registry / @fern-api/replay / 0.19.1

@fern-api/replay@0.19.1

Automatically preserves SDK customizations across Fern regenerations

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.11 MB of source

Source & flagged code

10 flagged

dist/index.jsView file

Lines 443-488javascript

443 if (match && match[1] === filePath) {

444 inTarget = true;

445 out.push(line);

446 }

447 continue;

448 }

449

Source & flagged code

10 flagged · loading source

dist/index.jsView file

463patternName = private_key_openssh severity = critical line = 463 matchedText = { name: .../ },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L463

463patternName = private_key_openssh severity = critical line = 463 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L463

464patternName = private_key_rsa severity = critical line = 464 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L464

468patternName = generic_password severity = medium line = 468 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L468

dist/index.cjsView file

518patternName = private_key_openssh severity = critical line = 518 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L518

519patternName = private_key_rsa severity = critical line = 519 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L519

523patternName = generic_password severity = medium line = 523 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L523

dist/cli.cjsView file

14644patternName = private_key_openssh severity = critical line = 14644 matchedText = { name: .../ },

Critical

Secret Pattern

OpenSSH private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14644

14645patternName = private_key_rsa severity = critical line = 14645 matchedText = { name: .../ },

Critical

Secret Pattern

RSA private key in dist/cli.cjs

dist/cli.cjsView on unpkg · L14645

14649patternName = generic_password severity = medium line = 14649 matchedText = { name: ...i },

Medium

Secret Pattern

Hardcoded password in dist/cli.cjs

dist/cli.cjsView on unpkg · L14649

Findings

7 Critical4 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

CriticalSecret Patterndist/cli.cjs

MediumEnvironment Vars

MediumSecret Patterndist/index.js

MediumSecret Patterndist/index.cjs

MediumSecret Patterndist/cli.cjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/index.cjsView file

Lines 498-543javascript

498 SENSITIVE_FILE_PATTERNS: () => SENSITIVE_FILE_PATTERNS,

499 bootstrap: () => bootstrap,

500 forget: () => forget,

501 isGenerationCommit: () => isGenerationCommit,

502 isReplayCommit: () => isReplayCommit,

503 isRevertCommit: () => isRevertCommit,

504 isSensitiveFile: () => isSensitiveFile,

505 parseRevertedMessage: () => parseRevertedMessage,

506 parseRevertedSha: () => parseRevertedSha,

507 reset: () => reset,

508 resolve: () => resolve,

509 scanForCredentials: () => scanForCredentials,

510 status: () => status,

511 threeWayMerge: () => threeWayMerge

512});

513module.exports = __toCommonJS(index_exports);

514

515// src/credentials.ts

516var CREDENTIAL_PATTERNS = [

517 { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },

518 { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L518

519 { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L519

520 { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },

521 { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },

522 { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },

523 { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L523

524 { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },

525 { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }

526];

527var SENSITIVE_FILE_PATTERNS = [

528 /(^|\/)\.env(\.[^/]+)?$/,

529 /\.pem$/,

530 /\.key$/,

531 /\.pkce_state\.json$/,

532 /(^|\/)id_rsa$/,

533 /(^|\/)id_ed25519$/

534];

535function isSensitiveFile(filePath) {

536 return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));

537}

538function scanForCredentials(content) {

539 const matches = [];

540 for (const { name, re } of CREDENTIAL_PATTERNS) {

541 if (re.test(content)) {

542 matches.push(name);

543 }