registry / @florent-uzio/custody / 2.10.0

@florent-uzio/custody@2.10.0

An SDK to interact with the Ripple Custody API

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 611 KB of source

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-

Source & flagged code

4 flagged · loading source

dist/services/keypairs/secp256k1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code