registry / @ductape/sdk / 0.1.32

@ductape/sdk@0.1.32

sdk for building ductaped products

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Network, secrets, storage, SMS, vector, and LLM capabilities are SDK features invoked by application code with user-provided credentials/configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports the SDK and calls service methods.

Impact

No install-time execution, credential harvesting, stealth persistence, or unauthorized file/config mutation identified.

Mechanism

Legitimate SDK API clients and adapters

Rationale

Static inspection shows a broad integration SDK with expected network and credential-handling primitives, but no install/import-time execution, hidden payload loading, exfiltration, destructive behavior, or AI-agent control-surface mutation. Scanner hits are explained by package-aligned API clients, placeholder secret patterns, lazy optional imports, and documented SDK features.

Evidence

package.jsondist/index.jsdist/clients/function.client.jsdist/parsers/utils/postman.utils.jsdist/database/presave/presave-processor.jsdist/api/urls.jsdist/agents/agent-executor.jsdist/api/services/secretsApi.service.jsdist/processor/repos/sms.repo.jsREADME.md

Network endpoints8

api.ductape.applocalhost:4311api.anthropic.comapi.openai.comapi.pinecone.ioexp.host/--/api/v2/push/sendapi.nexmo.com/v1/messagesapi.plivo.com/v1/Account/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has only prepublishOnly build script; no preinstall/install/postinstall runtime hook.
dist/index.js exports SDK classes and lazy service methods; constructor initializes state and method tables, not attack actions.
dist/clients/function.client.js dynamic URL is caller-supplied axios client construction, not hidden dynamic require or payload loading.
dist/parsers/utils/postman.utils.js contains placeholder auth tokens and api.example.com defaults for Postman parsing, not embedded secrets.
dist/api/urls.js and clients route user-invoked SDK calls to ductape API or local override; no unsolicited exfiltration path seen.
dist/agents/agent-executor.js reads OpenAI/Anthropic env API keys only when user configures LLM providers.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 364 file(s), 4.30 MB of source, external domains: api.anthropic.com, api.ductape.app, api.nexmo.com, api.openai.com, api.pinecone.io, api.plivo.com, example.com, exp.host, schema.getpostman.com, storage.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged

dist/parsers/utils/postman.utils.jsView file

Lines 19-59javascript

19 }

20 },

21 response: {

22 status: 'OK',

23 code: 200,

24 body: '{"status": "success", "data": {}}',

25 headers: [

26 { key: 'Content-Type', value: 'application/json', type: 'text' }

27 ]

28 },

29 variable: {

30 defaultValue: '',

31 type: 'string'

32 },

33 auth: {

34 bearer: {

35 token: '{{bearerToken}}'

36 },

37 basic: {

38 username: '{{username}}',

39 password: '{{password}}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/parsers/utils/postman.utils.jsView on unpkg · L39

40 },

41 apikey: {

42 key: 'X-API-Key',

43 value: '{{apiKey}}',

44 in: 'header'

45 }

46 }

47};

48class ValidationUtils {

49 static isValidUrl(url) {

50 try {

51 new URL(url);

52 return true;

53 }

54 catch (_a) {

55 return false;

56 }

57 }

58 static isValidHttpMethod(method) {

59 const validMethods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT'];

dist/clients/function.client.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/database/presave/presave-processor.jsView file

Lines 59-99javascript

59 const validationErrors = [];

60 // Sort operations by type to ensure proper order

61 // (defaults first, then validations, then transformations, then encryption/hash)

62 const sortedOps = this.sortOperations(operations);

63 const processedRecords =

Source & flagged code

3 flagged · loading source

dist/parsers/utils/postman.utils.jsView file

39patternName = generic_password severity = medium line = 39 matchedText = password...d}}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/parsers/utils/postman.utils.jsView on unpkg · L39

dist/clients/function.client.jsView file

5Object.defineProperty(exports, "__esModule", { value: true }); L6: const axios_1 = __importDefault(require("axios")); L7: const CancelToken = axios_1.default.CancelToken;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/clients/function.client.jsView on unpkg · L5

dist/database/presave/presave-processor.jsView file

79return { L80: data: isArray ? processedRecords : processedRecords[0], L81: appliedOperations, ... L193: case presave_interface_1.PreSaveOperationType.PARSE_JSON: L194: return { [op.field]: typeof record[op.field] === 'string' ? JSON.parse(record[op.field]) : record[op.field] }; L195: case presave_interface_1.PreSaveOperationType.STRINGIFY_JSON:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/database/presave/presave-processor.jsView on unpkg · L79

Findings

4 Medium6 Low

MediumSecret Patterndist/parsers/utils/postman.utils.js

MediumDynamic Requiredist/clients/function.client.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/database/presave/presave-processor.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/parsers/utils/postman.utils.jsView file

Lines 19-59javascript

19 }

20 },

21 response: {

22 status: 'OK',

23 code: 200,

24 body: '{"status": "success", "data": {}}',

25 headers: [

26 { key: 'Content-Type', value: 'application/json', type: 'text' }

27 ]

28 },

29 variable: {

30 defaultValue: '',

31 type: 'string'

32 },

33 auth: {

34 bearer: {

35 token: '{{bearerToken}}'

36 },

37 basic: {

38 username: '{{username}}',

39 password: '{{password}}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/parsers/utils/postman.utils.jsView on unpkg · L39

40 },

41 apikey: {

42 key: 'X-API-Key',

43 value: '{{apiKey}}',

44 in: 'header'

45 }

46 }

47};

48class ValidationUtils {

49 static isValidUrl(url) {

50 try {

51 new URL(url);

52 return true;

53 }

54 catch (_a) {

55 return false;

56 }

57 }

58 static isValidHttpMethod(method) {

59 const validMethods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT'];

dist/clients/function.client.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/database/presave/presave-processor.jsView file

Lines 59-99javascript

59 const validationErrors = [];

60 // Sort operations by type to ensure proper order

61 // (defaults first, then validations, then transformations, then encryption/hash)

62 const sortedOps = this.sortOperations(operations);

63 const processedRecords =