registry / @benzid.wael/secure-vault / 0.1.9

@benzid.wael/secure-vault@0.1.9

A secure password management application built with Electron and React

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 247 KB of source, external domains: api.example.com

Source & flagged code

4 flagged

src/electron/services/VaultService.jsView file

Lines 275-315javascript

275

276 // Test decryption before saving

277 const testKey = CryptographyService.deriveKey(newPassword, newSalt);

278 const testEncryptedData = {

279 encrypted: finalVaultFile.encrypted,

280 authTag: finalVaultFile.authTag,

281 iv: finalVaultFile.iv,

282 };

283 CryptographyService.decrypt(testEncryptedData, testKey);

284

285 // Atomically write the new vault file

286 await this.fileService.atomicWriteVaultFile(vaultName, finalVaultFile);

287

288 return { success: true };

289 } catch (error) {

290 // Restore from backup on error

291 await this.fileService.restoreFromBackup(vaultName);

292 throw error;

293 }

294 } catch (error) {

295 console.error('Error changing password:', error);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/electron/services/VaultService.jsView on unpkg · L295

296 return { success: false, error: 'Failed to change master password' };

297 }

298 }

299

300 async deleteVault(vaultName, confirmationPassword = null) {

301 try {

302 if (!(await this.fileService.vaultExists(vaultName))) {

303 return { success: false, error: 'Vault not found' };

304 }

305

306 if (vaultName === 'default' && !confirmationPassword) {

307 return {

308 success: false,

309 error: 'Cannot delete default vault without password confirmation',

310 };

311 }

312

313 // Verify password if provided

314 if (confirmationPassword) {

315 const verification = await this.verifyPassword(

package.jsonView file

Lines 7-47json

7 "homepage": "./",

8 "license": "MIT",

9 "author": {

10 "name": "Wael Ben Zid",

11 "email": "benzid.wael@hotmail.fr"

12 },

13 "repository": {

bin/commands/env.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @benzid.wael/secure-vault@0.1.7 matchedIdentity = npm:[redacted]:0.1.7 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/commands/env.jsView on unpkg

src/electron/services/recovery/PasswordRecoveryService.jsView file

Lines 104-129javascript

104

105 /**

106 * recover master password

107 * @param {string} vaultName

108 * @param {Object} metadata

109 * @param {Object} recoveryData

110 * @returns {Promise<Object>}

Source & flagged code

4 flagged · loading source

src/electron/services/VaultService.jsView file

295patternName = generic_password severity = medium line = 295 matchedText = console....or);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/electron/services/VaultService.jsView on unpkg · L295

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

bin/commands/env.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/commands/env.jsView on unpkg

src/electron/services/recovery/PasswordRecoveryService.jsView file

124patternName = generic_password severity = medium line = 124 matchedText = console....or);

Medium

Secret Pattern

Hardcoded password in src/electron/services/recovery/PasswordRecoveryService.js

src/electron/services/recovery/PasswordRecoveryService.jsView on unpkg · L124

Findings

2 High3 Medium5 Low

HighNode Builtin Dependency Squatpackage.json

HighPrevious Version Dangerous Deltabin/commands/env.js

MediumSecret Patternsrc/electron/services/VaultService.js

MediumEnvironment Vars

MediumSecret Patternsrc/electron/services/recovery/PasswordRecoveryService.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/electron/services/VaultService.jsView file

Lines 275-315javascript

275

276 // Test decryption before saving

277 const testKey = CryptographyService.deriveKey(newPassword, newSalt);

278 const testEncryptedData = {

279 encrypted: finalVaultFile.encrypted,

280 authTag: finalVaultFile.authTag,

281 iv: finalVaultFile.iv,

282 };

283 CryptographyService.decrypt(testEncryptedData, testKey);

284

285 // Atomically write the new vault file

286 await this.fileService.atomicWriteVaultFile(vaultName, finalVaultFile);

287

288 return { success: true };

289 } catch (error) {

290 // Restore from backup on error

291 await this.fileService.restoreFromBackup(vaultName);

292 throw error;

293 }

294 } catch (error) {

295 console.error('Error changing password:', error);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/electron/services/VaultService.jsView on unpkg · L295

296 return { success: false, error: 'Failed to change master password' };

297 }

298 }

299

300 async deleteVault(vaultName, confirmationPassword = null) {

301 try {

302 if (!(await this.fileService.vaultExists(vaultName))) {

303 return { success: false, error: 'Vault not found' };

304 }

305

306 if (vaultName === 'default' && !confirmationPassword) {

307 return {

308 success: false,

309 error: 'Cannot delete default vault without password confirmation',

310 };

311 }

312

313 // Verify password if provided

314 if (confirmationPassword) {

315 const verification = await this.verifyPassword(

package.jsonView file

Lines 7-47json

7 "homepage": "./",

8 "license": "MIT",

9 "author": {

10 "name": "Wael Ben Zid",

11 "email": "benzid.wael@hotmail.fr"

12 },

13 "repository": {

bin/commands/env.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/commands/env.jsView on unpkg

src/electron/services/recovery/PasswordRecoveryService.jsView file

Lines 104-129javascript

104

105 /**

106 * recover master password

107 * @param {string} vaultName

108 * @param {Object} metadata

109 * @param {Object} recoveryData

110 * @returns {Promise<Object>}