@cat-factory/server@0.137.4: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@cat-factory/server@0.137.4: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

13 flagged · loading source

dist/crypto/encoding.d.tsView file

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8patternName = private_key_rsa severity = critical line = 8 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

dist/modules/tasks/TaskSourceController.jsView file

190return unavailable(c); L191: const task = await tasks.importService.import(param(c, 'workspaceId'), sourceParam(c), c.req.valid('json').ref); L192: return c.json(task, 201);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/modules/tasks/TaskSourceController.jsView on unpkg · L190

dist/crypto/encoding.jsView file

30patternName = private_key_rsa severity = critical line = 30 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L30

31patternName = private_key_rsa severity = critical line = 31 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L31

dist/config/problems.jsView file

132patternName = private_key_rsa severity = critical line = 132 matchedText = remedy: ...t.',

Critical

Secret Pattern

RSA private key in dist/config/problems.js

dist/config/problems.jsView on unpkg · L132

214patternName = private_key_rsa severity = critical line = 214 matchedText = throw pr... ` +

Critical

Secret Pattern

RSA private key in dist/config/problems.js

dist/config/problems.jsView on unpkg · L214

216patternName = private_key_rsa severity = critical line = 216 matchedText = 'and use....');

Critical

Secret Pattern

RSA private key in dist/config/problems.js

dist/config/problems.jsView on unpkg · L216

218patternName = private_key_rsa severity = critical line = 218 matchedText = if (!/--...)) {

Critical

Secret Pattern

RSA private key in dist/config/problems.js

dist/config/problems.jsView on unpkg · L218

dist/github/GitHubAppAuth.d.tsView file

38patternName = private_key_rsa severity = critical line = 38 matchedText = /** App .... */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L38

dist/github/GitHubAppAuth.jsView file

184patternName = private_key_rsa severity = critical line = 184 matchedText = "the Git... " +

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.js

dist/github/GitHubAppAuth.jsView on unpkg · L184

Source & flagged code

13 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 170-210javascript

170 userId: c.get('user')?.id ?? null,

171 exp: Date.now() + 10 * 60 *

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const

dist/config/problems.jsView file

Lines 112-152javascript

112 remedy: 'Add a `[[d1_databases]]` entry with `binding = "TELEMETRY_DB"` to your wrangler.toml and create the database with `wrangler d1 create`.',

113 docsUrl: DOCS.envVars(ENV_VARS_ANCHORS.storageRetention),

114 },

115 AGENT_MODELS: {

116 summary

dist/github/GitHubAppAuth.d.tsView file

38patternName = private_key_rsa severity = critical line = 38 matchedText = /** App .... */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L38

dist/github/GitHubAppAuth.jsView file

184patternName = private_key_rsa severity = critical line = 184 matchedText = "the Git... " +

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.js

dist/github/GitHubAppAuth.jsView on unpkg · L184

Lines 194-233javascript

194 }

195 return key;

196}

197/**

198 * Validate a GitHub App private key at config load and return the trimmed value: present, a PKCS#8

199 * PEM (not the PKCS#1 key GitHub hands out), with a base64 body that decodes. Without this the

200 * defect surfaces lazily at the FIRST installation-token mint — deep in a pipeline, long after

201 * boot — as an opaque `crypto.subtle.importKey` rejection or an `atob` `InvalidCharacterError`.

202 * Shared across the facades (the key backs the App JWT the same way on Node and the Worker) so a

203 * malformed key reads identically. Callers pass the value only when the App is otherwise

204 * configured (an unset key simply disables the App); `varKey` names the specific var so the

205 * default and privileged App keys report against their own names.

206 */

207export function requireGitHubAppPrivateKey(value, varKey = 'GITHUB_APP_PRIVATE_KEY') {

208 const help = ENV_HELP.GITHUB_APP_PRIVATE_KEY;

209 const problem = (remedy) => configProblem({ key: varKey, summary: help.summary, remedy, docsUrl: help.docsUrl });

210 const pem = value?.trim();

211 if (!pem)

212 throw problem(help.remedy);

213 if (/BEGIN RSA PRIVATE KEY/.test(pem)) {

214 throw problem(`${varKey} is a PKCS#1 key (\`-----BEGIN RSA PRIVATE KEY-----\`), which Web Crypto cannot ` +

Critical

Secret Pattern

RSA private key in dist/config/problems.js

dist/config/problems.jsView on unpkg · L214

215 'import. Convert it once with `openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pk8.pem` ' +

216 'and use the resulting `-----BEGIN PRIVATE KEY-----` file.');

217 }

218 if (!/-----BEGIN PRIVATE KEY-----/.test(pem) || !/-----END PRIVATE KEY-----/.test(pem)) {

219 throw problem(`${varKey} is not a PKCS#8 PEM — the \`-----BEGIN PRIVATE KEY-----\`/\`-----END PRIVATE KEY-----\` ` +

220 `boundary lines are missing. ${help.remedy}`);

221 }

222 try {

223 // Structurally decode the body: catches a truncated or mangled base64 payload that would

224 // otherwise reach `crypto.subtle.importKey` unvalidated and reject opaquely at first mint.

225 pkcs8PemToDer(pem);

226 }

227 catch {

228 throw problem(`${varKey} has PKCS#8 boundary lines but its body is not valid base64 — the key was likely ` +

229 `truncated or mangled on the way into the environment (e.g. newlines lost). ${help.remedy}`);

230 }

231 return pem;

232}

233//# sourceMappingURL=problems.js.map