registry / @faable/faable / 1.18.0

@faable/faable@1.18.0

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 91.1 KB of source, external domains: api.faable.com, dashboard.faable.com, faable.auth.faable.link, faable.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/api/context.jsView file

Lines 1-32javascript

1import { FaableApi } from './FaableApi.js';

2import { apikey_strategy } from './strategies/apikey.strategy.js';

3import { getIDToken } from '@actions/core';

4import { oidc_strategy } from './strategies/oidc.strategy.js';

5import { bearer_strategy } from './strategies/bearer.strategy.js';

6import { CredentialsStore } from '../lib/CredentialsStore.js';

7import { loadLiveCredentials } from './session.js';

8import { log } from '../log.js';

10const context = async () => {

11 let api;

12 // Auth resolution: FAABLE_TOKEN → OIDC (CI) → local `faable login` credentials.

13 if (process.env.FAABLE_TOKEN) {

14 // Token in environment

15 const token = process.env.FAABLE_TOKEN;

16 api = FaableApi.create({ authStrategy: bearer_strategy, auth: { token } });

17 }

18 else if (process.env.GITHUB_ACTIONS === "true") {

19 // Github actions environment

20 try {

21 const idToken = process.env.FAABLE_ID_TOKEN || (await getIDToken("https://faable.com"));

22 api = FaableApi.create({ authStrategy: oidc_strategy, auth: { idToken } });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/api/context.jsView on unpkg · L12

23 }

24 catch (_) {

25 console.error("Error fetching token, configure 'permissions: id-token: write'");

26 }

27 }

28 else {

29 const store = new CredentialsStore();

30 // Auto-refreshes an expired access token via the stored refresh_token.

31 const config = await loadLiveCredentials(store);

32 if (config) {

dist/commands/deploy/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @faable/faable@1.14.0 matchedIdentity = npm:QGZhYWJsZS9mYWFibGU:1.14.0 similarity = 0.805 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/api/context.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code