registry / @embarkai/core / 0.4.6

@embarkai/core@0.4.6

Framework-agnostic core SDK for EmbarkAI smart accounts

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 950 KB of source, external domains: api.embarkai.io, api.lumiapassport.com, arbitrum-sepolia-rpc.publicnode.com, base-sepolia-rpc.publicnode.com, beam-explorer.lumia.org, beam-rpc.lumia.org, bnb-testnet.g.alchemy.com, bsc-testnet-rpc.publicnode.com, bsc-testnet.core.chainstack.com, dashboard.embarkai.io, ethereum-mainnet.core.chainstack.com, ethereum-sepolia-rpc.publicnode.com, explorer.lumia.org, lark-explorer.18102024.xyz, lark-rpc.18102024.xyz, mainnet-rpc.lumia.org, sepolia.arbiscan.io, sepolia.basescan.org, sepolia.etherscan.io, smart-cold-bush.bsc-testnet.quiknode.pro, testnet.bscscan.com

Source & flagged code

4 flagged

dist/clients/index.jsView file

Lines 590-630javascript

590 const dataIv = ciphertextWithIv.slice(0, 12);

591 const encryptedData = ciphertextWithIv.slice(12);

592 const decryptedData = await subtle.decrypt(

593 { name: "AES-GCM", iv: dataIv, ...aadBytes && { additionalData: aadBytes } },

594 dekCryptoKey,

595 encryptedData

596 );

597 const plaintext = new TextDecoder().decode(decryptedData);

598 return JSON.parse(plaintext);

599 } catch (error) {

600 lastError = error;

601 if (error instanceof Error && error.name === "OperationError" && aadCandidates.indexOf(aadBytes) < aadCandidates.length - 1) {

602 continue;

603 }

604 }

605 }

606 if (lastError instanceof Error && (lastError.name === "OperationError" || lastError.message.includes("OperationError"))) {

607 throw new Error("Incorrect password: Unable to decrypt the backup with the provided password");

608 }

609 throw new Error(

610 "Failed to decrypt keyshare with password: " + (lastError instanceof Error ? lastError.message : String(lastError))

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/clients/index.jsView on unpkg · L610

611 );

612}

613async function backupToVault(client, data, password) {

614 const envelope = await envelopeEncryptKeyshareWithPassword(data, password);

615 await uploadShareToVault(client, data.userId, envelope);

616}

617async function restoreFromVault(client, userId, password) {

618 const envelope = await downloadShareFromVault(client, userId);

619 const backupData = await envelopeDecryptKeyshareWithPassword(envelope, password);

620 if (backupData.userId !== userId) {

621 throw new Error("Vault backup does not match current user");

622 }

623 return backupData;

624}

625var tssUrlProvider, shareVaultUrlProvider;

626var init_vault = __esm({

627 "src/vault/index.ts"() {

628 }

629});

630

dist/clients/index.cjsView file

Lines 592-632javascript

592 const dataIv = ciphertextWithIv.slice(0, 12);

593 const encryptedData = ciphertextWithIv.slice(12);

594 const decryptedData = await subtle.decrypt(

dist/index.jsView file

Lines 2764-2804javascript

2764 const dataIv = ciphertextWithIv.slice(0, 12);

2765 const encryptedData = ciphertextWithIv.slice(12);

2766 const decryptedData = await subtle.decrypt(

dist/index.cjsView file

Lines 2765-2805javascript

2765 const dataIv = ciphertextWithIv.slice(0, 12);

2766 const encryptedData = ciphertextWithIv.slice(12);

2767 const decryptedData = await subtle.decrypt(

Source & flagged code

4 flagged · loading source

dist/clients/index.jsView file

610patternName = generic_password severity = medium line = 610 matchedText = "Failed ...or))

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/clients/index.jsView on unpkg · L610

dist/clients/index.cjsView file

612patternName = generic_password severity = medium line = 612 matchedText = "Failed ...or))

Medium

Secret Pattern

Hardcoded password in dist/clients/index.cjs

dist/clients/index.cjsView on unpkg · L612

dist/index.jsView file

2784patternName = generic_password severity = medium line = 2784 matchedText = "Failed ...or))

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L2784

dist/index.cjsView file

2785patternName = generic_password severity = medium line = 2785 matchedText = "Failed ...or))

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L2785

Findings

6 Medium4 Low

MediumSecret Patterndist/clients/index.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/clients/index.cjs

MediumSecret Patterndist/index.js

MediumSecret Patterndist/index.cjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/clients/index.jsView file

Lines 590-630javascript

590 const dataIv = ciphertextWithIv.slice(0, 12);

591 const encryptedData = ciphertextWithIv.slice(12);

592 const decryptedData = await subtle.decrypt(

593 { name: "AES-GCM", iv: dataIv, ...aadBytes && { additionalData: aadBytes } },

594 dekCryptoKey,

595 encryptedData

596 );

597 const plaintext = new TextDecoder().decode(decryptedData);

598 return JSON.parse(plaintext);

599 } catch (error) {

600 lastError = error;

601 if (error instanceof Error && error.name === "OperationError" && aadCandidates.indexOf(aadBytes) < aadCandidates.length - 1) {

602 continue;

603 }

604 }

605 }

606 if (lastError instanceof Error && (lastError.name === "OperationError" || lastError.message.includes("OperationError"))) {

607 throw new Error("Incorrect password: Unable to decrypt the backup with the provided password");

608 }

609 throw new Error(

610 "Failed to decrypt keyshare with password: " + (lastError instanceof Error ? lastError.message : String(lastError))

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/clients/index.jsView on unpkg · L610

611 );

612}

613async function backupToVault(client, data, password) {

614 const envelope = await envelopeEncryptKeyshareWithPassword(data, password);

615 await uploadShareToVault(client, data.userId, envelope);

616}

617async function restoreFromVault(client, userId, password) {

618 const envelope = await downloadShareFromVault(client, userId);

619 const backupData = await envelopeDecryptKeyshareWithPassword(envelope, password);

620 if (backupData.userId !== userId) {

621 throw new Error("Vault backup does not match current user");

622 }

623 return backupData;

624}

625var tssUrlProvider, shareVaultUrlProvider;

626var init_vault = __esm({

627 "src/vault/index.ts"() {

628 }

629});

630

dist/clients/index.cjsView file

Lines 592-632javascript

592 const dataIv = ciphertextWithIv.slice(0, 12);

593 const encryptedData = ciphertextWithIv.slice(12);

594 const decryptedData = await subtle.decrypt(

dist/index.jsView file

Lines 2764-2804javascript

2764 const dataIv = ciphertextWithIv.slice(0, 12);

2765 const encryptedData = ciphertextWithIv.slice(12);

2766 const decryptedData = await subtle.decrypt(

dist/index.cjsView file

Lines 2765-2805javascript

2765 const dataIv = ciphertextWithIv.slice(0, 12);

2766 const encryptedData = ciphertextWithIv.slice(12);

2767 const decryptedData = await subtle.decrypt(