registry / @earthsense/siracmd / 0.1.65

@earthsense/siracmd@0.1.65

siracmd — remote command-line client for SIRA

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 207 KB of source, external domains: api.github.com, deb.nodesource.com, github.com, tntjbdhrvicesifuxunc.supabase.co

Source & flagged code

7 flagged

dist/auth.jsView file

Lines 1-33javascript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8import { createServer } from "http";

9import { createClient } from "@supabase/supabase-js";

10import { loadCliConfig, saveCliConfig } from "./config.js";

11// Hardcoded Supabase project — all siracmd instances connect to the same project

12const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co";

13const SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InRudGpiZGhydmljZXNpZnV4dW5jIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMyNjQyMDgsImV4cCI6MjA4ODg0MDIwOH0.Jqpv0508USVVyLfmvFUr931yAm8mBxb4Jn6fWFtF41U";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

14const CALLBACK_PORT = 54321;

15const REDIRECT_URL = `http://localhost:${CALLBACK_PORT}/auth/callback`;

16export { SUPABASE_URL, SUPABASE_ANON_KEY };

17export async function login(provider = "github") {

18 const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

19 // Get the OAuth URL from Supabase

20 const { data, error } = await client.auth.signInWithOAuth({

21 provider,

22 options: { redirectTo: REDIRECT_URL, skipBrowserRedirect: true },

23 });

24 if (error || !data?.url) {

25 throw new Error(`Failed to initiate OAuth: ${error?.message ?? "no URL returned"}`);

26 }

27 console.log(`\nOpening browser for ${provider} authentication...`);

28 console.log(`If it doesn't open, visit:\n ${data.url}\n`);

29 // Open browser

30 const open = await getOpen();

31 await open(data.url);

32 // Wait for callback

33 const params = await waitForCallback();

Lines 125-156javascript

125 res.end("<html><body><h2>Authenticated! You can close this tab.</h2></body></html>");

126 clearTimeout(timeout);

127 server.close();

128 resolve(params);

129 }

130 else {

131 res.writeHead(404

dist/index.jsView file

Lines 2000-2040javascript

2000 console.log(`✓ collection already local at ${outDir} — skipping pull`);

2001 }

2002 else {

2003 if (existsSync(outDir) && readdirSync(outDir).length >

dist/auth.d.tsView file

Lines 1-16typescript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8declare const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co"

Source & flagged code

7 flagged · loading source

dist/auth.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code