registry / @arduino/react-native-mqtt-client / 0.3.4

@arduino/react-native-mqtt-client@0.3.4

MQTT client for React Native

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 22.7 KB of source

Source & flagged code

12 flagged

ios/ECPrivateKey.swiftView file

Lines 15-133text

15import Foundation

16#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)

17import CommonCrypto

18#elseif os(Linux)

19import OpenSSL

20#endif

23/**

24 Represents an elliptic curve private key.

25 Supported curves are:

Source & flagged code

12 flagged · loading source

ios/ECPrivateKey.swiftView file

35patternName = private_key_ec severity = critical line = 35 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ios/ECPrivateKey.swiftView on unpkg · L35

35patternName = private_key_ec severity = critical line = 35 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L35

69patternName = private_key_rsa severity = critical line = 69 matchedText = This can...--",

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L69

70patternName = private_key_ec severity = critical line = 70 matchedText = or from ...--".

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L70

74patternName = private_key_ec severity = critical line = 74 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L74

113patternName = private_key_rsa severity = critical line = 113 matchedText = /// This...---"

Critical

Secret Pattern

RSA private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L113

168patternName = private_key_ec severity = critical line = 168 matchedText = /// This...---"

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L168

472patternName = private_key_ec severity = critical line = 472 matchedText = return "...---"

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L472

android/gradlew.batView file

•path = android/gradlew.bat kind = build_helper sizeBytes = 2763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

android/gradlew.batView on unpkg

android/gradle/wrapper/gradle-wrapper.jarView file

•path = android/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 59203 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 59203 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = android/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 59203 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

8 Critical1 High3 Medium3 Low

CriticalCritical Secretios/ECPrivateKey.swift

CriticalSecret Patternios/ECPrivateKey.swift

HighShips High Entropy Blobandroid/gradle/wrapper/gradle-wrapper.jar

MediumShips Build Helperandroid/gradlew.bat

MediumShips Compressed Blobandroid/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowNested Archive Needs Inspectionandroid/gradle/wrapper/gradle-wrapper.jar

Lines 148-188text

148 publicKeyData = pubKeyData

149 } else {

150 throw ECError.failedASN1Decoding

151 }

152 let trimmedPubBytes = publicKeyData.drop(while: { $0 == 0x00})

153 if trimmedPubBytes.count != publicKeyData.count {

154 stripped = true

155 }

156 self.nativeKey = try ECPrivateKey.bytesToNativeKey(privateKeyData: privateKeyData,

157 publicKeyData: trimmedPubBytes,

158 curve: curve)

159 let derData = ECPrivateKey.generateASN1(privateKey: privateKeyData,

160 publicKey: publicKeyData,

161 curve: curve)

162 self.pemString = ECPrivateKey.derToPrivatePEM(derData: derData)

163 self.pubKeyBytes = trimmedPubBytes

164 self.curveId = curve.description

165 }

166

167 /// Initialize an ECPrivateKey from a SEC1 `.der` file data.

168 /// This is equivalent to a PEM String that has had the "-----BEGIN EC PRIVATE KEY-----"

Critical

Secret Pattern

EC private key in ios/ECPrivateKey.swift

ios/ECPrivateKey.swiftView on unpkg · L168

169 /// header and footer stripped and been base64 encoded to ASN1 Data.

170 /// - Parameter sec1DER: The elliptic curve private key Data.

171 /// - Returns: An ECPrivateKey.

172 /// - Throws: An ECError if the Data can't be decoded or is not a valid key.

173 public init(sec1DER: Data) throws {

174 self.pemString = ECPrivateKey.derToPrivatePEM(derData: sec1DER)

175 let (result, _) = ASN1.toASN1Element(data: sec1DER)

176 guard case let ASN1.ASN1Element.seq(elements: seq) = result,

177 seq.count > 3,

178 case let ASN1.ASN1Element.constructed(tag: _, elem: objectElement) = seq[2],

179 case let ASN1.ASN1Element.bytes(data: objectId) = objectElement,

180 case let ASN1.ASN1Element.bytes(data: privateKeyData) = seq[1]

181 else {

182 throw ECError.failedASN1Decoding

183 }

184 self.curve = try EllipticCurve.objectToCurve(ObjectIdentifier: objectId)

185 guard case let ASN1.ASN1Element.constructed(tag: _, elem: publicElement) = seq[3],

186 case let ASN1.ASN1Element.bytes(data: publicKeyData) = publicElement

187 else {

188 throw ECError.failedASN1Decoding