registry / @backstage/plugin-kubernetes-backend / 0.21.6

@backstage/plugin-kubernetes-backend@0.21.6

A Backstage backend plugin that integrates towards Kubernetes

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 77.6 KB of source

Source & flagged code

2 flagged

dist/index.d.tsView file

Lines 79-119typescript

79 *

80 * @public

81 */

82declare class GoogleStrategy implements AuthenticationStrategy {

83 getCredential(_: ClusterDetails, requestAuth: KubernetesRequestAuth): Promise<KubernetesCredential>;

84 validateCluster(): Error[];

85 presentAuthMetadata(_authMetadata: AuthMetadata): AuthMetadata;

86}

88/**

89 * GoogleServiceAccountStrategy provides authentication using Google Service Account credentials.

90 *

91 * Credentials can be provided via configuration:

92 * ```yaml

93 * kubernetes:

94 * googleServiceAccountCredentials: |

95 * {

96 * "type": "service_account",

97 * "project_id": "your-project-id",

98 * "private_key_id": "key-id",

99 * "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.d.tsView on unpkg · L99

Critical

Secret Pattern

RSA private key in dist/index.d.ts

dist/index.d.tsView on unpkg · L99

100 * "client_email": "your-service-account@your-project.iam.gserviceaccount.com",

101 * "client_id": "client-id",

102 * "auth_uri": "https://accounts.google.com/o/oauth2/auth",

103 * "token_uri": "https://oauth2.googleapis.com/token",

104 * "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

105 * "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."

106 * }

107 * ```

108 *

109 * If no credentials are provided in config, falls back to GOOGLE_APPLICATION_CREDENTIALS or ADC.

110 *

111 * @public

112 */

113declare class GoogleServiceAccountStrategy implements AuthenticationStrategy {

114 private readonly credentials?;

115 constructor(opts: {

116 config: Config;

117 });

118 getCredential(): Promise<KubernetesCredential>;

119 validateCluster(): Error[];

Source & flagged code

2 flagged · loading source

dist/index.d.tsView file

99patternName = private_key_rsa severity = critical line = 99 matchedText = * ...\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.d.tsView on unpkg · L99

99patternName = private_key_rsa severity = critical line = 99 matchedText = * ...\n",

Critical

Secret Pattern

RSA private key in dist/index.d.ts

dist/index.d.tsView on unpkg · L99

Findings

2 Critical2 Medium3 Low

CriticalCritical Secretdist/index.d.ts

CriticalSecret Patterndist/index.d.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/index.d.tsView file

Lines 79-119typescript

79 *

80 * @public

81 */

82declare class GoogleStrategy implements AuthenticationStrategy {

83 getCredential(_: ClusterDetails, requestAuth: KubernetesRequestAuth): Promise<KubernetesCredential>;

84 validateCluster(): Error[];

85 presentAuthMetadata(_authMetadata: AuthMetadata): AuthMetadata;

86}

88/**

89 * GoogleServiceAccountStrategy provides authentication using Google Service Account credentials.

90 *

91 * Credentials can be provided via configuration:

92 * ```yaml

93 * kubernetes:

94 * googleServiceAccountCredentials: |

95 * {

96 * "type": "service_account",

97 * "project_id": "your-project-id",

98 * "private_key_id": "key-id",

99 * "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.d.tsView on unpkg · L99

Critical

Secret Pattern

RSA private key in dist/index.d.ts

dist/index.d.tsView on unpkg · L99

100 * "client_email": "your-service-account@your-project.iam.gserviceaccount.com",

101 * "client_id": "client-id",

102 * "auth_uri": "https://accounts.google.com/o/oauth2/auth",

103 * "token_uri": "https://oauth2.googleapis.com/token",

104 * "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

105 * "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."

106 * }

107 * ```

108 *

109 * If no credentials are provided in config, falls back to GOOGLE_APPLICATION_CREDENTIALS or ADC.

110 *

111 * @public

112 */

113declare class GoogleServiceAccountStrategy implements AuthenticationStrategy {

114 private readonly credentials?;

115 constructor(opts: {

116 config: Config;

117 });

118 getCredential(): Promise<KubernetesCredential>;

119 validateCluster(): Error[];