registry / @cepharum/web-crypto-revised / 1.1.3

@cepharum/web-crypto-revised@1.1.3

higher-level crypto API for client and server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 22.6 KB of source

Source & flagged code

3 flagged

index.jsView file

Lines 508-548javascript

508 if ( !/\p{Nd}/u.test( password ) ) {

509 weaknesses.push( "errorNoDigit" );

510 }

511

512 if ( !/\p{P}/u.test( password ) && !/\p{S}/u.test( password ) ) {

513 weaknesses.push( "errorNoSpecial" );

514 }

515

516 return weaknesses;

517}

518

519/**

520 * Detects if current runtime is properly supporting encryption.

521 *

522 * @returns {Promise<void>} promise resolved on runtime properly supporting encryption and rejected otherwise

523 */

524export function testDrive() {

525 if ( !testDriveResult ) {

526 testDriveResult = ( async() => {

527 const message = { content: "top secret!" };

528 const password = "mY.S3crÈt%p4$§w0RD";

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L528

529

530 // base64

531 const base64 = toBase64( encode( password ) );

532 if ( decode( fromBase64( base64 ) ) !== password ) {

533 throw new Error( "encoding and decoding to/from Base64 failed" );

534 }

535

536 // URL-safe base64

537 const urlSafeBase64 = toUrlSafeBase64( encode( password ) );

538 if ( decode( fromUrlSafeBase64( urlSafeBase64 ) ) !== password ) {

539 throw new Error( "encoding and decoding to/from URL-safe Base64 failed" );

540 }

541

542 // symmetric

543 const aesEncrypted = await aesEncrypt( message, password );

544

545 if ( !aesEncrypted?.cipher || !aesEncrypted?.counter || !aesEncrypted?.salt ||

546 typeof aesEncrypted.cipher !== "string" || typeof aesEncrypted.counter !== "string" || typeof aesEncrypted.salt !== "string" ) {

547 throw new Error( "unexpected format of symmetrically encrypted data" );

548 }

readme.mdView file

Lines 45-97markdown

45 await testDrive();

46} catch {

47 // runtime does not support webcrypto API

48}

50// runtime supports webcrypto API

51```

53> If your server code is based on ES module syntax instead, the integration works identical to the example given for the client above.

55## More examples

57The library itself has been implemented using ES module syntax, hence it is the preferred way of using it in the following examples. Adopting these examples for the CommonJS syntax should be a straightforward task focusing one the import line.

Source & flagged code

3 flagged · loading source

index.jsView file

528patternName = generic_password severity = medium line = 528 matchedText = const pa...RD";

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L528

readme.mdView file

65patternName = generic_password severity = medium line = 65 matchedText = const pa...rD";

Medium

Secret Pattern

Hardcoded password in readme.md

readme.mdView on unpkg · L65

77patternName = generic_password severity = medium line = 77 matchedText = const pa...rD";

Medium

Secret Pattern

Hardcoded password in readme.md

readme.mdView on unpkg · L77

Findings

3 Medium1 Low

MediumSecret Patternindex.js

MediumSecret Patternreadme.md

LowScripts Present

Source & flagged code

3 flagged

index.jsView file

Lines 508-548javascript

508 if ( !/\p{Nd}/u.test( password ) ) {

509 weaknesses.push( "errorNoDigit" );

510 }

511

512 if ( !/\p{P}/u.test( password ) && !/\p{S}/u.test( password ) ) {

513 weaknesses.push( "errorNoSpecial" );

514 }

515

516 return weaknesses;

517}

518

519/**

520 * Detects if current runtime is properly supporting encryption.

521 *

522 * @returns {Promise<void>} promise resolved on runtime properly supporting encryption and rejected otherwise

523 */

524export function testDrive() {

525 if ( !testDriveResult ) {

526 testDriveResult = ( async() => {

527 const message = { content: "top secret!" };

528 const password = "mY.S3crÈt%p4$§w0RD";

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L528

529

530 // base64

531 const base64 = toBase64( encode( password ) );

532 if ( decode( fromBase64( base64 ) ) !== password ) {

533 throw new Error( "encoding and decoding to/from Base64 failed" );

534 }

535

536 // URL-safe base64

537 const urlSafeBase64 = toUrlSafeBase64( encode( password ) );

538 if ( decode( fromUrlSafeBase64( urlSafeBase64 ) ) !== password ) {

539 throw new Error( "encoding and decoding to/from URL-safe Base64 failed" );

540 }

541

542 // symmetric

543 const aesEncrypted = await aesEncrypt( message, password );

544

545 if ( !aesEncrypted?.cipher || !aesEncrypted?.counter || !aesEncrypted?.salt ||

546 typeof aesEncrypted.cipher !== "string" || typeof aesEncrypted.counter !== "string" || typeof aesEncrypted.salt !== "string" ) {

547 throw new Error( "unexpected format of symmetrically encrypted data" );

548 }

readme.mdView file

Lines 45-97markdown

45 await testDrive();

46} catch {

47 // runtime does not support webcrypto API

48}

50// runtime supports webcrypto API

51```

53> If your server code is based on ES module syntax instead, the integration works identical to the example given for the client above.

55## More examples