registry / @flashbacktech/tsclient / 0.5.1

@flashbacktech/tsclient@0.5.1

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 239 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2246-2286javascript

2246 label: "User OCID",

2247 type: "text",

2248 required: true,

2249 placeholder: "ocid1.user.oc1..aaaa\u2026",

2250 help: "The OCID of the user the API signing key belongs to."

2251 },

2252 {

2253 path: "metadata.fingerprint",

2254 label: "Key Fingerprint",

2255 type: "text",

2256 required: true,

2257 placeholder: "aa:bb:cc:dd:\u2026",

2258 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2259 },

2260 {

2261 path: "secret",

2262 label: "API Private Key (PEM)",

2263 type: "pem",

2264 required: true,

2265 secret: true,

2266 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2266

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2266

2267 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2268 },

2269 {

2270 path: "metadata.region",

2271 label: "Region",

2272 type: "text",

2273 required: false,

2274 placeholder: "us-phoenix-1",

2275 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2276 }

2277 ]

2278 },

2279 SSH: {

2280 id: "SSH",

2281 displayName: "SSH",

2282 capabilities: CAP_COMPUTE,

2283 fields: [

2284 {

2285 path: "metadata.user",

2286 label: "User",

Lines 2294-2334javascript

2294 label: "Host",

2295 type: "text",

2296 required: true,

2297 placeholder: "vps.example.com or * for wildcard",

2298 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2299 },

2300 {

2301 path

dist/index.cjsView file

Lines 2248-2288javascript

2248 label: "User OCID",

2249 type: "text",

2250 required: true,

2251 placeholder: "ocid1.user.oc1..aaaa\u2026",

2252 help: "The OCID of the user the API signing key belongs to."

2253 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2266patternName = private_key_rsa severity = critical line = 2266 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2266

2266patternName = private_key_rsa severity = critical line = 2266 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2266

2314patternName = private_key_openssh severity = critical line = 2314 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2314

dist/index.cjsView file

2268patternName = private_key_rsa severity = critical line = 2268 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2268

2316patternName = private_key_openssh severity = critical line = 2316 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2316

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2246-2286javascript

2246 label: "User OCID",

2247 type: "text",

2248 required: true,

2249 placeholder: "ocid1.user.oc1..aaaa\u2026",

2250 help: "The OCID of the user the API signing key belongs to."

2251 },

2252 {

2253 path: "metadata.fingerprint",

2254 label: "Key Fingerprint",

2255 type: "text",

2256 required: true,

2257 placeholder: "aa:bb:cc:dd:\u2026",

2258 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2259 },

2260 {

2261 path: "secret",

2262 label: "API Private Key (PEM)",

2263 type: "pem",

2264 required: true,

2265 secret: true,

2266 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2266

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2266

2267 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2268 },

2269 {

2270 path: "metadata.region",

2271 label: "Region",

2272 type: "text",

2273 required: false,

2274 placeholder: "us-phoenix-1",

2275 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2276 }

2277 ]

2278 },

2279 SSH: {

2280 id: "SSH",

2281 displayName: "SSH",

2282 capabilities: CAP_COMPUTE,

2283 fields: [

2284 {

2285 path: "metadata.user",

2286 label: "User",

Lines 2294-2334javascript

2294 label: "Host",

2295 type: "text",

2296 required: true,

2297 placeholder: "vps.example.com or * for wildcard",

2298 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2299 },

2300 {

2301 path

dist/index.cjsView file

Lines 2248-2288javascript

2248 label: "User OCID",

2249 type: "text",

2250 required: true,

2251 placeholder: "ocid1.user.oc1..aaaa\u2026",

2252 help: "The OCID of the user the API signing key belongs to."

2253 },

Lines 2296-2336javascript

2296 label: "Host",

2297 type: "text",

2298 required: true,

2299 placeholder: "vps.example.com or * for wildcard",

2300 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2301 },

2302 {

2303 path: "metadata.port",

2304 label: "Port",

2305 type: "number",

2306 required: false,

2307 default: 22,

2308 placeholder: "22"

2309 },

2310 {

2311 path: "secret",

2312 label: "PEM Private Key",

2313 type: "pem",

2314 required: true,

2315 secret: true,

2316 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2316

2317 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2318 }

2319 ]

2320 },

2321 GITHUB: {

2322 id: "GITHUB",

2323 displayName: "GitHub",

2324 capabilities: CAP_VCS,

2325 fields: [

2326 {

2327 path: "secret",

2328 label: "Personal Access Token (PAT)",

2329 type: "password",

2330 required: true,

2331 secret: true,

2332 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2333 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2334 },

2335 {

2336 path: "metadata.org",