registry / @edge-base/server / 0.3.3

@edge-base/server@0.3.3

EdgeBase runtime assets consumed by the EdgeBase CLI

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 189 file(s), 2.63 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api.cloudflare.com, api.github.com, api.line.me, api.mailgun.net, api.pwnedpasswords.com, api.resend.com, api.sendgrid.com, api.spotify.com, api.twilio.com, api.twitch.tv, api.x.com, app.example.com, appleid.apple.com, cdn.discordapp.com, cdn.jsdelivr.net, challenges.cloudflare.com, discord.com, docs.edgebase.dev, edgebase.fun, edgebase.local, example.com, fcm.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, id.twitch.tv, iid.googleapis.com, kapi.kakao.com, kauth.kakao.com, login.microsoftonline.com, nid.naver.com, oauth.reddit.com, oauth2.googleapis.com, openapi.naver.com, proxy.scalar.com, rest.messagebird.com, rest.nexmo.com, slack.com, svelte.dev, twitter.com, www.facebook.com, www.googleapis.com, www.reddit.com, www.w3.org

Source & flagged code

6 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/durable-objects/database-do.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @edge-base/server@0.3.1 matchedIdentity = npm:QGVkZ2UtYmFzZS9zZXJ2ZXI:0.3.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg

src/__tests__/push-provider.test.tsView file

Lines 44-81typescript

44 });

46 it('bypasses OAuth token exchange when MOCK_FCM_BASE_URL is configured', async () => {

47 const fetchMock = vi.fn(async (input: RequestInfo | URL, init?:

src/__tests__/admin-user-management.test.tsView file

Lines 138-178typescript

138 registerPhonePendingMock.mockReset().mockResolvedValue(undefined);

139 createUserMock.mockReset();

140 getUserByIdMock.mockReset();

141 updateUserMock.mockReset();

142 buildPublicUserDataMock.mockReset().mockReturnValue({

143 displayName: 'Public User',

144

Source & flagged code

6 flagged · loading source

src/lib/push-provider.tsView file

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

src/durable-objects/database-do.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg

src/__tests__/push-provider.test.tsView file

64patternName = private_key_rsa severity = critical line = 64 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in src/__tests__/push-provider.test.ts

src/__tests__/push-provider.test.tsView on unpkg · L64

src/__tests__/admin-user-management.test.tsView file

158patternName = generic_password severity = medium line = 158 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in src/__tests__/admin-user-management.test.ts

src/__tests__/admin-user-management.test.tsView on unpkg · L158

308patternName = generic_password severity = medium line = 308 matchedText = await ex...3');

Medium

Secret Pattern

Hardcoded password in src/__tests__/admin-user-management.test.ts

src/__tests__/admin-user-management.test.tsView on unpkg · L308

Findings

3 Critical1 High5 Medium5 Low

CriticalCritical Secretsrc/lib/push-provider.ts

CriticalSecret Patternsrc/__tests__/push-provider.test.ts

CriticalSecret Patternsrc/lib/push-provider.ts

HighPrevious Version Dangerous Deltasrc/durable-objects/database-do.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/__tests__/admin-user-management.test.ts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/durable-objects/database-do.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg

src/__tests__/push-provider.test.tsView file

Lines 44-81typescript

44 });

46 it('bypasses OAuth token exchange when MOCK_FCM_BASE_URL is configured', async () => {

47 const fetchMock = vi.fn(async (input: RequestInfo | URL, init?:

src/__tests__/admin-user-management.test.tsView file

Lines 138-178typescript

138 registerPhonePendingMock.mockReset().mockResolvedValue(undefined);

139 createUserMock.mockReset();

140 getUserByIdMock.mockReset();

141 updateUserMock.mockReset();

142 buildPublicUserDataMock.mockReset().mockReturnValue({

143 displayName: 'Public User',

144