registry / @beignet/provider-locks-redis / 0.0.29

@beignet/provider-locks-redis@0.0.29

Redis-backed lock and lease provider for Beignet

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chainNo supply-chain packaging signals triggered.

Manifest

WildcardDependency

scanned 2 file(s), 28.6 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

Lines 343-383javascript

343 throw new LeaseOptionsError("Lease key is required.");

344 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

345 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

346 }

347 if (options.waitMs !== undefined && options.waitMs < 0) {

348 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

349 }

350 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

351 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

352 }

353}

354function reconnectBackoff(attempt) {

355 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

356}

357function redactConnectionUrl(url) {

358 try {

359 const parsed = new URL(url);

360 if (parsed.username)

361 parsed.username = "redacted";

362 if (parsed.password)

363 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L363

364 if (parsed.search)

365 parsed.search = "?redacted";

366 parsed.hash = "";

367 return parsed.toString();

368 }

369 catch {

370 return "[invalid URL]";

371 }

372}

373function createRandomToken() {

374 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

375 return crypto.randomUUID();

376 }

377 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

378}

379function defaultSleep(ms) {

380 return new Promise((resolve) => setTimeout(resolve, ms));

381}

382function errorMessage(error) {

383 return error instanceof Error ? error.message : String(error);

src/index.tsView file

Lines 51-91typescript

51 .string()

52 .regex(/^\d+$/, "Expected a non-negative integer string")

53 .transform((value) => Number.parseInt(value, 10));

55const RedisLocksConfigSchema = z.object

Source & flagged code

3 flagged · loading source

dist/index.jsView file

363patternName = generic_password severity = medium line = 363 matchedText = parsed.p...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L363

src/index.tsView file

536patternName = generic_password severity = medium line = 536 matchedText = if (pars...ed";

Medium

Secret Pattern

Hardcoded password in src/index.ts

src/index.tsView on unpkg · L536

71export interface RedisLocksClient { L72: eval( L73: script: string,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.tsView on unpkg · L71

Findings

3 Medium2 Low

MediumSecret Patterndist/index.js

MediumWildcard Dependency

MediumSecret Patternsrc/index.ts

LowScripts Present

LowEvalsrc/index.ts

Source & flagged code

3 flagged

dist/index.jsView file

Lines 343-383javascript

343 throw new LeaseOptionsError("Lease key is required.");

344 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

345 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

346 }

347 if (options.waitMs !== undefined && options.waitMs < 0) {

348 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

349 }

350 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

351 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

352 }

353}

354function reconnectBackoff(attempt) {

355 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

356}

357function redactConnectionUrl(url) {

358 try {

359 const parsed = new URL(url);

360 if (parsed.username)

361 parsed.username = "redacted";

362 if (parsed.password)

363 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L363

364 if (parsed.search)

365 parsed.search = "?redacted";

366 parsed.hash = "";

367 return parsed.toString();

368 }

369 catch {

370 return "[invalid URL]";

371 }

372}

373function createRandomToken() {

374 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

375 return crypto.randomUUID();

376 }

377 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

378}

379function defaultSleep(ms) {

380 return new Promise((resolve) => setTimeout(resolve, ms));

381}

382function errorMessage(error) {

383 return error instanceof Error ? error.message : String(error);

src/index.tsView file

Lines 51-91typescript

51 .string()

52 .regex(/^\d+$/, "Expected a non-negative integer string")

53 .transform((value) => Number.parseInt(value, 10));

55const RedisLocksConfigSchema = z.object

Lines 516-556typescript

516 if (!key) throw new LeaseOptionsError("Lease key is required.");

517 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

518 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

519 }

520 if (options.waitMs !== undefined && options.waitMs < 0) {

521 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

522 }

523 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

524 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

525 }

526}

527

528function reconnectBackoff(attempt: number): number {

529 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

530}

531

532function redactConnectionUrl(url: string): string {

533 try {

534 const parsed = new URL(url);

535 if (parsed.username) parsed.username = "redacted";

536 if (parsed.password) parsed.password = "redacted";

Medium

Secret Pattern

Hardcoded password in src/index.ts

src/index.tsView on unpkg · L536

537 if (parsed.search) parsed.search = "?redacted";

538 parsed.hash = "";

539 return parsed.toString();

540 } catch {

541 return "[invalid URL]";

542 }

543}

544

545function createRandomToken(): string {

546 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

547 return crypto.randomUUID();

548 }

549

550 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

551}

552

553function defaultSleep(ms: number): Promise<void> {

554 return new Promise((resolve) => setTimeout(resolve, ms));

555}

556