registry / @edge-base/server / 0.4.1

@edge-base/server@0.4.1

EdgeBase runtime assets consumed by the EdgeBase CLI

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 198 file(s), 2.95 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api.cloudflare.com, api.github.com, api.line.me, api.mailgun.net, api.pwnedpasswords.com, api.resend.com, api.sendgrid.com, api.spotify.com, api.twilio.com, api.twitch.tv, api.x.com, app.example.com, appleid.apple.com, cdn.discordapp.com, cdn.jsdelivr.net, challenges.cloudflare.com, discord.com, docs.edgebase.dev, edgebase.fun, edgebase.local, example.com, fcm.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, id.twitch.tv, iid.googleapis.com, kapi.kakao.com, kauth.kakao.com, login.microsoftonline.com, nid.naver.com, oauth-state.internal, oauth.reddit.com, oauth2.googleapis.com, openapi.naver.com, proxy.scalar.com, rest.messagebird.com, rest.nexmo.com, slack.com, svelte.dev, twitter.com, www.facebook.com, www.googleapis.com, www.reddit.com, www.w3.org

Source & flagged code

3 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/durable-objects/database-do.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @edge-base/server@0.3.3 matchedIdentity = npm:QGVkZ2UtYmFzZS9zZXJ2ZXI:0.3.3 similarity = 0.408 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg

Source & flagged code

3 flagged · loading source

src/lib/push-provider.tsView file

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

src/durable-objects/database-do.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg

Findings

2 Critical1 High3 Medium5 Low

CriticalCritical Secretsrc/lib/push-provider.ts

CriticalSecret Patternsrc/lib/push-provider.ts

HighPrevious Version Dangerous Deltasrc/durable-objects/database-do.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

src/durable-objects/database-do.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/durable-objects/database-do.tsView on unpkg