registry / @flashbacktech/tsclient / 0.5.8

@flashbacktech/tsclient@0.5.8

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 273 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2293-2333javascript

2293 label: "User OCID",

2294 type: "text",

2295 required: true,

2296 placeholder: "ocid1.user.oc1..aaaa\u2026",

2297 help: "The OCID of the user the API signing key belongs to."

2298 },

2299 {

2300 path: "metadata.fingerprint",

2301 label: "Key Fingerprint",

2302 type: "text",

2303 required: true,

2304 placeholder: "aa:bb:cc:dd:\u2026",

2305 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2306 },

2307 {

2308 path: "secret",

2309 label: "API Private Key (PEM)",

2310 type: "pem",

2311 required: true,

2312 secret: true,

2313 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2313

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2313

2314 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2315 },

2316 {

2317 path: "metadata.region",

2318 label: "Region",

2319 type: "text",

2320 required: false,

2321 placeholder: "us-phoenix-1",

2322 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2323 }

2324 ]

2325 },

2326 SSH: {

2327 id: "SSH",

2328 displayName: "SSH",

2329 capabilities: CAP_COMPUTE,

2330 fields: [

2331 {

2332 path: "metadata.user",

2333 label: "User",

Lines 2341-2381javascript

2341 label: "Host",

2342 type: "text",

2343 required: true,

2344 placeholder: "vps.example.com or * for wildcard",

2345 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2346 },

2347 {

2348 path

dist/index.cjsView file

Lines 2295-2335javascript

2295 label: "User OCID",

2296 type: "text",

2297 required: true,

2298 placeholder: "ocid1.user.oc1..aaaa\u2026",

2299 help: "The OCID of the user the API signing key belongs to."

2300 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2313patternName = private_key_rsa severity = critical line = 2313 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2313

2313patternName = private_key_rsa severity = critical line = 2313 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2313

2361patternName = private_key_openssh severity = critical line = 2361 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2361

dist/index.cjsView file

2315patternName = private_key_rsa severity = critical line = 2315 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2315

2363patternName = private_key_openssh severity = critical line = 2363 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2363

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2293-2333javascript

2293 label: "User OCID",

2294 type: "text",

2295 required: true,

2296 placeholder: "ocid1.user.oc1..aaaa\u2026",

2297 help: "The OCID of the user the API signing key belongs to."

2298 },

2299 {

2300 path: "metadata.fingerprint",

2301 label: "Key Fingerprint",

2302 type: "text",

2303 required: true,

2304 placeholder: "aa:bb:cc:dd:\u2026",

2305 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2306 },

2307 {

2308 path: "secret",

2309 label: "API Private Key (PEM)",

2310 type: "pem",

2311 required: true,

2312 secret: true,

2313 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2313

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2313

2314 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2315 },

2316 {

2317 path: "metadata.region",

2318 label: "Region",

2319 type: "text",

2320 required: false,

2321 placeholder: "us-phoenix-1",

2322 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2323 }

2324 ]

2325 },

2326 SSH: {

2327 id: "SSH",

2328 displayName: "SSH",

2329 capabilities: CAP_COMPUTE,

2330 fields: [

2331 {

2332 path: "metadata.user",

2333 label: "User",

Lines 2341-2381javascript

2341 label: "Host",

2342 type: "text",

2343 required: true,

2344 placeholder: "vps.example.com or * for wildcard",

2345 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2346 },

2347 {

2348 path

dist/index.cjsView file

Lines 2295-2335javascript

2295 label: "User OCID",

2296 type: "text",

2297 required: true,

2298 placeholder: "ocid1.user.oc1..aaaa\u2026",

2299 help: "The OCID of the user the API signing key belongs to."

2300 },

Lines 2343-2383javascript

2343 label: "Host",

2344 type: "text",

2345 required: true,

2346 placeholder: "vps.example.com or * for wildcard",

2347 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2348 },

2349 {

2350 path: "metadata.port",

2351 label: "Port",

2352 type: "number",

2353 required: false,

2354 default: 22,

2355 placeholder: "22"

2356 },

2357 {

2358 path: "secret",

2359 label: "PEM Private Key",

2360 type: "pem",

2361 required: true,

2362 secret: true,

2363 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2363

2364 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2365 }

2366 ]

2367 },

2368 GITHUB: {

2369 id: "GITHUB",

2370 displayName: "GitHub",

2371 capabilities: CAP_VCS,

2372 fields: [

2373 {

2374 path: "secret",

2375 label: "Personal Access Token (PAT)",

2376 type: "password",

2377 required: true,

2378 secret: true,

2379 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2380 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2381 },

2382 {

2383 path: "metadata.org",