registry / @edge-base/server / 0.4.8

@edge-base/server@0.4.8

EdgeBase runtime assets consumed by the EdgeBase CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 201 file(s), 2.99 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api.cloudflare.com, api.github.com, api.line.me, api.mailgun.net, api.pwnedpasswords.com, api.resend.com, api.sendgrid.com, api.spotify.com, api.twilio.com, api.twitch.tv, api.x.com, app.example.com, appleid.apple.com, cdn.discordapp.com, cdn.jsdelivr.net, challenges.cloudflare.com, discord.com, docs.edgebase.dev, edgebase.fun, edgebase.local, example.com, fcm.googleapis.com, github.com, graph.facebook.com, graph.microsoft.com, id.twitch.tv, iid.googleapis.com, kapi.kakao.com, kauth.kakao.com, login.microsoftonline.com, nid.naver.com, oauth-state.internal, oauth.reddit.com, oauth2.googleapis.com, openapi.naver.com, proxy.scalar.com, rest.messagebird.com, rest.nexmo.com, slack.com, svelte.dev, twitter.com, www.facebook.com, www.googleapis.com, www.reddit.com, www.w3.org

Source & flagged code

2 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,

Source & flagged code

2 flagged · loading source

src/lib/push-provider.tsView file

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

278patternName = private_key_rsa severity = critical line = 278 matchedText = .replace... '')

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

Findings

2 Critical3 Medium5 Low

CriticalCritical Secretsrc/lib/push-provider.ts

CriticalSecret Patternsrc/lib/push-provider.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/lib/push-provider.tsView file

Lines 258-298typescript

258 */

259 private async getAccessToken(): Promise<string | null> {

260 if (this.accessToken && Date.now() < this.tokenExpiry) {

261 return this.accessToken;

262 }

263

264 if (this.useMockAccessToken) {

265 this.accessToken = 'mock-access-token';

266 this.tokenExpiry = Date.now() + 55 * 60 * 1000;

267 return this.accessToken;

268 }

269

270 try {

271 const sa = JSON.parse(this.serviceAccountJson) as {

272 client_email: string;

273 private_key: string;

274 };

275

276 // Import RS256 private key

277 const pemContent = sa.private_key

278 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/push-provider.tsView on unpkg · L278

Critical

Secret Pattern

RSA private key in src/lib/push-provider.ts

src/lib/push-provider.tsView on unpkg · L278

279 .replace(/-----END PRIVATE KEY-----/g, '')

280 .replace(/\n/g, '');

281 const keyData = Uint8Array.from(atob(pemContent), c => c.charCodeAt(0));

282

283 const privateKey = await crypto.subtle.importKey(

284 'pkcs8',

285 keyData,

286 { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },

287 false,

288 ['sign'],

289 );

290

291 // Create JWT

292 const now = Math.floor(Date.now() / 1000);

293 const header = { alg: 'RS256', typ: 'JWT' };

294 const claimSet = {

295 iss: sa.client_email,

296 scope: 'https://www.googleapis.com/auth/firebase.messaging',

297 aud: this.endpoints.oauth2TokenUrl,

298 iat: now,