoded or is not a valid key.

118 public init(pkcs8DER: Data) throws {

119 let (result, _) = ASN1.toASN1Element(data: pkcs8DER)

120 guard case let ASN1.ASN1Element.seq(elements: es) = result,

121 es.count > 2,

122 case let ASN1.ASN1Element.seq(elements: ids) = es[1],

123 ids.count > 1,

124 case let ASN1.ASN1Element.bytes(data: privateKeyID) = ids[1]

125 else {

126 throw ECError.failedASN1Decoding

127 }

128 self.curve = try EllipticCurve.objectToCurve(ObjectIdentifier: privateKeyID)

129 guard case let ASN1.ASN1Element.bytes(data: privateOctest) = es[2] else {

130 throw ECError.failedASN1Decoding

131 }

132 let (octest, _) = ASN1.toASN1Element(data: privateOctest)

133 guard case let ASN1.ASN1Element.seq(elements: seq) = octest,

Lines 148-188text

148 publicKeyData = pubKeyData

149 } else {

150 throw ECError.failedASN1Decoding

151 }

152 let trimmedPubBytes = publicKeyData.drop(while: { $0 == 0x00})

153 if trimmedPubBytes.count != publicKeyData.count {

154 stripped = true

155 }

156 self.nativeKey = try ECPrivateKey.bytesToNativeKey(privateKeyData: privateKeyData,

157 publicKeyData: trimmedPubBytes,

158 curve: curve)

159 let derData = ECPrivateKey.generateASN1(privateKey: privateKeyData,

160 publicKey: publicKeyData,

Lines 452-475text

452 kSecAttrKeyClass: kSecAttrKeyClassPrivate] as CFDictionary,

453 &error)

454 else {

455 if let secError = error?.takeRetainedValue() {

456 throw secError

457 } else {

458 throw ECError.failedNativeKeyCreation

459 }

460 }

461 return secKey

462 #endif

463 }

464

465 private static func derToPrivatePEM(derData: Data) -> String {

android/gradlew.batView file

•path = android/gradlew.bat kind = build_helper sizeBytes = 2763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

android/gradlew.batView on unpkg

android/gradle/wrapper/gradle-wrapper.jarView file

•path = android/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 59203 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 59203 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 59203 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

12 flagged · loading source

ios/ECPrivateKey.swiftView file

35patternName = private_key_ec severity = critical line = 35 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ios/ECPrivateKey.swiftView on unpkg · L35

35patternName = private_key_ec severity = critical line = 35 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L35

69patternName = private_key_rsa severity = critical line = 69 matchedText = This can...--",

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L69

70patternName = private_key_ec severity = critical line = 70 matchedText = or from ...--".

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L70

74patternName = private_key_ec severity = critical line = 74 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L74

113patternName = private_key_rsa severity = critical line = 113 matchedText = /// This...---"

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L113

168patternName = private_key_ec severity = critical line = 168 matchedText = /// This...---"

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L168

472patternName = private_key_ec severity = critical line = 472 matchedText = return "...---"

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L472

android/gradlew.batView file

•path = android/gradlew.bat kind = build_helper sizeBytes = 2763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

android/gradlew.batView on unpkg

android/gradle/wrapper/gradle-wrapper.jarView file

•path = android/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 59203 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 59203 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 59203 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

8 Critical1 High3 Medium3 Low

CriticalCritical Secretios/ECPrivateKey.swift

CriticalSecret Patternios/ECPrivateKey.swift

HighShips High Entropy Blobandroid/gradle/wrapper/gradle-wrapper.jar

MediumShips Build Helperandroid/gradlew.bat

MediumShips Compressed Blobandroid/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowNested Archive Needs Inspectionandroid/gradle/wrapper/gradle-wrapper.jar

Source & flagged code

12 flagged

ios/ECPrivateKey.swiftView file

Lines 15-133text

15import Foundation

16#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)

17import CommonCrypto

18#elseif os(Linux)

19import OpenSSL

20#endif

23/**

24 Represents an elliptic curve private key.

25 Supported curves are:

26 - prime256v1

27 - secp384r1

28 - NID_secp521r1

29 You can generate an elliptic curve Key using OpenSSL:

30 https://wiki.openssl.org/index.php/Command_Line_Elliptic_Curve_Operations#Generating_EC_Keys_and_Parameters

32 ### Usage Example:

33 ```swift

34 let pemKey = """

35 -----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ios/ECPrivateKey.swiftView on unpkg · L35

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L35

36 MHcCAQEEIJX+87WJ7Gh19sohyZnhxZeXYNOcuGv4Q+8MLge4UkaZoAoGCCqGSM49

37 AwEHoUQDQgAEikc5m6C2xtDWeeAeT18WElO37zvFOz8p4kAlhvgIHN23XIClNESg

38 KVmLgSSq2asqiwdrU5YHbcHFkgdABM1SPA==

39 -----END EC PRIVATE KEY-----

40 """

41 let privateKey = try ECPrivateKey(key: pemKey)

42 let signature = "Hello world".sign(with: privateKey)

43 ```

44 */

45@available(macOS 10.13, iOS 11, watchOS 4.0, tvOS 11.0, *)

46public class ECPrivateKey {

47 /// A String description of the curve this key was generated from.

48 public let curveId: String

50 /// The `EllipticCurve` this key was generated from.

51 public let curve: EllipticCurve

53 /// The private key represented as a PEM String.

54 public let pemString: String

56 #if os(Linux)

57 typealias NativeKey = OpaquePointer?

58 deinit { EC_KEY_free(.make(optional: self.nativeKey)) }

59 #else

60 typealias NativeKey = SecKey

61 #endif

62 public var nativeKey: SecKey?

63 let pubKeyBytes: Data

64 private var stripped: Bool = false

67 /**

68 Initialize an ECPrivateKey from a PEM String.

69 This can either be from a `.p8` file with the header "-----BEGIN PRIVATE KEY-----",

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L69

70 or from a `.pem` file with the header "-----BEGIN EC PRIVATE KEY-----".

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L70

71 ### Usage Example: ###

72 ```swift

73 let privateKeyString = """

74 -----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L74

75 MHcCAQEEIJX+87WJ7Gh19sohyZnhxZeXYNOcuGv4Q+8MLge4UkaZoAoGCCqGSM49

76 AwEHoUQDQgAEikc5m6C2xtDWeeAeT18WElO37zvFOz8p4kAlhvgIHN23XIClNESg

77 KVmLgSSq2asqiwdrU5YHbcHFkgdABM1SPA==

78 -----END EC PRIVATE KEY-----

79 """

80 let key = try ECPrivateKey(key: privateKeyString)

81 ```

82 - Parameter key: The elliptic curve private key as a PEM string.

83 - Returns: An ECPrivateKey.

84 - Throws: An ECError if the PEM string can't be decoded or is not a valid key.

85 */

86 public convenience init(key: String) throws {

87 // Strip whitespace characters

88 let strippedKey = String(key.filter { !" \n\t\r".contains($0) })

89 var pemComponents = strippedKey.components(separatedBy: "-----")

90 guard pemComponents.count >= 5 else {

91 throw ECError.invalidPEMString

92 }

93 // Remove any EC parameters since Curve is determined by OID

94 if pemComponents[1] == "BEGINECPARAMETERS" {

95 pemComponents.removeFirst(5)

96 guard pemComponents.count >= 5 else {

97 throw ECError.invalidPEMString

98 }

99 }

100 guard let der = Data(base64Encoded: pemComponents[2]) else {

101 throw ECError.failedBase64Encoding

102 }

103 if pemComponents[1] == "BEGINECPRIVATEKEY" {

104 try self.init(sec1DER: der)

105 } else if pemComponents[1] == "BEGINPRIVATEKEY" {

106 try self.init(pkcs8DER: der)

107 } else {

108 throw ECError.unknownPEMHeader

109 }

110 }

111

112 /// Initialize an ECPrivateKey from a PKCS8 `.der` file data.

113 /// This is equivalent to a PEM String that has had the "-----BEGIN PRIVATE KEY-----"

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L113

114 /// header and footer stripped and been base64 encoded to ASN1 Data.

115 /// - Parameter pkcs8DER: The elliptic curve private key Data.

116 /// - Returns: An ECPrivateKey.

117 /// - Throws: An ECError if the Data can't be decoded or is not a valid key.

118 public init(pkcs8DER: Data) throws {

119 let (result, _) = ASN1.toASN1Element(data: pkcs8DER)

120 guard case let ASN1.ASN1Element.seq(elements: es) = result,

121 es.count > 2,

122 case let ASN1.ASN1Element.seq(elements: ids) = es[1],

123 ids.count > 1,

124 case let ASN1.ASN1Element.bytes(data: privateKeyID) = ids[1]

125 else {

126 throw ECError.failedASN1Decoding

127 }

128 self.curve = try EllipticCurve.objectToCurve(ObjectIdentifier: privateKeyID)

129 guard case let ASN1.ASN1Element.bytes(data: privateOctest) = es[2] else {

130 throw ECError.failedASN1Decoding

131 }

132 let (octest, _) = ASN1.toASN1Element(data: privateOctest)

133 guard case let ASN1.ASN1Element.seq(elements: seq) = octest,

Lines 148-188text

148 publicKeyData = pubKeyData

149 } else {

150 throw ECError.failedASN1Decoding

151 }

152 let trimmedPubBytes = publicKeyData.drop(while: { $0 == 0x00})

153 if trimmedPubBytes.count != publicKeyData.count {

154 stripped = true

155 }

156 self.nativeKey = try ECPrivateKey.bytesToNativeKey(privateKeyData: privateKeyData,

157 publicKeyData: trimmedPubBytes,

158 curve: curve)

159 let derData = ECPrivateKey.generateASN1(privateKey: privateKeyData,

160 publicKey: publicKeyData,

Lines 452-475text

452 kSecAttrKeyClass: kSecAttrKeyClassPrivate] as CFDictionary,

453 &error)

454 else {

455 if let secError = error?.takeRetainedValue() {

456 throw secError

457 } else {

458 throw ECError.failedNativeKeyCreation

459 }

460 }

461 return secKey

462 #endif

463 }

464

465 private static func derToPrivatePEM(derData: Data) -> String {

android/gradlew.batView file

•path = android/gradlew.bat kind = build_helper sizeBytes = 2763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

android/gradlew.batView on unpkg

android/gradle/wrapper/gradle-wrapper.jarView file

•path = android/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 59203 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 59203 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 59203 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg