registry  /  @djust-b2b/djust-front-sdk  /  3.2.2

@djust-b2b/djust-front-sdk@3.2.2

DJUST Front SDK - Universal TypeScript SDK for DJUST B2B API. SSR-safe, type-safe, production-ready.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The legacy transport can disclose API credentials and request bodies to Sentry when telemetry is active and an API request fails. This is a concrete credential-logging vulnerability, not install-time malware.

Static reason
One or more suspicious static signals were detected.
Trigger
A legacy `DjustSDK` request receives a non-OK response while Sentry telemetry is initialized or the default DSN is retained.
Impact
May expose `dj-api-key`, bearer tokens, passwords, and API payloads to the Sentry project.
Mechanism
Sends request headers and body as Sentry exception extras.
Rationale
Source inspection confirms a sensitive telemetry leak on the legacy error path. It warrants a warning for credential exfiltration risk, but the inspected package does not show intentional install-time or autonomous malicious behavior.
Evidence
package.jsondist/index.mjslib/settings/fetch-instance.jslib/services/auth/auth.service.jsdist/index.cjslib/client/create-client.jslib/client/transport.js
Network endpoints1
39ef5198e24fa0ec7b743c460bd1ca63@o1191347.ingest.us.sentry.io/4508879498575872

Decision evidence

public snapshot
AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
  • `dist/index.mjs` embeds a DJUST Sentry ingest DSN.
  • On non-OK API responses, `dist/index.mjs` sends all request headers and request body to Sentry extras.
  • Those headers include `dj-api-key` and an Authorization bearer token.
  • `lib/services/auth/auth.service.js` sends login passwords in request bodies, making failed legacy login calls exposable.
Evidence against
  • `package.json` has no preinstall, install, or postinstall hook; `prepare` references absent build sources.
  • Entrypoints import SDK modules but do not initiate network requests at import time.
  • No child-process, filesystem-write, eval, dynamic-import, or persistence APIs were found in shipped runtime JS.
  • Normal API traffic targets the caller-supplied `baseUrl`; the modern client uses caller-provided transport hooks.
Behavioral surface
Source
Network
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 171 file(s), 1.18 MB of source, external domains: example.com

Source & flagged code

29 flagged · loading source
dist/services/auth/index.d.tsView file
34patternName = supabase_service_key severity = critical line = 34 matchedText = * toke...5c",
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/services/auth/index.d.tsView on unpkg · L34
34patternName = supabase_service_key severity = critical line = 34 matchedText = * toke...5c",
Critical
Secret Pattern

Supabase service role key (JWT) in dist/services/auth/index.d.ts

dist/services/auth/index.d.tsView on unpkg · L34
146patternName = generic_password severity = medium line = 146 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in dist/services/auth/index.d.ts

dist/services/auth/index.d.tsView on unpkg · L146
dist/index.mjsView file
5958patternName = generic_password severity = medium line = 5958 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L5958
9877patternName = generic_password severity = medium line = 9877 matchedText = * pass...3!',
Medium
Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L9877
dist/services/customer-user/customer-user.service.d.tsView file
97patternName = generic_password severity = medium line = 97 matchedText = * pass...3!',
Medium
Secret Pattern

Hardcoded password in dist/services/customer-user/customer-user.service.d.ts

dist/services/customer-user/customer-user.service.d.tsView on unpkg · L97
dist/services/customer-user/index.d.tsView file
65patternName = generic_password severity = medium line = 65 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in dist/services/customer-user/index.d.ts

dist/services/customer-user/index.d.tsView on unpkg · L65
dist/services/auth/auth.service.d.tsView file
44patternName = generic_password severity = medium line = 44 matchedText = * pass...23',
Medium
Secret Pattern

Hardcoded password in dist/services/auth/auth.service.d.ts

dist/services/auth/auth.service.d.tsView on unpkg · L44
189patternName = generic_password severity = medium line = 189 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in dist/services/auth/auth.service.d.ts

dist/services/auth/auth.service.d.tsView on unpkg · L189
dist/services/customer-account/index.d.tsView file
84patternName = generic_password severity = medium line = 84 matchedText = * pa...23",
Medium
Secret Pattern

Hardcoded password in dist/services/customer-account/index.d.ts

dist/services/customer-account/index.d.tsView on unpkg · L84
README.mdView file
396patternName = generic_password severity = medium line = 396 matchedText = password...rd',
Medium
Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L396
lib/services/customer-user/customer-user.service.jsView file
107patternName = generic_password severity = medium line = 107 matchedText = * pass...3!',
Medium
Secret Pattern

Hardcoded password in lib/services/customer-user/customer-user.service.js

lib/services/customer-user/customer-user.service.jsView on unpkg · L107
lib/services/customer-user/customer-user.service.d.tsView file
97patternName = generic_password severity = medium line = 97 matchedText = * pass...3!',
Medium
Secret Pattern

Hardcoded password in lib/services/customer-user/customer-user.service.d.ts

lib/services/customer-user/customer-user.service.d.tsView on unpkg · L97
lib/services/customer-user/index.jsView file
84patternName = generic_password severity = medium line = 84 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in lib/services/customer-user/index.js

lib/services/customer-user/index.jsView on unpkg · L84
lib/services/customer-user/index.d.tsView file
65patternName = generic_password severity = medium line = 65 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in lib/services/customer-user/index.d.ts

lib/services/customer-user/index.d.tsView on unpkg · L65
lib/services/auth/auth.service.d.tsView file
44patternName = generic_password severity = medium line = 44 matchedText = * pass...23',
Medium
Secret Pattern

Hardcoded password in lib/services/auth/auth.service.d.ts

lib/services/auth/auth.service.d.tsView on unpkg · L44
189patternName = generic_password severity = medium line = 189 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/auth.service.d.ts

lib/services/auth/auth.service.d.tsView on unpkg · L189
lib/services/auth/__mocks__/auth.mocks.jsView file
9patternName = supabase_service_key severity = critical line = 9 matchedText = validTok...5c",
Critical
Secret Pattern

Supabase service role key (JWT) in lib/services/auth/__mocks__/auth.mocks.js

lib/services/auth/__mocks__/auth.mocks.jsView on unpkg · L9
11patternName = supabase_service_key severity = critical line = 11 matchedText = refreshT...5c",
Critical
Secret Pattern

Supabase service role key (JWT) in lib/services/auth/__mocks__/auth.mocks.js

lib/services/auth/__mocks__/auth.mocks.jsView on unpkg · L11
18patternName = generic_password severity = medium line = 18 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/__mocks__/auth.mocks.js

lib/services/auth/__mocks__/auth.mocks.jsView on unpkg · L18
22patternName = generic_password severity = medium line = 22 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/__mocks__/auth.mocks.js

lib/services/auth/__mocks__/auth.mocks.jsView on unpkg · L22
lib/services/auth/index.jsView file
44patternName = supabase_service_key severity = critical line = 44 matchedText = * toke...5c",
Critical
Secret Pattern

Supabase service role key (JWT) in lib/services/auth/index.js

lib/services/auth/index.jsView on unpkg · L44
195patternName = generic_password severity = medium line = 195 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/index.js

lib/services/auth/index.jsView on unpkg · L195
lib/services/auth/auth.service.jsView file
46patternName = generic_password severity = medium line = 46 matchedText = * pass...23',
Medium
Secret Pattern

Hardcoded password in lib/services/auth/auth.service.js

lib/services/auth/auth.service.jsView on unpkg · L46
256patternName = generic_password severity = medium line = 256 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/auth.service.js

lib/services/auth/auth.service.jsView on unpkg · L256
lib/services/auth/index.d.tsView file
34patternName = supabase_service_key severity = critical line = 34 matchedText = * toke...5c",
Critical
Secret Pattern

Supabase service role key (JWT) in lib/services/auth/index.d.ts

lib/services/auth/index.d.tsView on unpkg · L34
146patternName = generic_password severity = medium line = 146 matchedText = * pass...23",
Medium
Secret Pattern

Hardcoded password in lib/services/auth/index.d.ts

lib/services/auth/index.d.tsView on unpkg · L146
lib/services/customer-account/index.jsView file
124patternName = generic_password severity = medium line = 124 matchedText = * pa...23",
Medium
Secret Pattern

Hardcoded password in lib/services/customer-account/index.js

lib/services/customer-account/index.jsView on unpkg · L124
lib/services/customer-account/index.d.tsView file
84patternName = generic_password severity = medium line = 84 matchedText = * pa...23",
Medium
Secret Pattern

Hardcoded password in lib/services/customer-account/index.d.ts

lib/services/customer-account/index.d.tsView on unpkg · L84

Findings

6 Critical24 Medium4 Low
CriticalCritical Secretdist/services/auth/index.d.ts
CriticalSecret Patterndist/services/auth/index.d.ts
CriticalSecret Patternlib/services/auth/__mocks__/auth.mocks.js
CriticalSecret Patternlib/services/auth/__mocks__/auth.mocks.js
CriticalSecret Patternlib/services/auth/index.js
CriticalSecret Patternlib/services/auth/index.d.ts
MediumNetwork
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/index.mjs
MediumSecret Patterndist/services/customer-user/customer-user.service.d.ts
MediumSecret Patterndist/services/customer-user/index.d.ts
MediumSecret Patterndist/services/auth/auth.service.d.ts
MediumSecret Patterndist/services/auth/auth.service.d.ts
MediumSecret Patterndist/services/auth/index.d.ts
MediumSecret Patterndist/services/customer-account/index.d.ts
MediumSecret PatternREADME.md
MediumSecret Patternlib/services/customer-user/customer-user.service.js
MediumSecret Patternlib/services/customer-user/customer-user.service.d.ts
MediumSecret Patternlib/services/customer-user/index.js
MediumSecret Patternlib/services/customer-user/index.d.ts
MediumSecret Patternlib/services/auth/auth.service.d.ts
MediumSecret Patternlib/services/auth/auth.service.d.ts
MediumSecret Patternlib/services/auth/__mocks__/auth.mocks.js
MediumSecret Patternlib/services/auth/__mocks__/auth.mocks.js
MediumSecret Patternlib/services/auth/index.js
MediumSecret Patternlib/services/auth/auth.service.js
MediumSecret Patternlib/services/auth/auth.service.js
MediumSecret Patternlib/services/auth/index.d.ts
MediumSecret Patternlib/services/customer-account/index.js
MediumSecret Patternlib/services/customer-account/index.d.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings