registry / @cat-factory/server / 0.64.1

@cat-factory/server@0.64.1

Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Observed network and token handling are user-invoked HTTP server/OAuth/proxy features matching the package description.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package exposes server controllers and helpers; network calls occur only through invoked routes or helper methods.

Impact

No evidence of unconsented credential harvesting, exfiltration, persistence, destructive behavior, or install-time execution.

Mechanism

runtime-neutral Hono server controllers and fetch-based upstream clients

Rationale

Static source inspection shows a legitimate runtime-neutral HTTP server package with user-invoked controllers, OAuth clients, and proxy helpers; the scanner's secret and dynamic-require hints are explained by PEM documentation/parsing and normal route code. No install-time execution, hidden payload, exfiltration, or persistence behavior was identified.

Evidence

package.jsondist/index.jsdist/app.jsdist/modules/tasks/TaskSourceController.jsdist/crypto/encoding.jsdist/crypto/encoding.d.tsdist/modules/webSearch/upstreams.jsdist/modules/llmProxy/LlmProxyController.jsdist/auth/GitHubOAuth.jsdist/auth/GoogleOAuth.jsdist/auth/LinearOAuth.js

Network endpoints8

github.comapi.github.comaccounts.google.comwww.googleapis.comoauth2.googleapis.com/tokenlinear.appapi.linear.app/oauth/tokenapi.search.brave.com/res/v1/web/search

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; main is dist/index.js exports only.
dist/modules/tasks/TaskSourceController.js contains Hono route handlers for task integrations; no dynamic require/import found.
dist/crypto/encoding.d.ts and dist/crypto/encoding.js only document/parse caller-supplied PEM text; no embedded secret present.
Network use is runtime API/OAuth/proxy behavior aligned with server package: GitHub, Google, Linear, Brave/SearXNG, LLM upstreams.
Search found no child_process, eval, Function, native binary loading, or filesystem writes.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 121 file(s), 698 KB of source, external domains: accounts.google.com, api.github.com, api.linear.app, api.search.brave.com, github.com, linear.app, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

7 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 142-182javascript

142 workspaceId,

143 userId: c.get('user')?.id ?? null,

144 exp: Date.now() + 10 * 60 * 1000,

145 });

146

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const byte of bytes)

15 binary +=

dist/github/GitHubAppAuth.d.tsView file

Lines 1-24typescript

1import type { Clock, GitHubInstallationRepository, InstallationPermissions } from '@cat-factory/kernel';

2export interface GitHubAppAuthDependencies {

3 appId: string;

4 /** App private key in PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`). */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4

Source & flagged code

7 flagged · loading source

dist/crypto/encoding.d.tsView file

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8patternName = private_key_rsa severity = critical line = 8 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

dist/modules/tasks/TaskSourceController.jsView file

162return unavailable(c); L163: const task = await tasks.importService.import(param(c, 'workspaceId'), sourceParam(c), c.req.valid('json').ref); L164: return c.json(task, 201);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/modules/tasks/TaskSourceController.jsView on unpkg · L162

dist/crypto/encoding.jsView file

30patternName = private_key_rsa severity = critical line = 30 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L30

31patternName = private_key_rsa severity = critical line = 31 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L31

dist/github/GitHubAppAuth.d.tsView file

4patternName = private_key_rsa severity = critical line = 4 matchedText = /** App .... */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4

Findings

6 Critical2 Medium5 Low

CriticalCritical Secretdist/crypto/encoding.d.ts

CriticalSecret Patterndist/crypto/encoding.d.ts

CriticalSecret Patterndist/crypto/encoding.js

CriticalSecret Patterndist/github/GitHubAppAuth.d.ts

MediumDynamic Requiredist/modules/tasks/TaskSourceController.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 142-182javascript

142 workspaceId,

143 userId: c.get('user')?.id ?? null,

144 exp: Date.now() + 10 * 60 * 1000,

145 });

146

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const byte of bytes)

15 binary +=

dist/github/GitHubAppAuth.d.tsView file

Lines 1-24typescript

1import type { Clock, GitHubInstallationRepository, InstallationPermissions } from '@cat-factory/kernel';

2export interface GitHubAppAuthDependencies {

3 appId: string;

4 /** App private key in PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`). */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4