registry / @cat-factory/server / 0.137.10

@cat-factory/server@0.137.10

Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis completed at 98.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 159 file(s), 1.06 MB of source, external domains: accounts.google.com, api.github.com, api.linear.app, api.search.brave.com, github.com, linear.app, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

13 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 170-210javascript

170 userId: c.get('user')?.id ?? null,

171 exp: Date.now() + 10 * 60 *

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const

dist/config/problems.jsView file

Lines 112-152javascript

112 remedy: 'Add a `[[d1_databases]]` entry with `binding = "TELEMETRY_DB"` to your wrangler.toml and create the database with `wrangler d1 create`.',

113 docsUrl: DOCS.envVars(ENV_VARS_ANCHORS.storageRetention),

114 },

115 AGENT_MODELS: {

116 summary

dist/github/GitHubAppAuth.d.tsView file

38patternName = private_key_rsa severity = critical line = 38 matchedText = /** App .... */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L38

dist/github/GitHubAppAuth.jsView file

184patternName = private_key_rsa severity = critical line = 184 matchedText = "the Git... " +

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.js

dist/github/GitHubAppAuth.jsView on unpkg · L184

Source & flagged code

13 flagged · loading source

dist/crypto/encoding.d.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code