registry / @flashbacktech/tsclient / 0.4.92

@flashbacktech/tsclient@0.4.92

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 226 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2165-2205javascript

2165 label: "User OCID",

2166 type: "text",

2167 required: true,

2168 placeholder: "ocid1.user.oc1..aaaa\u2026",

2169 help: "The OCID of the user the API signing key belongs to."

2170 },

2171 {

2172 path: "metadata.fingerprint",

2173 label: "Key Fingerprint",

2174 type: "text",

2175 required: true,

2176 placeholder: "aa:bb:cc:dd:\u2026",

2177 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2178 },

2179 {

2180 path: "secret",

2181 label: "API Private Key (PEM)",

2182 type: "pem",

2183 required: true,

2184 secret: true,

2185 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2185

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2185

2186 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2187 },

2188 {

2189 path: "metadata.region",

2190 label: "Region",

2191 type: "text",

2192 required: false,

2193 placeholder: "us-phoenix-1",

2194 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2195 }

2196 ]

2197 },

2198 SSH: {

2199 id: "SSH",

2200 displayName: "SSH",

2201 capabilities: CAP_COMPUTE,

2202 fields: [

2203 {

2204 path: "metadata.user",

2205 label: "User",

Lines 2213-2253javascript

2213 label: "Host",

2214 type: "text",

2215 required: true,

2216 placeholder: "vps.example.com or * for wildcard",

2217 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2218 },

2219 {

2220 path

dist/index.cjsView file

Lines 2167-2207javascript

2167 label: "User OCID",

2168 type: "text",

2169 required: true,

2170 placeholder: "ocid1.user.oc1..aaaa\u2026",

2171 help: "The OCID of the user the API signing key belongs to."

2172 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2185patternName = private_key_rsa severity = critical line = 2185 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2185

2185patternName = private_key_rsa severity = critical line = 2185 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2185

2233patternName = private_key_openssh severity = critical line = 2233 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2233

dist/index.cjsView file

2187patternName = private_key_rsa severity = critical line = 2187 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2187

2235patternName = private_key_openssh severity = critical line = 2235 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2235

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2165-2205javascript

2165 label: "User OCID",

2166 type: "text",

2167 required: true,

2168 placeholder: "ocid1.user.oc1..aaaa\u2026",

2169 help: "The OCID of the user the API signing key belongs to."

2170 },

2171 {

2172 path: "metadata.fingerprint",

2173 label: "Key Fingerprint",

2174 type: "text",

2175 required: true,

2176 placeholder: "aa:bb:cc:dd:\u2026",

2177 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2178 },

2179 {

2180 path: "secret",

2181 label: "API Private Key (PEM)",

2182 type: "pem",

2183 required: true,

2184 secret: true,

2185 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2185

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2185

2186 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2187 },

2188 {

2189 path: "metadata.region",

2190 label: "Region",

2191 type: "text",

2192 required: false,

2193 placeholder: "us-phoenix-1",

2194 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2195 }

2196 ]

2197 },

2198 SSH: {

2199 id: "SSH",

2200 displayName: "SSH",

2201 capabilities: CAP_COMPUTE,

2202 fields: [

2203 {

2204 path: "metadata.user",

2205 label: "User",

Lines 2213-2253javascript

2213 label: "Host",

2214 type: "text",

2215 required: true,

2216 placeholder: "vps.example.com or * for wildcard",

2217 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2218 },

2219 {

2220 path

dist/index.cjsView file

Lines 2167-2207javascript

2167 label: "User OCID",

2168 type: "text",

2169 required: true,

2170 placeholder: "ocid1.user.oc1..aaaa\u2026",

2171 help: "The OCID of the user the API signing key belongs to."

2172 },

Lines 2215-2255javascript

2215 label: "Host",

2216 type: "text",

2217 required: true,

2218 placeholder: "vps.example.com or * for wildcard",

2219 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2220 },

2221 {

2222 path: "metadata.port",

2223 label: "Port",

2224 type: "number",

2225 required: false,

2226 default: 22,

2227 placeholder: "22"

2228 },

2229 {

2230 path: "secret",

2231 label: "PEM Private Key",

2232 type: "pem",

2233 required: true,

2234 secret: true,

2235 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2235

2236 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2237 }

2238 ]

2239 },

2240 GITHUB: {

2241 id: "GITHUB",

2242 displayName: "GitHub",

2243 capabilities: CAP_VCS,

2244 fields: [

2245 {

2246 path: "secret",

2247 label: "Personal Access Token (PAT)",

2248 type: "password",

2249 required: true,

2250 secret: true,

2251 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2252 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2253 },

2254 {

2255 path: "metadata.org",