registry / @cat-factory/server / 0.70.0

@cat-factory/server@0.70.0

Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The suspicious scanner hits are explained by normal server OAuth, GitHub, web-search, token signing, and credential-handling APIs.

Static reason

One or more suspicious static signals were detected.

Trigger

User/runtime HTTP route calls or explicit library use; no install-time trigger.

Impact

No unauthorized exfiltration, persistence, destructive action, or lifecycle execution identified.

Mechanism

Runtime-neutral Hono server controllers and integration clients

Rationale

Static source inspection shows a legitimate server package with user-invoked integration routes and no lifecycle/import-time payload or unconsented data collection. Scanner signals are false positives from declarations, comments, and package-aligned network/token handling.

Evidence

package.jsondist/index.jsdist/modules/tasks/TaskSourceController.jsdist/crypto/encoding.jsdist/modules/webSearch/upstreams.jsdist/auth/GitHubOAuth.jsdist/auth/GoogleOAuth.jsdist/auth/LinearOAuth.js

Network endpoints8

api.search.brave.com/res/v1/web/searchlinear.appapi.linear.app/oauth/tokenaccounts.google.comwww.googleapis.comoauth2.googleapis.com/tokengithub.comapi.github.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no lifecycle scripts; main is dist/index.js and files only dist.
dist/index.js only re-exports server modules; no install/import-time execution observed.
dist/modules/tasks/TaskSourceController.js contains Hono route handlers and no dynamic require/import.
dist/crypto/encoding.js/.d.ts only parse caller-supplied PEM/base64 data; no embedded secret.
Network use is package-aligned OAuth/GitHub/web-search functionality with explicit user/runtime actions.
rg found no child_process, eval, Function, persistence, destructive, or AI-agent control-surface writes.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 124 file(s), 738 KB of source, external domains: accounts.google.com, api.github.com, api.linear.app, api.search.brave.com, github.com, linear.app, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

7 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 168-208javascript

168 userId: c.get('user')?.id ?? null,

169 exp: Date.now() + 10 * 60 * 1000,

170 });

171 const url

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const byte of bytes)

15 binary +=

dist/github/GitHubAppAuth.d.tsView file

Lines 1-24typescript

1import type { Clock, GitHubInstallationRepository, InstallationPermissions } from '@cat-factory/kernel';

2export interface GitHubAppAuthDependencies {

3 appId: string;

4 /** App private key in PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`). */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4

Source & flagged code

7 flagged · loading source

dist/crypto/encoding.d.tsView file

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

7patternName = private_key_rsa severity = critical line = 7 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8patternName = private_key_rsa severity = critical line = 8 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

dist/modules/tasks/TaskSourceController.jsView file

188return unavailable(c); L189: const task = await tasks.importService.import(param(c, 'workspaceId'), sourceParam(c), c.req.valid('json').ref); L190: return c.json(task, 201);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/modules/tasks/TaskSourceController.jsView on unpkg · L188

dist/crypto/encoding.jsView file

30patternName = private_key_rsa severity = critical line = 30 matchedText = * (`----...CS#1

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L30

31patternName = private_key_rsa severity = critical line = 31 matchedText = * (`----... via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.js

dist/crypto/encoding.jsView on unpkg · L31

dist/github/GitHubAppAuth.d.tsView file

4patternName = private_key_rsa severity = critical line = 4 matchedText = /** App .... */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4

Findings

6 Critical2 Medium5 Low

CriticalCritical Secretdist/crypto/encoding.d.ts

CriticalSecret Patterndist/crypto/encoding.d.ts

CriticalSecret Patterndist/crypto/encoding.js

CriticalSecret Patterndist/github/GitHubAppAuth.d.ts

MediumDynamic Requiredist/modules/tasks/TaskSourceController.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/crypto/encoding.d.tsView file

Lines 1-14typescript

1/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */

2export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;

3/** Decode a base64url string to bytes. */

4export declare function base64urlToBytes(value: string): Uint8Array;

5/**

6 * Decode a PEM private key body to DER bytes. Requires PKCS#8

7 * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/crypto/encoding.d.tsView on unpkg · L7

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L7

8 * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via

Critical

Secret Pattern

RSA private key in dist/crypto/encoding.d.ts

dist/crypto/encoding.d.tsView on unpkg · L8

9 * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).

10 */

11export declare function pkcs8PemToDer(pem: string): ArrayBuffer;

12/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */

13export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

14//# sourceMappingURL=encoding.d.ts.map

dist/modules/tasks/TaskSourceController.jsView file

Lines 168-208javascript

168 userId: c.get('user')?.id ?? null,

169 exp: Date.now() + 10 * 60 * 1000,

170 });

171 const url

dist/crypto/encoding.jsView file

Lines 10-51javascript

10 bytes = input;

11 else

12 bytes = new Uint8Array(input);

13 let binary = '';

14 for (const byte of bytes)

15 binary +=

dist/github/GitHubAppAuth.d.tsView file

Lines 1-24typescript

1import type { Clock, GitHubInstallationRepository, InstallationPermissions } from '@cat-factory/kernel';

2export interface GitHubAppAuthDependencies {

3 appId: string;

4 /** App private key in PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`). */

Critical

Secret Pattern

RSA private key in dist/github/GitHubAppAuth.d.ts

dist/github/GitHubAppAuth.d.tsView on unpkg · L4