registry / @edge-base/server / 0.3.1

@edge-base/server@0.3.1

EdgeBase runtime assets consumed by the EdgeBase CLI

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 189 file(s), 2.57 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api.cloudflare.com, api.github.com, api.line.me, api.mailgun.net, api.pwnedpasswords.com, api.resend.com, api.sendgrid.com, api.spotify.com, api.twilio.com, api.twitch.tv, api.x.com, app.example.com, appleid.apple.com, cdn.discordapp.com, cdn.jsdelivr.net, challenges.cloudflare.com, discord.com, docs.edgebase.dev, edgebase.fun, edgebase.local, example.com, fcm.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, id.twitch.tv, iid.googleapis.com, kapi.kakao.com, kauth.kakao.com, login.microsoftonline.com, nid.naver.com, oauth.reddit.com, oauth2.googleapis.com, openapi.naver.com, proxy.scalar.com, rest.messagebird.com, rest.nexmo.com, slack.com, svelte.dev, twitter.com, www.facebook.com, www.googleapis.com, www.reddit.com, www.w3.org

Source & flagged code

5 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/__tests__/push-provider.test.tsView file

Lines 44-81typescript

44 });

46 it('bypasses OAuth token exchange when MOCK_FCM_BASE_URL is configured', async () => {

47 const fetchMock = vi.fn(async (input: RequestInfo | URL, init?:

src/__tests__/admin-user-management.test.tsView file

Lines 138-178typescript

138 registerPhonePendingMock.mockReset().mockResolvedValue(undefined);

139 createUserMock.mockReset();

140 getUserByIdMock.mockReset();

141 updateUserMock.mockReset();

142 buildPublicUserDataMock.mockReset().mockReturnValue({

143 displayName: 'Public User',

144

Source & flagged code

5 flagged · loading source

src/lib/push-provider.tsView file

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

src/__tests__/push-provider.test.tsView file

64patternName = private_key_rsa severity = critical line = 64 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in src/__tests__/push-provider.test.ts

src/__tests__/push-provider.test.tsView on unpkg · L64

src/__tests__/admin-user-management.test.tsView file

158patternName = generic_password severity = medium line = 158 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in src/__tests__/admin-user-management.test.ts

src/__tests__/admin-user-management.test.tsView on unpkg · L158

308patternName = generic_password severity = medium line = 308 matchedText = await ex...3');

Medium

Secret Pattern

Hardcoded password in src/__tests__/admin-user-management.test.ts

src/__tests__/admin-user-management.test.tsView on unpkg · L308

Findings

3 Critical5 Medium5 Low

CriticalCritical Secretsrc/lib/push-provider.ts

CriticalSecret Patternsrc/__tests__/push-provider.test.ts

CriticalSecret Patternsrc/lib/push-provider.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/__tests__/admin-user-management.test.ts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/__tests__/push-provider.test.tsView file

Lines 44-81typescript

44 });

46 it('bypasses OAuth token exchange when MOCK_FCM_BASE_URL is configured', async () => {

47 const fetchMock = vi.fn(async (input: RequestInfo | URL, init?:

src/__tests__/admin-user-management.test.tsView file

Lines 138-178typescript

138 registerPhonePendingMock.mockReset().mockResolvedValue(undefined);

139 createUserMock.mockReset();

140 getUserByIdMock.mockReset();

141 updateUserMock.mockReset();

142 buildPublicUserDataMock.mockReset().mockReturnValue({

143 displayName: 'Public User',

144

Lines 288-312typescript

288 await expect(updateManagedAdminUser(db, 'user-1', {

289 email: 'new@example.com',

290 })).rejects.toMatchObject({ code: 500 });

291

292 expect(registerEmailPendingMock).toHaveBeenCalledWith(db, 'new@example.com', 'user-1');

293 expect(confirmEmailMock).toHaveBeenCalledWith(db, 'new@example.com', 'user-1');

294 expect(deleteEmailMock).toHaveBeenCalledWith(db, 'old@example.com');

295 expect(deleteEmailMock).toHaveBeenCalledWith(db, 'new@example.com');

296 expect(registerEmailPendingMock).toHaveBeenCalledWith(db, 'old@example.com', 'user-1');

297 expect(confirmEmailMock).toHaveBeenCalledWith(db, 'old@example.com', 'user-1');

298 expect(updateUserMock).toHaveBeenCalledTimes(2);

299 expect(syncPublicUserProjectionMock).toHaveBeenCalledTimes(2);

300 });

301});

302

303describe('prepareImportedPasswordHash', () => {

304 it('reuses valid hashes and hashes plain passwords', async () => {

305 const existingHash = '$2b$12$abcdefghijklmnopqrstuv';

306

307 await expect(prepareImportedPasswordHash({ passwordHash: existingHash })).resolves.toBe(existingHash);

308 await expect(prepareImportedPasswordHash({ password: 'secret123' })).resolves.toBe('hashed:secret123');

Medium

Secret Pattern

Hardcoded password in src/__tests__/admin-user-management.test.ts

src/__tests__/admin-user-management.test.tsView on unpkg · L308

309 expect(hashPasswordMock).toHaveBeenCalledWith('secret123');

310 });

311});

312