registry / @checkstack/logstream-backend / 0.3.0

@checkstack/logstream-backend@0.3.0

Log stream ingestion, storage, drain and health integration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVars

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 106 file(s), 768 KB of source, external domains: api.example.com

Source & flagged code

3 flagged

src/drain/masking.test.tsView file

Lines 150-200typescript

150 // Deliberately a short, obviously-fake token body: it still matches the

151 // masker's `sk_live_[A-Za-z0-9]{8,}` rule (so redaction is exercised) but

152 // is well under the length real secret scanners flag, so this fixture is

153 // never mistaken for a live key.

154 name: "stripe live key",

155 input: "using sk_live_FAKEKEYFORTESTS now",

156 expected: `using ${W} now`,

157 },

158 {

159 name: "openai project key",

160 input: "key sk-proj-abcDEF123456ghijKLMno789 set",

161 expected: `key ${W} set`,

162 },

163 {

164 name: "anthropic key",

165 input: "key sk-ant-api03-abcDEF123456ghijKLMno set",

166 expected: `key ${W} set`,

167 },

168 {

169 name: "github PAT",

170 input: "token ghp_16C7e42F292c6912E7710c838347Ae178B4a here",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/drain/masking.test.tsView on unpkg · L170

Critical

Secret Pattern

GitHub personal access token in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L170

171 expected: `token ${W} here`,

172 },

173 {

174 name: "slack token",

175 input: "slack xoxb-1234567890-abcdefghijkl posted",

176 expected: `slack ${W} posted`,

177 },

178 {

179 name: "aws access key id",

180 input: "creds AKIAIOSFODNN7EXAMPLE loaded",

Critical

Secret Pattern

AWS access key ID in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L180

181 expected: `creds ${W} loaded`,

182 },

183 {

184 name: "checkstack ingest token",

185 input: "auth ckls_s1_AbCdEfGhIjKlMnOpQrStUvWxYz here",

186 expected: `auth ${W} here`,

187 },

188 ];

189

190 for (const c of secrets) {

191 it(`masks ${c.name}`, () => {

192 expect(maskLine({ body: c.input })).toBe(c.expected);

193 });

194 }

195

196 // Conservatism: ordinary words that merely start with a prefix letter-run,

197 // or contain a prefix substring, must NOT be masked (mirrors the hex rule's

198 // required-digit guard so real logs stay legible).

199 const kept: Array<{ name: string; input: string }> = [

200 { name: "hyphenated word starting sk", input: "sk-manager restarted" },

Source & flagged code

3 flagged · loading source

src/drain/masking.test.tsView file

170patternName = github_pat severity = critical line = 170 matchedText = input: "...re",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/drain/masking.test.tsView on unpkg · L170

170patternName = github_pat severity = critical line = 170 matchedText = input: "...re",

Critical

Secret Pattern

GitHub personal access token in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L170

180patternName = aws_access_key severity = critical line = 180 matchedText = input: "...ed",

Critical

Secret Pattern

AWS access key ID in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L180

Findings

3 Critical1 Medium3 Low

CriticalCritical Secretsrc/drain/masking.test.ts

CriticalSecret Patternsrc/drain/masking.test.ts

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/drain/masking.test.tsView file

Lines 150-200typescript

150 // Deliberately a short, obviously-fake token body: it still matches the

151 // masker's `sk_live_[A-Za-z0-9]{8,}` rule (so redaction is exercised) but

152 // is well under the length real secret scanners flag, so this fixture is

153 // never mistaken for a live key.

154 name: "stripe live key",

155 input: "using sk_live_FAKEKEYFORTESTS now",

156 expected: `using ${W} now`,

157 },

158 {

159 name: "openai project key",

160 input: "key sk-proj-abcDEF123456ghijKLMno789 set",

161 expected: `key ${W} set`,

162 },

163 {

164 name: "anthropic key",

165 input: "key sk-ant-api03-abcDEF123456ghijKLMno set",

166 expected: `key ${W} set`,

167 },

168 {

169 name: "github PAT",

170 input: "token ghp_16C7e42F292c6912E7710c838347Ae178B4a here",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/drain/masking.test.tsView on unpkg · L170

Critical

Secret Pattern

GitHub personal access token in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L170

171 expected: `token ${W} here`,

172 },

173 {

174 name: "slack token",

175 input: "slack xoxb-1234567890-abcdefghijkl posted",

176 expected: `slack ${W} posted`,

177 },

178 {

179 name: "aws access key id",

180 input: "creds AKIAIOSFODNN7EXAMPLE loaded",

Critical

Secret Pattern

AWS access key ID in src/drain/masking.test.ts

src/drain/masking.test.tsView on unpkg · L180

181 expected: `creds ${W} loaded`,

182 },

183 {

184 name: "checkstack ingest token",

185 input: "auth ckls_s1_AbCdEfGhIjKlMnOpQrStUvWxYz here",

186 expected: `auth ${W} here`,

187 },

188 ];

189

190 for (const c of secrets) {

191 it(`masks ${c.name}`, () => {

192 expect(maskLine({ body: c.input })).toBe(c.expected);

193 });

194 }

195

196 // Conservatism: ordinary words that merely start with a prefix letter-run,

197 // or contain a prefix substring, must NOT be masked (mirrors the hex rule's

198 // required-digit guard so real logs stay legible).

199 const kept: Array<{ name: string; input: string }> = [

200 { name: "hyphenated word starting sk", input: "sk-manager restarted" },