Loading npm security reports…

@cosmicdrift/kumiko-bundled-features@0.151.0: Suspicious npm | LPM Firewall

registry / @cosmicdrift/kumiko-bundled-features / 0.151.0

@cosmicdrift/kumiko-bundled-features@0.151.0

Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 50 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 687 file(s), 2.11 MB of source, external domains: schema.org, www.sitemaps.org, www.w3.org

Source & flagged code

46 flagged

src/file-provider-s3/__tests__/feature.test.tsView file

Lines 23-63typescript

23 test("exports.configKeys covers the S3-config knobs", () => {

24 const keys = fileProviderS3Feature.exports.configKeys;

25 expect(keys.bucket).toBeDefined();

26 expect(keys.region).toBeDefined();

27 expect(keys.endpoint).toBeDefined();

28 expect(keys.forcePathStyle).toBeDefined();

29 expect(keys.accessKeyId).toBeDefined();

30 });

32 test("exports.secretAccessKey is the S3_SECRET_ACCESS_KEY secret-handle (drift-pin)", () => {

33 expect(fileProviderS3Feature.exports.secretAccessKey).toBe(S3_SECRET_ACCESS_KEY);

34 expect(S3_SECRET_ACCESS_KEY.name).toBe("file-provider-s3:secret:s3-secret-access-key");

35 });

36});

38describe("S3_SECRET_ACCESS_KEY — generic redaction", () => {

39 const secretDef = fileProviderS3Feature.secretKeys["s3.secretAccessKey"];

41 test("redact preserves first 4 + last 4 chars on long keys", () => {

42 expect(secretDef?.redact).toBeDefined();

43 expect(secretDef?.redact?.("AKIA1234567890ABCDEFGHIJ7890klmn")).toMatch(/^AKIA\.\.\.klmn$/);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/file-provider-s3/__tests__/feature.test.tsView on unpkg · L43

Critical

Secret Pattern

AWS access key ID in src/file-provider-s3/__tests__/feature.test.ts

src/file-provider-s3/__tests__/feature.test.tsView on unpkg · L43

44 });

46 test("redact masks short keys completely", () => {

47 expect(secretDef?.redact?.("short")).toBe("•".repeat(5));

48 });

49});

51describe("fileProviderS3Feature — plugin-registration", () => {

52 test("registers itself under entityName 's3' for file-foundation's extension", () => {

53 const usages = fileProviderS3Feature.extensionUsages;

54 expect(usages.some((u) => u.extensionName === "fileProvider" && u.entityName === "s3")).toBe(

55 true,

56 );

57 });

58});

60function s3Plugin(): FileProviderPlugin {

61 const options = fileProviderS3Feature.extensionUsages.find(

62 (u) => u.extensionName === "fileProvider" && u.entityName === "s3",

63 )?.options;

src/auth-mfa/totp.tsView file

Lines 26-56typescript

27 return String(truncated % 10 ** DIGITS).padStart(DIGITS, "0");

28}

30// Exposed for callers that need to derive "the code right now" — the

src/shared/identity-v3-hash.test.tsView file

Lines 39-125typescript

40 const subkeyLength = args.subkeyLength ?? BMC_SUBKEY_LENGTH;

41 const subkey = pbkdf2Sync(args.password, args.salt, args.iterations, subkeyLength, algorithm);

src/sessions/__tests__/password-auto-revoke.integration.test.tsView file

Lines 136-176typescript

136 (await h.authedPost("/api/query", a.token, { type: "user:query:user:me", payload: {} }))

137 .status,

138 ).toBe(401);

139 expect(

140 (await

src/user-profile/__tests__/change-email.integration.test.tsView file

118patternName = generic_password severity = medium line = 118 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L118

138patternName = generic_password severity = medium line = 138 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L138

144patternName = generic_password severity = medium line = 144 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L144

src/inbound-mail-foundation/constants.tsView file

66patternName = generic_password severity = medium line = 66 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/inbound-mail-foundation/constants.ts

src/inbound-mail-foundation/constants.tsView on unpkg · L66

src/auth-email-password/__tests__/signup-flow.integration.test.tsView file

181patternName = generic_password severity = medium line = 181 matchedText = const pa...34";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/signup-flow.integration.test.ts

src/auth-email-password/__tests__/signup-flow.integration.test.tsView on unpkg · L181

230patternName = generic_password severity = medium line = 230 matchedText = const pa...34";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/signup-flow.integration.test.ts

src/auth-email-password/__tests__/signup-flow.integration.test.tsView on unpkg · L230

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView file

91patternName = generic_password severity = medium line = 91 matchedText = const pa...25";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L91

125patternName = generic_password severity = medium line = 125 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L125

147patternName = generic_password severity = medium line = 147 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L147

src/auth-email-password/__tests__/seed-admin.integration.test.tsView file

66patternName = generic_password severity = medium line = 66 matchedText = password...pw",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/seed-admin.integration.test.ts

src/auth-email-password/__tests__/seed-admin.integration.test.tsView on unpkg · L66

src/auth-email-password/__tests__/auth.integration.test.tsView file

108patternName = generic_password severity = medium line = 108 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L108

114patternName = generic_password severity = medium line = 114 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L114

157patternName = generic_password severity = medium line = 157 matchedText = password...er",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L157

src/auth-email-password/__tests__/auth-claims.integration.test.tsView file

141patternName = generic_password severity = medium line = 141 matchedText = password...gh",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth-claims.integration.test.ts

src/auth-email-password/__tests__/auth-claims.integration.test.tsView on unpkg · L141

Source & flagged code

46 flagged · loading source

src/file-provider-s3/__tests__/feature.test.tsView file

src/user-profile/__tests__/change-email.integration.test.tsView file

118patternName = generic_password severity = medium line = 118 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L118

138patternName = generic_password severity = medium line = 138 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L138

144patternName = generic_password severity = medium line = 144 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L144

152patternName = generic_password severity = medium line = 152 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L152

169patternName = generic_password severity = medium line = 169 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L169

170patternName = generic_password severity = medium line = 170 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L170

182patternName = generic_password severity = medium line = 182 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L182

205patternName = generic_password severity = medium line = 205 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L205

src/auth-email-password/__tests__/auth.integration.test.tsView file

108patternName = generic_password severity = medium line = 108 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L108

114patternName = generic_password severity = medium line = 114 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L114

157patternName = generic_password severity = medium line = 157 matchedText = password...er",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L157

193patternName = generic_password severity = medium line = 193 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L193

206patternName = generic_password severity = medium line = 206 matchedText = password...ld",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L206

233patternName = generic_password severity = medium line = 233 matchedText = password...gh",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L233

250patternName = generic_password severity = medium line = 250 matchedText = password...pw",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L250

270patternName = generic_password severity = medium line = 270 matchedText = password...ng",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L270

280patternName = generic_password severity = medium line = 280 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L280

332patternName = generic_password severity = medium line = 332 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L332

362patternName = generic_password severity = medium line = 362 matchedText = password...34",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L362

445patternName = generic_password severity = medium line = 445 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L445

475patternName = generic_password severity = medium line = 475 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L475

526patternName = generic_password severity = medium line = 526 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L526

530patternName = generic_password severity = medium line = 530 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L530

555patternName = generic_password severity = medium line = 555 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L555

559patternName = generic_password severity = medium line = 559 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L559

580patternName = generic_password severity = medium line = 580 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L580

584patternName = generic_password severity = medium line = 584 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L584

625patternName = generic_password severity = medium line = 625 matchedText = await se... });

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L625

629patternName = generic_password severity = medium line = 629 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L629

Findings

2 Critical45 Medium3 Low

CriticalCritical Secretsrc/file-provider-s3/__tests__/feature.test.ts

CriticalSecret Patternsrc/file-provider-s3/__tests__/feature.test.ts

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/shared/identity-v3-hash.test.ts

MediumSecret Patternsrc/sessions/__tests__/password-auto-revoke.integration.test.ts

MediumSecret Patternsrc/user-profile/__tests__/change-email.integration.test.ts

MediumSecret Patternsrc/inbound-mail-foundation/constants.ts

MediumSecret Patternsrc/auth-email-password/__tests__/signup-flow.integration.test.ts

MediumSecret Patternsrc/auth-email-password/__tests__/identity-v3-login.integration.test.ts

MediumSecret Patternsrc/auth-email-password/__tests__/seed-admin.integration.test.ts

MediumSecret Patternsrc/auth-email-password/__tests__/auth.integration.test.ts

MediumSecret Patternsrc/auth-email-password/__tests__/auth-claims.integration.test.ts

LowWeak Cryptosrc/auth-mfa/totp.ts

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

46 flagged

src/file-provider-s3/__tests__/feature.test.tsView file

Lines 23-63typescript

23 test("exports.configKeys covers the S3-config knobs", () => {

24 const keys = fileProviderS3Feature.exports.configKeys;

25 expect(keys.bucket).toBeDefined();

26 expect(keys.region).toBeDefined();

27 expect(keys.endpoint).toBeDefined();

28 expect(keys.forcePathStyle).toBeDefined();

29 expect(keys.accessKeyId).toBeDefined();

30 });

32 test("exports.secretAccessKey is the S3_SECRET_ACCESS_KEY secret-handle (drift-pin)", () => {

33 expect(fileProviderS3Feature.exports.secretAccessKey).toBe(S3_SECRET_ACCESS_KEY);

34 expect(S3_SECRET_ACCESS_KEY.name).toBe("file-provider-s3:secret:s3-secret-access-key");

35 });

36});

38describe("S3_SECRET_ACCESS_KEY — generic redaction", () => {

39 const secretDef = fileProviderS3Feature.secretKeys["s3.secretAccessKey"];

41 test("redact preserves first 4 + last 4 chars on long keys", () => {

42 expect(secretDef?.redact).toBeDefined();

43 expect(secretDef?.redact?.("AKIA1234567890ABCDEFGHIJ7890klmn")).toMatch(/^AKIA\.\.\.klmn$/);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/file-provider-s3/__tests__/feature.test.tsView on unpkg · L43

Critical

Secret Pattern

AWS access key ID in src/file-provider-s3/__tests__/feature.test.ts

src/file-provider-s3/__tests__/feature.test.tsView on unpkg · L43

44 });

46 test("redact masks short keys completely", () => {

47 expect(secretDef?.redact?.("short")).toBe("•".repeat(5));

48 });

49});

51describe("fileProviderS3Feature — plugin-registration", () => {

52 test("registers itself under entityName 's3' for file-foundation's extension", () => {

53 const usages = fileProviderS3Feature.extensionUsages;

54 expect(usages.some((u) => u.extensionName === "fileProvider" && u.entityName === "s3")).toBe(

55 true,

56 );

57 });

58});

60function s3Plugin(): FileProviderPlugin {

61 const options = fileProviderS3Feature.extensionUsages.find(

62 (u) => u.extensionName === "fileProvider" && u.entityName === "s3",

63 )?.options;

src/auth-mfa/totp.tsView file

Lines 26-56typescript

27 return String(truncated % 10 ** DIGITS).padStart(DIGITS, "0");

28}

30// Exposed for callers that need to derive "the code right now" — the

src/shared/identity-v3-hash.test.tsView file

Lines 39-125typescript

40 const subkeyLength = args.subkeyLength ?? BMC_SUBKEY_LENGTH;

41 const subkey = pbkdf2Sync(args.password, args.salt, args.iterations, subkeyLength, algorithm);

src/sessions/__tests__/password-auto-revoke.integration.test.tsView file

Lines 136-176typescript

136 (await h.authedPost("/api/query", a.token, { type: "user:query:user:me", payload: {} }))

137 .status,

138 ).toBe(401);

139 expect(

140 (await

src/user-profile/__tests__/change-email.integration.test.tsView file

118patternName = generic_password severity = medium line = 118 matchedText = const se... });

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L118

138patternName = generic_password severity = medium line = 138 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L138

144patternName = generic_password severity = medium line = 144 matchedText = password...-1",

Medium

Secret Pattern

Hardcoded password in src/user-profile/__tests__/change-email.integration.test.ts

src/user-profile/__tests__/change-email.integration.test.tsView on unpkg · L144

src/inbound-mail-foundation/constants.tsView file

66patternName = generic_password severity = medium line = 66 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/inbound-mail-foundation/constants.ts

src/inbound-mail-foundation/constants.tsView on unpkg · L66

src/auth-email-password/__tests__/signup-flow.integration.test.tsView file

181patternName = generic_password severity = medium line = 181 matchedText = const pa...34";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/signup-flow.integration.test.ts

src/auth-email-password/__tests__/signup-flow.integration.test.tsView on unpkg · L181

230patternName = generic_password severity = medium line = 230 matchedText = const pa...34";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/signup-flow.integration.test.ts

src/auth-email-password/__tests__/signup-flow.integration.test.tsView on unpkg · L230

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView file

91patternName = generic_password severity = medium line = 91 matchedText = const pa...25";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L91

125patternName = generic_password severity = medium line = 125 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L125

147patternName = generic_password severity = medium line = 147 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

src/auth-email-password/__tests__/identity-v3-login.integration.test.tsView on unpkg · L147

src/auth-email-password/__tests__/seed-admin.integration.test.tsView file

66patternName = generic_password severity = medium line = 66 matchedText = password...pw",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/seed-admin.integration.test.ts

src/auth-email-password/__tests__/seed-admin.integration.test.tsView on unpkg · L66

src/auth-email-password/__tests__/auth.integration.test.tsView file

108patternName = generic_password severity = medium line = 108 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L108

114patternName = generic_password severity = medium line = 114 matchedText = password...ry",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L114

157patternName = generic_password severity = medium line = 157 matchedText = password...er",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth.integration.test.ts

src/auth-email-password/__tests__/auth.integration.test.tsView on unpkg · L157

src/auth-email-password/__tests__/auth-claims.integration.test.tsView file

141patternName = generic_password severity = medium line = 141 matchedText = password...gh",

Medium

Secret Pattern

Hardcoded password in src/auth-email-password/__tests__/auth-claims.integration.test.ts

src/auth-email-password/__tests__/auth-claims.integration.test.tsView on unpkg · L141