registry / @augustdigital/sdk / 8.7.2

@augustdigital/sdk@8.7.2

JS SDK powering the August Digital ecosystem.

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 149 file(s), 1.33 MB of source, external domains: 127.0.0.1, api.augustdigital.io, api.devnet.solana.com, api.goldsky.com, api.mainnet-beta.solana.com, api.octav.fi, api.paraswap.io, api.testnet.solana.com, app.upshift.finance, arbiscan.io, arbitrum-one-rpc.publicnode.com, avalanche-c-chain-rpc.publicnode.com, backend-dev.augustdigital.io, backend-qa.augustdigital.io, backend.fractalprotocol.org, backend.staging.fractalprotocol.org, base-rpc.publicnode.com, basescan.org, berachain-rpc.publicnode.com, bscscan.com, docs.augustdigital.io, ethereum-rpc.publicnode.com, etherscan.io, explore.tempo.xyz, explorer.inkonchain.com, explorer.katanarpc.com, explorer.mainnet.citrea.xyz, explorer.mezo.org, flare-api.flare.network, flarescan.com, fluentscan.xyz, gateway.thegraph.com, hooks.slack.com, hyperevmscan.io, layerzeroscan.com, linea-rpc.publicnode.com, monad-mainnet.g.alchemy.com, monadscan.com, optimism-mainnet.public.blastapi.io, plasmascan.to, polygonscan.com, prices.augustdigital.io, pro-api.coingecko.com, registry.npmjs.org, rpc-gel.inkonchain.com, rpc.ankr.com, rpc.fluent.xyz, rpc.hemi.network, rpc.hyperliquid.xyz, rpc.katana.network

Source & flagged code

3 flagged

lib/services/octavfi/fetcher.jsView file

Lines 1-28javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.fetchOctavfiPortfolios = fetchOctavfiPortfolios;

4const ethers_1 = require("ethers");

5const utils_1 = require("../../adapters/solana/utils");

6const core_1 = require("../../core");

7const BASE_URL = 'https://api.octav.fi';

8const OCTAVFI_API_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwczovL2hhc3VyYS5pby9qd3QvY2xhaW1zIjp7IngtaGFzdXJhLWRlZmF1bHQtcm9sZSI6InVzZXIiLCJ4LWhhc3VyYS1hbGxvd2VkLXJvbGVzIjpbInVzZXIiXSwieC1oYXN1cmEtdXNlci1pZCI6ImF1Z3VzdDEyMjM0In19.zaMUtrtdC82uaDh6XSZrsneEcKO3PFOE6FyX3G-MR6c';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/services/octavfi/fetcher.jsView on unpkg · L8

Critical

Secret Pattern

Supabase service role key (JWT) in lib/services/octavfi/fetcher.js

lib/services/octavfi/fetcher.jsView on unpkg · L8

9/**

10 * Filters addresses to only include EVM and Solana wallet addresses.

11 * Excludes Sui addresses and other non-supported address formats.

12 *

13 * @param addresses - Array of addresses to filter

14 * @returns Array containing only EVM and Solana addresses

15 */

16function filterEvmAndSolanaAddresses(addresses) {

17 return addresses.filter((address) => {

18 if (!address || typeof address !== 'string')

19 return false;

20 if ((0, ethers_1.isAddress)(address)) {

21 return true;

22 }

23 if (utils_1.SolanaUtils.isSolanaAddress(address)) {

24 return true;

25 }

26 core_1.Logger.log.info('filterEvmAndSolanaAddresses.excluded', { address });

27 return false;

28 });

lib/core/analytics/sentry-runtime.jsView file

Lines 12-52javascript

12 typeof window.document !== 'undefined') {

13 return 'browser';

14 }

15 if (typeof process !== 'undefined' &&

16 process.versions?.node &&

17 typeof window

Source & flagged code

3 flagged · loading source

lib/services/octavfi/fetcher.jsView file

8patternName = supabase_service_key severity = critical line = 8 matchedText = const OC...6c';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/services/octavfi/fetcher.jsView on unpkg · L8

8patternName = supabase_service_key severity = critical line = 8 matchedText = const OC...6c';

Critical

Secret Pattern

Supabase service role key (JWT) in lib/services/octavfi/fetcher.js

lib/services/octavfi/fetcher.jsView on unpkg · L8

lib/core/analytics/sentry-runtime.jsView file

32// `require('@sentry/node')`, which breaks the browser bundle. L33: const req = new Function('return typeof require === "function" ? require : null')(); L34: return typeof req === 'function' ? req : null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/core/analytics/sentry-runtime.jsView on unpkg · L32

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretlib/services/octavfi/fetcher.js

CriticalSecret Patternlib/services/octavfi/fetcher.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvallib/core/analytics/sentry-runtime.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/services/octavfi/fetcher.jsView file

Lines 1-28javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.fetchOctavfiPortfolios = fetchOctavfiPortfolios;

4const ethers_1 = require("ethers");

5const utils_1 = require("../../adapters/solana/utils");

6const core_1 = require("../../core");

7const BASE_URL = 'https://api.octav.fi';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/services/octavfi/fetcher.jsView on unpkg · L8

Critical

Secret Pattern

Supabase service role key (JWT) in lib/services/octavfi/fetcher.js

lib/services/octavfi/fetcher.jsView on unpkg · L8

9/**

10 * Filters addresses to only include EVM and Solana wallet addresses.

11 * Excludes Sui addresses and other non-supported address formats.

12 *

13 * @param addresses - Array of addresses to filter

14 * @returns Array containing only EVM and Solana addresses

15 */

16function filterEvmAndSolanaAddresses(addresses) {

17 return addresses.filter((address) => {

18 if (!address || typeof address !== 'string')

19 return false;

20 if ((0, ethers_1.isAddress)(address)) {

21 return true;

22 }

23 if (utils_1.SolanaUtils.isSolanaAddress(address)) {

24 return true;

25 }

26 core_1.Logger.log.info('filterEvmAndSolanaAddresses.excluded', { address });

27 return false;

28 });

lib/core/analytics/sentry-runtime.jsView file

Lines 12-52javascript

12 typeof window.document !== 'undefined') {

13 return 'browser';

14 }

15 if (typeof process !== 'undefined' &&

16 process.versions?.node &&

17 typeof window