registry / @bloodsbro/nuxt-auth-utils / 0.6.4

@bloodsbro/nuxt-auth-utils@0.6.4

Add Authentication to Nuxt applications with secured & sealed cookies sessions.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

WildcardDependency

scanned 72 file(s), 167 KB of source, external domains: access.line.me, account.box.com, accounts.google.com, accounts.livechat.com, accounts.spotify.com, api-m.paypal.com, api.atlassian.com, api.box.com, api.dropboxapi.com, api.github.com, api.heroku.com, api.hubapi.com, api.instagram.com, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.polar.sh, api.spotify.com, api.steampowered.com, api.twitch.tv, api.workos.com, api.x.com, apis.roblox.com, app.hubspot.com, appleid.apple.com, auth.atlassian.com, auth.riotgames.com, discord.com, gitea.com, github.com, gitlab.com, graph.facebook.com, graph.instagram.com, graph.microsoft.com, id.heroku.com, id.kick.com, id.twitch.tv, id.vk.ru, linear.app, login.microsoftonline.com, login.salesforce.com, login.szn.cz, login.yandex.ru, oauth.battle.net, oauth.battlenet.com.cn, oauth.yandex.ru, oauth2.googleapis.com, open.tiktokapis.com, osu.ppy.sh

Source & flagged code

3 flagged

dist/runtime/server/lib/oauth/apple.d.tsView file

Lines 1-40typescript

1import type { OAuthConfig } from '#auth-utils';

2export interface OAuthAppleConfig {

3 /**

4 * Apple OAuth Client ID

5 * @default process.env.NUXT_OAUTH_APPLE_CLIENT_ID

6 */

7 clientId?: string;

8 /**

9 * Apple OAuth team ID

10 * @default process.env.NUXT_OAUTH_APPLE_TEAM_ID

11 */

12 teamId?: string;

13 /**

14 * Apple OAuth key identifier

15 * @default process.env.NUXT_OAUTH_APPLE_KEY_ID

16 */

17 keyId?: string;

18 /**

19 * Apple OAuth Private Key. Linebreaks must be replaced with \n

20 * @example '-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM...\n-----END PRIVATE KEY-----'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

Critical

Secret Pattern

RSA private key in dist/runtime/server/lib/oauth/apple.d.ts

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

21 * @default process.env.NUXT_OAUTH_APPLE_PRIVATE_KEY

22 */

23 privateKey?: string;

24 /**

25 * Apple OAuth Scope. Apple wants this to be a string separated by spaces, but for consistency with other providers, we also allow an array of strings.

26 * @default ''

27 * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope

28 * @example 'name email'

29 */

30 scope?: string | string[];

31 /**

32 * Apple OAuth Authorization URL

33 * @default 'https://appleid.apple.com/auth/authorize'

34 */

35 authorizationURL?: string;

36 /**

37 * Extra authorization parameters to provide to the authorization URL

38 * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope

39 * @example { usePop: true }

40 */

dist/module.mjsView file

Lines 27-67javascript

27 const composables = [

28 { name: "useUserSession", from: resolver.resolve("./runtime/app/composables/session") }

29 ];

30 if (options.webAuthn) {

31 composables.push({ name: "useWebAuthn", from: resolver.resolve("./runtime/app/composables/webauthn") });

32 }

Source & flagged code

3 flagged · loading source

dist/runtime/server/lib/oauth/apple.d.tsView file

20patternName = private_key_rsa severity = critical line = 20 matchedText = * @examp...---'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

20patternName = private_key_rsa severity = critical line = 20 matchedText = * @examp...---'

Critical

Secret Pattern

RSA private key in dist/runtime/server/lib/oauth/apple.d.ts

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

dist/module.mjsView file

47for (const pkg of peerDeps) { L48: await import(pkg).catch(() => { L49: missingDeps.push(pkg);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/module.mjsView on unpkg · L47

Findings

2 Critical4 Medium3 Low

CriticalCritical Secretdist/runtime/server/lib/oauth/apple.d.ts

CriticalSecret Patterndist/runtime/server/lib/oauth/apple.d.ts

MediumDynamic Requiredist/module.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

dist/runtime/server/lib/oauth/apple.d.tsView file

Lines 1-40typescript

1import type { OAuthConfig } from '#auth-utils';

2export interface OAuthAppleConfig {

3 /**

4 * Apple OAuth Client ID

5 * @default process.env.NUXT_OAUTH_APPLE_CLIENT_ID

6 */

7 clientId?: string;

8 /**

9 * Apple OAuth team ID

10 * @default process.env.NUXT_OAUTH_APPLE_TEAM_ID

11 */

12 teamId?: string;

13 /**

14 * Apple OAuth key identifier

15 * @default process.env.NUXT_OAUTH_APPLE_KEY_ID

16 */

17 keyId?: string;

18 /**

19 * Apple OAuth Private Key. Linebreaks must be replaced with \n

20 * @example '-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM...\n-----END PRIVATE KEY-----'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

Critical

Secret Pattern

RSA private key in dist/runtime/server/lib/oauth/apple.d.ts

dist/runtime/server/lib/oauth/apple.d.tsView on unpkg · L20

21 * @default process.env.NUXT_OAUTH_APPLE_PRIVATE_KEY

22 */

23 privateKey?: string;

24 /**

25 * Apple OAuth Scope. Apple wants this to be a string separated by spaces, but for consistency with other providers, we also allow an array of strings.

26 * @default ''

27 * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope

28 * @example 'name email'

29 */

30 scope?: string | string[];

31 /**

32 * Apple OAuth Authorization URL

33 * @default 'https://appleid.apple.com/auth/authorize'

34 */

35 authorizationURL?: string;

36 /**

37 * Extra authorization parameters to provide to the authorization URL

38 * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope

39 * @example { usePop: true }

40 */

dist/module.mjsView file

Lines 27-67javascript

27 const composables = [

28 { name: "useUserSession", from: resolver.resolve("./runtime/app/composables/session") }

29 ];

30 if (options.webAuthn) {

31 composables.push({ name: "useWebAuthn", from: resolver.resolve("./runtime/app/composables/webauthn") });

32 }