Loading npm security reports…

@ductape/sdk@0.1.71: Suspicious npm security report (Warn) | LPM Firewall

registry / @ductape/sdk / 0.1.71

@ductape/sdk@0.1.71

sdk for building ductaped products

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 364 file(s), 4.31 MB of source, external domains: api.anthropic.com, api.ductape.app, api.nexmo.com, api.openai.com, api.pinecone.io, api.plivo.com, example.com, exp.host, schema.getpostman.com, storage.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged

dist/parsers/utils/postman.utils.jsView file

Lines 19-59javascript

19 }

20 },

21 response: {

22 status: 'OK',

23 code: 200,

24 body: '{"status": "success", "data": {}}',

25 headers: [

26 { key: 'Content-Type', value: 'application/json', type: 'text' }

27 ]

28 },

29 variable: {

30 defaultValue: '',

31 type: 'string'

32 },

33 auth: {

34 bearer: {

35 token: '{{bearerToken}}'

36 },

37 basic: {

38 username: '{{username}}',

39 password: '{{password}}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/parsers/utils/postman.utils.jsView on unpkg · L39

40 },

41 apikey: {

42 key: 'X-API-Key',

43 value: '{{apiKey}}',

44 in: 'header'

45 }

46 }

47};

48class ValidationUtils {

49 static isValidUrl(url) {

50 try {

51 new URL(url);

52 return true;

53 }

54 catch (_a) {

55 return false;

56 }

57 }

58 static isValidHttpMethod(method) {

59 const validMethods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT'];

dist/clients/function.client.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/database/presave/presave-processor.jsView file

Lines 59-99javascript

59 const validationErrors = [];

60 // Sort operations by type to ensure proper order

61 // (defaults first, then validations, then transformations, then encryption/hash)

62 const sortedOps = this.sortOperations(operations);

Source & flagged code

3 flagged · loading source

dist/parsers/utils/postman.utils.jsView file

39patternName = generic_password severity = medium line = 39 matchedText = password...d}}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/parsers/utils/postman.utils.jsView on unpkg · L39

dist/clients/function.client.jsView file

5Object.defineProperty(exports, "__esModule", { value: true }); L6: const axios_1 = __importDefault(require("axios")); L7: const CancelToken = axios_1.default.CancelToken;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/clients/function.client.jsView on unpkg · L5

dist/database/presave/presave-processor.jsView file

Findings

4 Medium6 Low

MediumSecret Patterndist/parsers/utils/postman.utils.js

MediumDynamic Requiredist/clients/function.client.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/database/presave/presave-processor.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings