registry / @flashbacktech/tsclient / 0.4.90

@flashbacktech/tsclient@0.4.90

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 216 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2046-2086javascript

2046 label: "User OCID",

2047 type: "text",

2048 required: true,

2049 placeholder: "ocid1.user.oc1..aaaa\u2026",

2050 help: "The OCID of the user the API signing key belongs to."

2051 },

2052 {

2053 path: "metadata.fingerprint",

2054 label: "Key Fingerprint",

2055 type: "text",

2056 required: true,

2057 placeholder: "aa:bb:cc:dd:\u2026",

2058 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2059 },

2060 {

2061 path: "secret",

2062 label: "API Private Key (PEM)",

2063 type: "pem",

2064 required: true,

2065 secret: true,

2066 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2066

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2066

2067 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2068 },

2069 {

2070 path: "metadata.region",

2071 label: "Region",

2072 type: "text",

2073 required: false,

2074 placeholder: "us-phoenix-1",

2075 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2076 }

2077 ]

2078 },

2079 SSH: {

2080 id: "SSH",

2081 displayName: "SSH",

2082 capabilities: CAP_COMPUTE,

2083 fields: [

2084 {

2085 path: "metadata.user",

2086 label: "User",

Lines 2094-2134javascript

2094 label: "Host",

2095 type: "text",

2096 required: true,

2097 placeholder: "vps.example.com or * for wildcard",

2098 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2099 },

2100 {

2101 path

dist/index.cjsView file

Lines 2048-2088javascript

2048 label: "User OCID",

2049 type: "text",

2050 required: true,

2051 placeholder: "ocid1.user.oc1..aaaa\u2026",

2052 help: "The OCID of the user the API signing key belongs to."

2053 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2066patternName = private_key_rsa severity = critical line = 2066 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2066

2066patternName = private_key_rsa severity = critical line = 2066 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2066

2114patternName = private_key_openssh severity = critical line = 2114 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2114

dist/index.cjsView file

2068patternName = private_key_rsa severity = critical line = 2068 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2068

2116patternName = private_key_openssh severity = critical line = 2116 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2116

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2046-2086javascript

2046 label: "User OCID",

2047 type: "text",

2048 required: true,

2049 placeholder: "ocid1.user.oc1..aaaa\u2026",

2050 help: "The OCID of the user the API signing key belongs to."

2051 },

2052 {

2053 path: "metadata.fingerprint",

2054 label: "Key Fingerprint",

2055 type: "text",

2056 required: true,

2057 placeholder: "aa:bb:cc:dd:\u2026",

2058 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2059 },

2060 {

2061 path: "secret",

2062 label: "API Private Key (PEM)",

2063 type: "pem",

2064 required: true,

2065 secret: true,

2066 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2066

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2066

2067 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2068 },

2069 {

2070 path: "metadata.region",

2071 label: "Region",

2072 type: "text",

2073 required: false,

2074 placeholder: "us-phoenix-1",

2075 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2076 }

2077 ]

2078 },

2079 SSH: {

2080 id: "SSH",

2081 displayName: "SSH",

2082 capabilities: CAP_COMPUTE,

2083 fields: [

2084 {

2085 path: "metadata.user",

2086 label: "User",

Lines 2094-2134javascript

2094 label: "Host",

2095 type: "text",

2096 required: true,

2097 placeholder: "vps.example.com or * for wildcard",

2098 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2099 },

2100 {

2101 path

dist/index.cjsView file

Lines 2048-2088javascript

2048 label: "User OCID",

2049 type: "text",

2050 required: true,

2051 placeholder: "ocid1.user.oc1..aaaa\u2026",

2052 help: "The OCID of the user the API signing key belongs to."

2053 },

Lines 2096-2136javascript

2096 label: "Host",

2097 type: "text",

2098 required: true,

2099 placeholder: "vps.example.com or * for wildcard",

2100 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2101 },

2102 {

2103 path: "metadata.port",

2104 label: "Port",

2105 type: "number",

2106 required: false,

2107 default: 22,

2108 placeholder: "22"

2109 },

2110 {

2111 path: "secret",

2112 label: "PEM Private Key",

2113 type: "pem",

2114 required: true,

2115 secret: true,

2116 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2116

2117 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2118 }

2119 ]

2120 },

2121 GITHUB: {

2122 id: "GITHUB",

2123 displayName: "GitHub",

2124 capabilities: CAP_VCS,

2125 fields: [

2126 {

2127 path: "secret",

2128 label: "Personal Access Token (PAT)",

2129 type: "password",

2130 required: true,

2131 secret: true,

2132 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2133 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2134 },

2135 {

2136 path: "metadata.org",