registry / @blamejs/core / 0.16.0

@blamejs/core@0.16.0

⚠ Under review

The Node framework that owns its stack.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 566 file(s), 14.5 MB of source, external domains: accounts.google.com, api.github.com, api.hcaptcha.com, api.pwnedpasswords.com, api.resend.com, app.example.com, appleid.apple.com, attacker.example, attacker.tld, bimigroup.org, blamejs.com, c2pa.org, challenges.cloudflare.com, cloudflare-dns.com, datatracker.ietf.org, dns.google, dns.quad9.net, docs.example.com, example.com, financialdataexchange.org, github.com, json-schema.org, login.microsoftonline.com, mds.fidoalliance.org, mds3.fidoalliance.org, nvd.nist.gov, oauth2.googleapis.com, placeholder.invalid, publicsuffix.org, s3.amazonaws.com, schemas.dmtf.org, schemas.microsoft.com, schemas.openid.net, schemas.xmlsoap.org, simplewebauthn.dev, storage.googleapis.com, www.apache.org, www.google.com, www.googleapis.com, www.rfc-editor.org, www.w3.org, x.com

Source & flagged code

9 flagged

lib/mail-crypto-pgp.jsView file

Lines 62-102javascript

62 * Symmetrically Encrypted Integrity Protected Data packets,

63 * RFC 9580 §5.1 / §5.13) as `b.mail.crypto.pgp.encrypt` /

64 * `.decrypt`, and WKD key discovery (draft-koch-openpgp-webkey-

65 * service) as `b.mail.crypto.pgp.wkd` — all on the same `b.cms`

66 * substrate that backs S/MIME sign/verify.

67 *

68 * Deferred (with the documented condition for opting in):

69 * - v6 signature packets (RFC 9580 §5.2.3, packet version 6 with

70 * SHA2-512 fingerprints and salted hashes). Defer condition: v6

71 * is not yet emitted by GnuPG 2.4 LTS or by Sequoia stable, so

72 * v6 output would fail to verify on the majority of fielded

73 * receivers. Reopen when at least two major implementations

74 * ship v6 signature verification by default. Cheap escape

75 * hatch: operators on v6-only systems can ingest the v4

76 * signature from this module and re-sign with their own

77 * v6-capable toolchain.

78 *

79 * Surface:

80 * var sigBundle = b.mail.crypto.pgp.sign({

81 * message: "rfc822 body bytes",

82 * privateKeyPem: "-----BEGIN PRIVATE KEY----- ...",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/mail-crypto-pgp.jsView on unpkg · L82

Critical

Secret Pattern

RSA private key in lib/mail-crypto-pgp.js

lib/mail-crypto-pgp.jsView on unpkg · L82

83 * passphrase: undefined | "...", // optional

84 * audit: opts.audit, // optional b.audit handle

85 * });

86 * // → { armored: "-----BEGIN PGP SIGNATURE----- ...",

87 * // multipartSigned: <Buffer ...>, // RFC 3156 wrapper bytes

88 * // signedAt: epochSeconds, fingerprint: "abcd..." }

89 *

90 * var rv = b.mail.crypto.pgp.verify({

91 * message: "the signed payload bytes",

92 * armored: "-----BEGIN PGP SIGNATURE----- ...",

93 * publicKeyPem: "-----BEGIN PUBLIC KEY----- ...",

94 * audit: opts.audit,

95 * });

96 * // → { ok: true, signerFingerprint: "abcd...", signedAt: epoch, hashAlg: "sha256" }

97 *

98 * The signer's `message` MUST be the canonicalized payload that the

99 * verifier will recompute over. For `multipart/signed` per RFC 3156

100 * §5, the canonical form is the signed part's full MIME headers +

101 * body with CRLF line endings — operators producing such a body

102 * should pass exactly those bytes here.

bin/blamejs.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2"use strict";

3// Thin entrypoint — all dispatch logic lives in lib/cli.js so it can

4// be driven from tests without spawning a child process.

5var cli = require("../lib/cli");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/blamejs.jsView on unpkg · L4

7cli.main(process.argv.slice(2

lib/ws-client.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * b.wsClient — outbound WebSocket client (RFC 6455).

4 *

5 * Companion to b.websocket (server-side). Operators dial out to peer

6 * WebSocket endpoints from Node — webhooks, pubsub bridges, integration

7 * with external realtime services — without reaching for `ws` from

8 * npm.

9 *

10 * var client = b.wsClient.connect("wss://stream.example.com/v1", {

11 * subprotocols: ["json-stream-v1"],

lib/middleware/body-parser.jsView file

Lines 579-619javascript

579// BODY streaming part body; watch for \r\n--<boundary>

580// DONE all parts read

581

582var MP_INITIAL = 0;

583var MP_AFTER_BD = 1;

584var MP_HEADERS = 2;

585var

lib/guard-filename.jsView file

•Trigger-reachable chain: manifest.main -> index.js -> lib/guard-filename.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/guard-filename.jsView on unpkg

lib/redact.jsView file

Lines 106-146javascript

106 // URL with bearer-shaped query parameter — the parent field is

107 // typically `url` or `referer`, neither of which the field-name

108 // pass redacts. Replace the whole querystring after the marker

109 // so the path stays useful for log triage.

110 name: "url-bearer-query",

111 test: function (v) {

112 return typeof v

Source & flagged code

9 flagged · loading source

lib/mail-crypto-pgp.jsView file

82patternName = private_key_rsa severity = critical line = 82 matchedText = * .....",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/mail-crypto-pgp.jsView on unpkg · L82

82patternName = private_key_rsa severity = critical line = 82 matchedText = * .....",

Critical

Secret Pattern

RSA private key in lib/mail-crypto-pgp.js

lib/mail-crypto-pgp.jsView on unpkg · L82

bin/blamejs.jsView file

4// be driven from tests without spawning a child process. L5: var cli = require("../lib/cli"); L6:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/blamejs.jsView on unpkg · L4

lib/ws-client.jsView file

2/** L3: * b.wsClient — outbound WebSocket client (RFC 6455). L4: * ... L18: * L19: * client.on("open", function () { client.send({ subscribe: ["orders"] }); }); L20: * client.on("message", function (data, isBinary) { ... }); ... L24: * client.send("text frame"); L25: * client.send(Buffer.from("binary frame")); L26: * client.close(1000, "bye"); ... L199: L200: // Operators with a non-RFC-6455 GUID (private protocols on top of L201: // the WebSocket framing layer, framework-specific handshake variants)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/ws-client.jsView on unpkg · L2

lib/middleware/body-parser.jsView file

599contains invisible/control Unicode U+202E (right-to-left override) // `Photo01By<U+202E>gpj.SCR` displays as `Photo01By.jpg` in audit

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/middleware/body-parser.jsView on unpkg · L599

lib/guard-filename.jsView file

•Trigger-reachable chain: manifest.main -> index.js -> lib/guard-filename.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/guard-filename.jsView on unpkg

lib/redact.jsView file

126patternName = private_key_openssh severity = critical line = 126 matchedText = test: ...; },

Critical

Secret Pattern

OpenSSH private key in lib/redact.js

lib/redact.jsView on unpkg · L126

428patternName = private_key_openssh severity = critical line = 428 matchedText = detect: ...; },

Critical

Secret Pattern

OpenSSH private key in lib/redact.js

lib/redact.jsView on unpkg · L428

267patternName = generic_password severity = medium line = 267 matchedText = * // ...D]",

Medium

Secret Pattern

Hardcoded password in lib/redact.js

lib/redact.jsView on unpkg · L267

Findings

6 Critical6 Medium6 Low

CriticalCritical Secretlib/mail-crypto-pgp.js

CriticalTrojan Source Unicodelib/middleware/body-parser.js

CriticalTrigger Reachable Dangerous Capabilitylib/guard-filename.js

CriticalSecret Patternlib/mail-crypto-pgp.js

CriticalSecret Patternlib/redact.js

MediumDynamic Requirebin/blamejs.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patternlib/redact.js

LowScripts Present

LowWeak Cryptolib/ws-client.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

lib/mail-crypto-pgp.jsView file

Lines 62-102javascript

62 * Symmetrically Encrypted Integrity Protected Data packets,

63 * RFC 9580 §5.1 / §5.13) as `b.mail.crypto.pgp.encrypt` /

64 * `.decrypt`, and WKD key discovery (draft-koch-openpgp-webkey-

65 * service) as `b.mail.crypto.pgp.wkd` — all on the same `b.cms`

66 * substrate that backs S/MIME sign/verify.

67 *

68 * Deferred (with the documented condition for opting in):

69 * - v6 signature packets (RFC 9580 §5.2.3, packet version 6 with

70 * SHA2-512 fingerprints and salted hashes). Defer condition: v6

71 * is not yet emitted by GnuPG 2.4 LTS or by Sequoia stable, so

72 * v6 output would fail to verify on the majority of fielded

73 * receivers. Reopen when at least two major implementations

74 * ship v6 signature verification by default. Cheap escape

75 * hatch: operators on v6-only systems can ingest the v4

76 * signature from this module and re-sign with their own

77 * v6-capable toolchain.

78 *

79 * Surface:

80 * var sigBundle = b.mail.crypto.pgp.sign({

81 * message: "rfc822 body bytes",

82 * privateKeyPem: "-----BEGIN PRIVATE KEY----- ...",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/mail-crypto-pgp.jsView on unpkg · L82

Critical

Secret Pattern

RSA private key in lib/mail-crypto-pgp.js

lib/mail-crypto-pgp.jsView on unpkg · L82

83 * passphrase: undefined | "...", // optional

84 * audit: opts.audit, // optional b.audit handle

85 * });

86 * // → { armored: "-----BEGIN PGP SIGNATURE----- ...",

87 * // multipartSigned: <Buffer ...>, // RFC 3156 wrapper bytes

88 * // signedAt: epochSeconds, fingerprint: "abcd..." }

89 *

90 * var rv = b.mail.crypto.pgp.verify({

91 * message: "the signed payload bytes",

92 * armored: "-----BEGIN PGP SIGNATURE----- ...",

93 * publicKeyPem: "-----BEGIN PUBLIC KEY----- ...",

94 * audit: opts.audit,

95 * });

96 * // → { ok: true, signerFingerprint: "abcd...", signedAt: epoch, hashAlg: "sha256" }

97 *

98 * The signer's `message` MUST be the canonicalized payload that the

99 * verifier will recompute over. For `multipart/signed` per RFC 3156

100 * §5, the canonical form is the signed part's full MIME headers +

101 * body with CRLF line endings — operators producing such a body

102 * should pass exactly those bytes here.

bin/blamejs.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2"use strict";

3// Thin entrypoint — all dispatch logic lives in lib/cli.js so it can

4// be driven from tests without spawning a child process.

5var cli = require("../lib/cli");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/blamejs.jsView on unpkg · L4

7cli.main(process.argv.slice(2

lib/ws-client.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * b.wsClient — outbound WebSocket client (RFC 6455).

4 *

5 * Companion to b.websocket (server-side). Operators dial out to peer

6 * WebSocket endpoints from Node — webhooks, pubsub bridges, integration

7 * with external realtime services — without reaching for `ws` from

8 * npm.

9 *

10 * var client = b.wsClient.connect("wss://stream.example.com/v1", {

11 * subprotocols: ["json-stream-v1"],

lib/middleware/body-parser.jsView file

Lines 579-619javascript

579// BODY streaming part body; watch for \r\n--<boundary>

580// DONE all parts read

581

582var MP_INITIAL = 0;

583var MP_AFTER_BD = 1;

584var MP_HEADERS = 2;

585var

lib/guard-filename.jsView file

•Trigger-reachable chain: manifest.main -> index.js -> lib/guard-filename.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/guard-filename.jsView on unpkg

lib/redact.jsView file

Lines 106-146javascript

106 // URL with bearer-shaped query parameter — the parent field is

107 // typically `url` or `referer`, neither of which the field-name

108 // pass redacts. Replace the whole querystring after the marker

109 // so the path stays useful for log triage.

110 name: "url-bearer-query",

111 test: function (v) {

112 return typeof v