registry / @fern-api/replay / 0.19.1

@fern-api/replay@0.19.1

Automatically preserves SDK customizations across Fern regenerations

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.11 MB of source

Source & flagged code

10 flagged

dist/index.jsView file

Lines 443-488javascript

443 if (match && match[1] === filePath) {

444 inTarget = true;

445 out.push(line);

446 }

447 continue;

448 }

449 if (inTarget) out.push(line);

450 }

451 return out.length > 0 ? out.join("\n") + "\n" : null;

452}

453var init_PatchApplyTheirs = __esm({

454 "src/PatchApplyTheirs.ts"() {

455 "use strict";

456 init_GitClient();

457 }

458});

459

460// src/credentials.ts

461var CREDENTIAL_PATTERNS = [

462 { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },

463 { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L463

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L463

464 { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L464

465 { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },

466 { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },

467 { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },

468 { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L468

469 { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },

470 { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }

471];

472var SENSITIVE_FILE_PATTERNS = [

473 /(^|\/)\.env(\.[^/]+)?$/,

474 /\.pem$/,

475 /\.key$/,

476 /\.pkce_state\.json$/,

477 /(^|\/)id_rsa$/,

478 /(^|\/)id_ed25519$/

479];

480function isSensitiveFile(filePath) {

481 return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));

482}

483function scanForCredentials(content) {

484 const matches = [];

485 for (const { name, re } of CREDENTIAL_PATTERNS) {

486 if (re.test(content)) {

487 matches.push(name);

488 }

dist/index.cjsView file

Lines 498-543javascript

498 SENSITIVE_FILE_PATTERNS: () => SENSITIVE_FILE_PATTERNS,

499 bootstrap: () => bootstrap,

500 forget: () => forget,

501 isGenerationCommit: () => isGenerationCommit,

502 isReplayCommit: () => isReplayCommit,

503 isRevertCommit

dist/cli.cjsView file

14644patternName = private_key_openssh severity = critical line = 14644 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14644

14645patternName = private_key_rsa severity = critical line = 14645 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14645

14649patternName = generic_password severity = medium line = 14649 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/cli.cjs

dist/cli.cjsView on unpkg · L14649

Source & flagged code

10 flagged · loading source

dist/index.jsView file

463patternName = private_key_openssh severity = critical line = 463 matchedText = { name: .../ },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L463

463patternName = private_key_openssh severity = critical line = 463 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L463

464patternName = private_key_rsa severity = critical line = 464 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L464

468patternName = generic_password severity = medium line = 468 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L468

dist/index.cjsView file

518patternName = private_key_openssh severity = critical line = 518 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L518

519patternName = private_key_rsa severity = critical line = 519 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L519

523patternName = generic_password severity = medium line = 523 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L523

dist/cli.cjsView file

14644patternName = private_key_openssh severity = critical line = 14644 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14644

14645patternName = private_key_rsa severity = critical line = 14645 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14645

14649patternName = generic_password severity = medium line = 14649 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/cli.cjs

dist/cli.cjsView on unpkg · L14649

Findings

7 Critical4 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

CriticalSecret Patterndist/cli.cjs

MediumEnvironment Vars

MediumSecret Patterndist/index.js

MediumSecret Patterndist/index.cjs

MediumSecret Patterndist/cli.cjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

10 flagged

dist/index.jsView file

Lines 443-488javascript

443 if (match && match[1] === filePath) {

444 inTarget = true;

445 out.push(line);

446 }

447 continue;

448 }

449 if (inTarget) out.push(line);

450 }

451 return out.length > 0 ? out.join("\n") + "\n" : null;

452}

453var init_PatchApplyTheirs = __esm({

454 "src/PatchApplyTheirs.ts"() {

455 "use strict";

456 init_GitClient();

457 }

458});

459

460// src/credentials.ts

461var CREDENTIAL_PATTERNS = [

462 { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },

463 { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L463

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L463

464 { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L464

465 { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },

466 { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },

467 { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },

468 { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L468

469 { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },

470 { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }

471];

472var SENSITIVE_FILE_PATTERNS = [

473 /(^|\/)\.env(\.[^/]+)?$/,

474 /\.pem$/,

475 /\.key$/,

476 /\.pkce_state\.json$/,

477 /(^|\/)id_rsa$/,

478 /(^|\/)id_ed25519$/

479];

480function isSensitiveFile(filePath) {

481 return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));

482}

483function scanForCredentials(content) {

484 const matches = [];

485 for (const { name, re } of CREDENTIAL_PATTERNS) {

486 if (re.test(content)) {

487 matches.push(name);

488 }

dist/index.cjsView file

Lines 498-543javascript

498 SENSITIVE_FILE_PATTERNS: () => SENSITIVE_FILE_PATTERNS,

499 bootstrap: () => bootstrap,

500 forget: () => forget,

501 isGenerationCommit: () => isGenerationCommit,

502 isReplayCommit: () => isReplayCommit,

503 isRevertCommit

dist/cli.cjsView file

14644patternName = private_key_openssh severity = critical line = 14644 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14644

14645patternName = private_key_rsa severity = critical line = 14645 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14645

14649patternName = generic_password severity = medium line = 14649 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/cli.cjs

dist/cli.cjsView on unpkg · L14649