registry / @faable/faable / 1.14.0

@faable/faable@1.14.0

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 114 KB of source, external domains: api.faable.com, dashboard.faable.com, faable.auth.faable.link, faable.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/api/context.jsView file

Lines 1-32javascript

1import { FaableApi } from './FaableApi.js';

2import { apikey_strategy } from './strategies/apikey.strategy.js';

3import { getIDToken } from '@actions/core';

4import { oidc_strategy } from './strategies/oidc.strategy.js';

5import { bearer_strategy } from './strategies/bearer.strategy.js';

6import { CredentialsStore } from '../lib/CredentialsStore.js';

7import { loadLiveCredentials } from './session.js';

8import { log } from '../log.js';

10const context = async () => {

11 let api;

12 // Auth resolution: FAABLE_TOKEN → OIDC (CI) → local `faable login` credentials.

13 if (process.env.FAABLE_TOKEN) {

14 // Token in environment

15 const token = process.env.FAABLE_TOKEN;

16 api = FaableApi.create({ authStrategy: bearer_strategy, auth: { token } });

17 }

18 else if (process.env.GITHUB_ACTIONS === "true") {

19 // Github actions environment

20 try {

21 const idToken = process.env.FAABLE_ID_TOKEN || (await getIDToken("https://faable.com"));

22 api = FaableApi.create({ authStrategy: oidc_strategy, auth: { idToken } });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/api/context.jsView on unpkg · L12

23 }

24 catch (_) {

25 console.error("Error fetching token, configure 'permissions: id-token: write'");

26 }

27 }

28 else {

29 const store = new CredentialsStore();

30 // Auto-refreshes an expired access token via the stored refresh_token.

31 const config = await loadLiveCredentials(store);

32 if (config) {

dist/commands/deploy/buildpacks/shared/templates/entrypoint.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 44 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/commands/deploy/buildpacks/shared/templates/entrypoint.shView on unpkg

Source & flagged code

2 flagged · loading source

dist/api/context.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code