registry / @flashbacktech/tsclient / 0.4.91

@flashbacktech/tsclient@0.4.91

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 225 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2154-2194javascript

2154 label: "User OCID",

2155 type: "text",

2156 required: true,

2157 placeholder: "ocid1.user.oc1..aaaa\u2026",

2158 help: "The OCID of the user the API signing key belongs to."

2159 },

2160 {

2161 path: "metadata.fingerprint",

2162 label: "Key Fingerprint",

2163 type: "text",

2164 required: true,

2165 placeholder: "aa:bb:cc:dd:\u2026",

2166 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2167 },

2168 {

2169 path: "secret",

2170 label: "API Private Key (PEM)",

2171 type: "pem",

2172 required: true,

2173 secret: true,

2174 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2174

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2174

2175 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2176 },

2177 {

2178 path: "metadata.region",

2179 label: "Region",

2180 type: "text",

2181 required: false,

2182 placeholder: "us-phoenix-1",

2183 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2184 }

2185 ]

2186 },

2187 SSH: {

2188 id: "SSH",

2189 displayName: "SSH",

2190 capabilities: CAP_COMPUTE,

2191 fields: [

2192 {

2193 path: "metadata.user",

2194 label: "User",

Lines 2202-2242javascript

2202 label: "Host",

2203 type: "text",

2204 required: true,

2205 placeholder: "vps.example.com or * for wildcard",

2206 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2207 },

2208 {

2209 path

dist/index.cjsView file

Lines 2156-2196javascript

2156 label: "User OCID",

2157 type: "text",

2158 required: true,

2159 placeholder: "ocid1.user.oc1..aaaa\u2026",

2160 help: "The OCID of the user the API signing key belongs to."

2161 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2174patternName = private_key_rsa severity = critical line = 2174 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2174

2174patternName = private_key_rsa severity = critical line = 2174 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2174

2222patternName = private_key_openssh severity = critical line = 2222 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2222

dist/index.cjsView file

2176patternName = private_key_rsa severity = critical line = 2176 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2176

2224patternName = private_key_openssh severity = critical line = 2224 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2224

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2154-2194javascript

2154 label: "User OCID",

2155 type: "text",

2156 required: true,

2157 placeholder: "ocid1.user.oc1..aaaa\u2026",

2158 help: "The OCID of the user the API signing key belongs to."

2159 },

2160 {

2161 path: "metadata.fingerprint",

2162 label: "Key Fingerprint",

2163 type: "text",

2164 required: true,

2165 placeholder: "aa:bb:cc:dd:\u2026",

2166 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2167 },

2168 {

2169 path: "secret",

2170 label: "API Private Key (PEM)",

2171 type: "pem",

2172 required: true,

2173 secret: true,

2174 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2174

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2174

2175 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2176 },

2177 {

2178 path: "metadata.region",

2179 label: "Region",

2180 type: "text",

2181 required: false,

2182 placeholder: "us-phoenix-1",

2183 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2184 }

2185 ]

2186 },

2187 SSH: {

2188 id: "SSH",

2189 displayName: "SSH",

2190 capabilities: CAP_COMPUTE,

2191 fields: [

2192 {

2193 path: "metadata.user",

2194 label: "User",

Lines 2202-2242javascript

2202 label: "Host",

2203 type: "text",

2204 required: true,

2205 placeholder: "vps.example.com or * for wildcard",

2206 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2207 },

2208 {

2209 path

dist/index.cjsView file

Lines 2156-2196javascript

2156 label: "User OCID",

2157 type: "text",

2158 required: true,

2159 placeholder: "ocid1.user.oc1..aaaa\u2026",

2160 help: "The OCID of the user the API signing key belongs to."

2161 },

Lines 2204-2244javascript

2204 label: "Host",

2205 type: "text",

2206 required: true,

2207 placeholder: "vps.example.com or * for wildcard",

2208 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2209 },

2210 {

2211 path: "metadata.port",

2212 label: "Port",

2213 type: "number",

2214 required: false,

2215 default: 22,

2216 placeholder: "22"

2217 },

2218 {

2219 path: "secret",

2220 label: "PEM Private Key",

2221 type: "pem",

2222 required: true,

2223 secret: true,

2224 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2224

2225 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2226 }

2227 ]

2228 },

2229 GITHUB: {

2230 id: "GITHUB",

2231 displayName: "GitHub",

2232 capabilities: CAP_VCS,

2233 fields: [

2234 {

2235 path: "secret",

2236 label: "Personal Access Token (PAT)",

2237 type: "password",

2238 required: true,

2239 secret: true,

2240 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2241 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2242 },

2243 {

2244 path: "metadata.org",