registry / @flashbacktech/tsclient / 0.4.97

@flashbacktech/tsclient@0.4.97

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 228 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2173-2213javascript

2173 label: "User OCID",

2174 type: "text",

2175 required: true,

2176 placeholder: "ocid1.user.oc1..aaaa\u2026",

2177 help: "The OCID of the user the API signing key belongs to."

2178 },

2179 {

2180 path: "metadata.fingerprint",

2181 label: "Key Fingerprint",

2182 type: "text",

2183 required: true,

2184 placeholder: "aa:bb:cc:dd:\u2026",

2185 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2186 },

2187 {

2188 path: "secret",

2189 label: "API Private Key (PEM)",

2190 type: "pem",

2191 required: true,

2192 secret: true,

2193 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2193

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2193

2194 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2195 },

2196 {

2197 path: "metadata.region",

2198 label: "Region",

2199 type: "text",

2200 required: false,

2201 placeholder: "us-phoenix-1",

2202 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2203 }

2204 ]

2205 },

2206 SSH: {

2207 id: "SSH",

2208 displayName: "SSH",

2209 capabilities: CAP_COMPUTE,

2210 fields: [

2211 {

2212 path: "metadata.user",

2213 label: "User",

Lines 2221-2261javascript

2221 label: "Host",

2222 type: "text",

2223 required: true,

2224 placeholder: "vps.example.com or * for wildcard",

2225 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2226 },

2227 {

2228 path

dist/index.cjsView file

Lines 2175-2215javascript

2175 label: "User OCID",

2176 type: "text",

2177 required: true,

2178 placeholder: "ocid1.user.oc1..aaaa\u2026",

2179 help: "The OCID of the user the API signing key belongs to."

2180 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2193patternName = private_key_rsa severity = critical line = 2193 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2193

2193patternName = private_key_rsa severity = critical line = 2193 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2193

2241patternName = private_key_openssh severity = critical line = 2241 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2241

dist/index.cjsView file

2195patternName = private_key_rsa severity = critical line = 2195 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2195

2243patternName = private_key_openssh severity = critical line = 2243 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2243

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2173-2213javascript

2173 label: "User OCID",

2174 type: "text",

2175 required: true,

2176 placeholder: "ocid1.user.oc1..aaaa\u2026",

2177 help: "The OCID of the user the API signing key belongs to."

2178 },

2179 {

2180 path: "metadata.fingerprint",

2181 label: "Key Fingerprint",

2182 type: "text",

2183 required: true,

2184 placeholder: "aa:bb:cc:dd:\u2026",

2185 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2186 },

2187 {

2188 path: "secret",

2189 label: "API Private Key (PEM)",

2190 type: "pem",

2191 required: true,

2192 secret: true,

2193 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2193

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2193

2194 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2195 },

2196 {

2197 path: "metadata.region",

2198 label: "Region",

2199 type: "text",

2200 required: false,

2201 placeholder: "us-phoenix-1",

2202 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2203 }

2204 ]

2205 },

2206 SSH: {

2207 id: "SSH",

2208 displayName: "SSH",

2209 capabilities: CAP_COMPUTE,

2210 fields: [

2211 {

2212 path: "metadata.user",

2213 label: "User",

Lines 2221-2261javascript

2221 label: "Host",

2222 type: "text",

2223 required: true,

2224 placeholder: "vps.example.com or * for wildcard",

2225 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2226 },

2227 {

2228 path

dist/index.cjsView file

Lines 2175-2215javascript

2175 label: "User OCID",

2176 type: "text",

2177 required: true,

2178 placeholder: "ocid1.user.oc1..aaaa\u2026",

2179 help: "The OCID of the user the API signing key belongs to."

2180 },

Lines 2223-2263javascript

2223 label: "Host",

2224 type: "text",

2225 required: true,

2226 placeholder: "vps.example.com or * for wildcard",

2227 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2228 },

2229 {

2230 path: "metadata.port",

2231 label: "Port",

2232 type: "number",

2233 required: false,

2234 default: 22,

2235 placeholder: "22"

2236 },

2237 {

2238 path: "secret",

2239 label: "PEM Private Key",

2240 type: "pem",

2241 required: true,

2242 secret: true,

2243 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2243

2244 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2245 }

2246 ]

2247 },

2248 GITHUB: {

2249 id: "GITHUB",

2250 displayName: "GitHub",

2251 capabilities: CAP_VCS,

2252 fields: [

2253 {

2254 path: "secret",

2255 label: "Personal Access Token (PAT)",

2256 type: "password",

2257 required: true,

2258 secret: true,

2259 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2260 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2261 },

2262 {

2263 path: "metadata.org",