registry / @bentlyr/midown / 1.3.2

@bentlyr/midown@1.3.2

Headless local context engine and CLI to map codebase dependencies for AI consumption.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 124 KB of source, external domains: api.anthropic.com, api.openai.com, cdnjs.cloudflare.com, generativelanguage.googleapis.com, hmljmijzfkiivjxzqgri.supabase.co, openrouter.ai, registry.npmjs.org

Source & flagged code

5 flagged

dist/storage/auth.jsView file

Lines 1-30javascript

1import { createClient } from "@supabase/supabase-js";

2import { readConfig, updateConfig } from "./config.js";

3/**

4 * Validates a user against Supabase Auth and pulls their status from your custom subscriptions table.

5 */

6export async function authenticateUser(email, password) {

7 const config = await readConfig();

8 // 1. Resolve keys: Prioritize live .env values, fallback to config.json, fallback to hardcoded prod keys

9 const supabaseUrl = process.env.MIDOWN_SUPABASE_URL || config.supabaseUrl || "https://hmljmijzfkiivjxzqgri.supabase.co";

10 const supabaseAnonKey = process.env.MIDOWN_SUPABASE_ANON_KEY || config.supabaseAnonKey || "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImhtbGptaWp6ZmtpaXZqeHpxZ3JpIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODI4MjYyNTIsImV4cCI6MjA5ODQwMjI1Mn0.kSF09ZK2zSf-JnVoACpkJtXOTspqO6cywNCpft2OnyQ";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/storage/auth.jsView on unpkg · L10

Critical

Secret Pattern

Supabase service role key (JWT) in dist/storage/auth.js

dist/storage/auth.jsView on unpkg · L10

11 // 2. Trigger dev sandbox simulator if no keys are found anywhere

12 if (!supabaseUrl || !supabaseAnonKey || supabaseUrl.includes("your-project-id")) {

13 const mockId = "00000000-0000-0000-0000-000000000000";

14 const mockToken = `sb_mock_token_${Buffer.from(email).toString("base64")}`;

15 await updateConfig({ supabaseSession: mockToken });

16 return {

17 userId: mockId,

18 email: email,

19 fullName: email.split("@")[0],

20 plan: "free",

21 status: "trialing"

22 };

23 }

24 try {

25 // 3. Fire real cloud backend connection

26 const supabase = createClient(supabaseUrl, supabaseAnonKey);

27 const { data: authData, error: authError } = await supabase.auth.signInWithPassword({

28 email,

29 password

30 });

Lines 48-88javascript

48 userId,

49 email: authData.user.email || email,

50 fullName: profile?.full_name || null,

51 plan: (subscription?.plan || "free"),

52 status: (subscription?.status || "trialing")

53 };

54 }

src/assets/icon.icnsView file

•path = src/assets/icon.icns kind = high_entropy_blob sizeBytes = 240029 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/icon.icnsView on unpkg

dist/storage/visualize.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bentlyr/midown@1.3.4 matchedIdentity = npm:QGJlbnRseXIvbWlkb3du:1.3.4 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/storage/visualize.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/storage/auth.jsView file

10patternName = supabase_service_key severity = critical line = 10 matchedText = const su...yQ";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/storage/auth.jsView on unpkg · L10

10patternName = supabase_service_key severity = critical line = 10 matchedText = const su...yQ";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/storage/auth.js

dist/storage/auth.jsView on unpkg · L10

68patternName = supabase_service_key severity = critical line = 68 matchedText = const su...yQ";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/storage/auth.js

dist/storage/auth.jsView on unpkg · L68

src/assets/icon.icnsView file

•path = src/assets/icon.icns kind = high_entropy_blob sizeBytes = 240029 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/icon.icnsView on unpkg

dist/storage/visualize.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/storage/visualize.jsView on unpkg

Findings

3 Critical2 High3 Medium5 Low

CriticalCritical Secretdist/storage/auth.js

CriticalSecret Patterndist/storage/auth.js

HighShips High Entropy Blobsrc/assets/icon.icns

HighPrevious Version Dangerous Deltadist/storage/visualize.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/storage/auth.jsView file

Lines 1-30javascript

1import { createClient } from "@supabase/supabase-js";

2import { readConfig, updateConfig } from "./config.js";

3/**

4 * Validates a user against Supabase Auth and pulls their status from your custom subscriptions table.

5 */

6export async function authenticateUser(email, password) {

7 const config = await readConfig();

8 // 1. Resolve keys: Prioritize live .env values, fallback to config.json, fallback to hardcoded prod keys

9 const supabaseUrl = process.env.MIDOWN_SUPABASE_URL || config.supabaseUrl || "https://hmljmijzfkiivjxzqgri.supabase.co";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/storage/auth.jsView on unpkg · L10

Critical

Secret Pattern

Supabase service role key (JWT) in dist/storage/auth.js

dist/storage/auth.jsView on unpkg · L10

11 // 2. Trigger dev sandbox simulator if no keys are found anywhere

12 if (!supabaseUrl || !supabaseAnonKey || supabaseUrl.includes("your-project-id")) {

13 const mockId = "00000000-0000-0000-0000-000000000000";

14 const mockToken = `sb_mock_token_${Buffer.from(email).toString("base64")}`;

15 await updateConfig({ supabaseSession: mockToken });

16 return {

17 userId: mockId,

18 email: email,

19 fullName: email.split("@")[0],

20 plan: "free",

21 status: "trialing"

22 };

23 }

24 try {

25 // 3. Fire real cloud backend connection

26 const supabase = createClient(supabaseUrl, supabaseAnonKey);

27 const { data: authData, error: authError } = await supabase.auth.signInWithPassword({

28 email,

29 password

30 });

Lines 48-88javascript

48 userId,

49 email: authData.user.email || email,

50 fullName: profile?.full_name || null,

51 plan: (subscription?.plan || "free"),

52 status: (subscription?.status || "trialing")

53 };

54 }

src/assets/icon.icnsView file

•path = src/assets/icon.icns kind = high_entropy_blob sizeBytes = 240029 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/icon.icnsView on unpkg

dist/storage/visualize.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/storage/visualize.jsView on unpkg