registry / @beignet/provider-locks-redis / 0.0.35

@beignet/provider-locks-redis@0.0.35

Redis-backed lock and lease provider for Beignet

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chainNo supply-chain packaging signals triggered.

Manifest

WildcardDependency

scanned 2 file(s), 28.0 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

Lines 332-372javascript

332 throw new LeaseOptionsError("Lease key is required.");

333 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

334 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

335 }

336 if (options.waitMs !== undefined && options.waitMs < 0) {

337 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

338 }

339 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

340 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

341 }

342}

343function reconnectBackoff(attempt) {

344 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

345}

346function redactConnectionUrl(url) {

347 try {

348 const parsed = new URL(url);

349 if (parsed.username)

350 parsed.username = "redacted";

351 if (parsed.password)

352 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L352

353 if (parsed.search)

354 parsed.search = "?redacted";

355 parsed.hash = "";

356 return parsed.toString();

357 }

358 catch {

359 return "[invalid URL]";

360 }

361}

362function createRandomToken() {

363 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

364 return crypto.randomUUID();

365 }

366 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

367}

368function defaultSleep(ms) {

369 return new Promise((resolve) => setTimeout(resolve, ms));

370}

371function errorMessage(error) {

372 return error instanceof Error ? error.message : String(error);

src/index.tsView file

Lines 63-103typescript

63 DEFAULT_MAX_RETRIES_PER_REQUEST,

64 ),

65 CONNECT_MAX_ATTEMPTS: NumberString.default(DEFAULT_CONNECT_MAX_ATTEMPTS),

66}) satisfies z.ZodType<RedisLocksConfig>;

68/**

69 * Validated configuration for the Redis locks provider.

70 */

Source & flagged code

3 flagged · loading source

dist/index.jsView file

352patternName = generic_password severity = medium line = 352 matchedText = parsed.p...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L352

src/index.tsView file

539patternName = generic_password severity = medium line = 539 matchedText = if (pars...ed";

Medium

Secret Pattern

Hardcoded password in src/index.ts

src/index.tsView on unpkg · L539

83export interface RedisLocksClient { L84: eval( L85: script: string,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.tsView on unpkg · L83

Findings

3 Medium2 Low

MediumSecret Patterndist/index.js

MediumWildcard Dependency

MediumSecret Patternsrc/index.ts

LowScripts Present

LowEvalsrc/index.ts

Source & flagged code

3 flagged

dist/index.jsView file

Lines 332-372javascript

332 throw new LeaseOptionsError("Lease key is required.");

333 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

334 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

335 }

336 if (options.waitMs !== undefined && options.waitMs < 0) {

337 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

338 }

339 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

340 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

341 }

342}

343function reconnectBackoff(attempt) {

344 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

345}

346function redactConnectionUrl(url) {

347 try {

348 const parsed = new URL(url);

349 if (parsed.username)

350 parsed.username = "redacted";

351 if (parsed.password)

352 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L352

353 if (parsed.search)

354 parsed.search = "?redacted";

355 parsed.hash = "";

356 return parsed.toString();

357 }

358 catch {

359 return "[invalid URL]";

360 }

361}

362function createRandomToken() {

363 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

364 return crypto.randomUUID();

365 }

366 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

367}

368function defaultSleep(ms) {

369 return new Promise((resolve) => setTimeout(resolve, ms));

370}

371function errorMessage(error) {

372 return error instanceof Error ? error.message : String(error);

src/index.tsView file

Lines 63-103typescript

63 DEFAULT_MAX_RETRIES_PER_REQUEST,

64 ),

65 CONNECT_MAX_ATTEMPTS: NumberString.default(DEFAULT_CONNECT_MAX_ATTEMPTS),

66}) satisfies z.ZodType<RedisLocksConfig>;

68/**

69 * Validated configuration for the Redis locks provider.

70 */

Lines 519-559typescript

519 if (!key) throw new LeaseOptionsError("Lease key is required.");

520 if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {

521 throw new LeaseOptionsError("Lease ttlMs must be a positive number.");

522 }

523 if (options.waitMs !== undefined && options.waitMs < 0) {

524 throw new LeaseOptionsError("Lease waitMs must be zero or greater.");

525 }

526 if (options.retryDelayMs !== undefined && options.retryDelayMs <= 0) {

527 throw new LeaseOptionsError("Lease retryDelayMs must be positive.");

528 }

529}

530

531function reconnectBackoff(attempt: number): number {

532 return Math.min(2 ** attempt * 100, RECONNECT_BACKOFF_CAP_MS);

533}

534

535function redactConnectionUrl(url: string): string {

536 try {

537 const parsed = new URL(url);

538 if (parsed.username) parsed.username = "redacted";

539 if (parsed.password) parsed.password = "redacted";

Medium

Secret Pattern

Hardcoded password in src/index.ts

src/index.tsView on unpkg · L539

540 if (parsed.search) parsed.search = "?redacted";

541 parsed.hash = "";

542 return parsed.toString();

543 } catch {

544 return "[invalid URL]";

545 }

546}

547

548function createRandomToken(): string {

549 if (typeof crypto !== "undefined" && "randomUUID" in crypto) {

550 return crypto.randomUUID();

551 }

552

553 return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;

554}

555

556function defaultSleep(ms: number): Promise<void> {

557 return new Promise((resolve) => setTimeout(resolve, ms));

558}

559