registry / @flashbacktech/tsclient / 0.5.3

@flashbacktech/tsclient@0.5.3

TypeScript client for the cloud-agent platform API.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 243 KB of source, external domains: api.anthropic.com, api.openai.com, bedrock-runtime.us-east-1.amazonaws.com, dev.azure.com, flashback.tech, generativelanguage.googleapis.com, gitlab.com, gitlab.example.com, hooks.slack.com, json-schema.org, outlook.office.com, s3.amazonaws.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2255-2295javascript

2255 label: "User OCID",

2256 type: "text",

2257 required: true,

2258 placeholder: "ocid1.user.oc1..aaaa\u2026",

2259 help: "The OCID of the user the API signing key belongs to."

2260 },

2261 {

2262 path: "metadata.fingerprint",

2263 label: "Key Fingerprint",

2264 type: "text",

2265 required: true,

2266 placeholder: "aa:bb:cc:dd:\u2026",

2267 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2268 },

2269 {

2270 path: "secret",

2271 label: "API Private Key (PEM)",

2272 type: "pem",

2273 required: true,

2274 secret: true,

2275 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2275

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2275

2276 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2277 },

2278 {

2279 path: "metadata.region",

2280 label: "Region",

2281 type: "text",

2282 required: false,

2283 placeholder: "us-phoenix-1",

2284 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2285 }

2286 ]

2287 },

2288 SSH: {

2289 id: "SSH",

2290 displayName: "SSH",

2291 capabilities: CAP_COMPUTE,

2292 fields: [

2293 {

2294 path: "metadata.user",

2295 label: "User",

Lines 2303-2343javascript

2303 label: "Host",

2304 type: "text",

2305 required: true,

2306 placeholder: "vps.example.com or * for wildcard",

2307 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2308 },

2309 {

2310 path

dist/index.cjsView file

Lines 2257-2297javascript

2257 label: "User OCID",

2258 type: "text",

2259 required: true,

2260 placeholder: "ocid1.user.oc1..aaaa\u2026",

2261 help: "The OCID of the user the API signing key belongs to."

2262 },

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2275patternName = private_key_rsa severity = critical line = 2275 matchedText = placehol...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2275

2275patternName = private_key_rsa severity = critical line = 2275 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2275

2323patternName = private_key_openssh severity = critical line = 2323 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L2323

dist/index.cjsView file

2277patternName = private_key_rsa severity = critical line = 2277 matchedText = placehol...--",

Critical

Secret Pattern

RSA private key in dist/index.cjs

dist/index.cjsView on unpkg · L2277

2325patternName = private_key_openssh severity = critical line = 2325 matchedText = placehol...--",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2325

Findings

5 Critical5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

CriticalSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 2255-2295javascript

2255 label: "User OCID",

2256 type: "text",

2257 required: true,

2258 placeholder: "ocid1.user.oc1..aaaa\u2026",

2259 help: "The OCID of the user the API signing key belongs to."

2260 },

2261 {

2262 path: "metadata.fingerprint",

2263 label: "Key Fingerprint",

2264 type: "text",

2265 required: true,

2266 placeholder: "aa:bb:cc:dd:\u2026",

2267 help: "Fingerprint of the uploaded API signing key (shown next to the key in the console)."

2268 },

2269 {

2270 path: "secret",

2271 label: "API Private Key (PEM)",

2272 type: "pem",

2273 required: true,

2274 secret: true,

2275 placeholder: "-----BEGIN PRIVATE KEY-----\n\u2026\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2275

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2275

2276 help: "Paste the PEM, or drop the .pem file. Passphrase-protected keys are rejected \u2014 the agent runs unattended. Encrypted at rest."

2277 },

2278 {

2279 path: "metadata.region",

2280 label: "Region",

2281 type: "text",

2282 required: false,

2283 placeholder: "us-phoenix-1",

2284 help: "Default region for the oci CLI / SDK. Optional \u2014 leave blank to use the SDK default."

2285 }

2286 ]

2287 },

2288 SSH: {

2289 id: "SSH",

2290 displayName: "SSH",

2291 capabilities: CAP_COMPUTE,

2292 fields: [

2293 {

2294 path: "metadata.user",

2295 label: "User",

Lines 2303-2343javascript

2303 label: "Host",

2304 type: "text",

2305 required: true,

2306 placeholder: "vps.example.com or * for wildcard",

2307 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2308 },

2309 {

2310 path

dist/index.cjsView file

Lines 2257-2297javascript

2257 label: "User OCID",

2258 type: "text",

2259 required: true,

2260 placeholder: "ocid1.user.oc1..aaaa\u2026",

2261 help: "The OCID of the user the API signing key belongs to."

2262 },

Lines 2305-2345javascript

2305 label: "Host",

2306 type: "text",

2307 required: true,

2308 placeholder: "vps.example.com or * for wildcard",

2309 help: "Hostname or IP. Use '*' for a key that's valid across multiple hosts; the agent will require the prompt to name the target host."

2310 },

2311 {

2312 path: "metadata.port",

2313 label: "Port",

2314 type: "number",

2315 required: false,

2316 default: 22,

2317 placeholder: "22"

2318 },

2319 {

2320 path: "secret",

2321 label: "PEM Private Key",

2322 type: "pem",

2323 required: true,

2324 secret: true,

2325 placeholder: "-----BEGIN OPENSSH PRIVATE KEY-----\n\u2026\n-----END OPENSSH PRIVATE KEY-----",

Critical

Secret Pattern

OpenSSH private key in dist/index.cjs

dist/index.cjsView on unpkg · L2325

2326 help: "Paste the PEM, or drop the private key file (e.g. id_ed25519). Passphrase-encrypted keys are rejected \u2014 the agent runs unattended."

2327 }

2328 ]

2329 },

2330 GITHUB: {

2331 id: "GITHUB",

2332 displayName: "GitHub",

2333 capabilities: CAP_VCS,

2334 fields: [

2335 {

2336 path: "secret",

2337 label: "Personal Access Token (PAT)",

2338 type: "password",

2339 required: true,

2340 secret: true,

2341 placeholder: "ghp_xxxxxxxxxxxxxxxxxxxxxxxx",

2342 help: "A classic or fine-grained PAT. Encrypted at rest. The first 7 characters are kept in metadata for display."

2343 },

2344 {

2345 path: "metadata.org",