registry / @florent-uzio/custody / 2.6.2

@florent-uzio/custody@2.6.2

An SDK to interact with the Ripple Custody API

AI Security Review

scanned 6h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The SDK performs authenticated HTTP requests only after a consumer constructs and uses the client with configured API/auth URLs.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer instantiates RippleCustody and invokes an API operation.

Impact

Signs caller-provided challenges and sends API/auth data to configured service endpoints; no unconsented persistence, harvesting, or remote payload execution found.

Mechanism

Caller-configured authenticated Ripple Custody API client with local cryptographic signing.

Rationale

Static hints are explained by intended SDK behavior: cryptographic key generation/signing and authenticated Axios requests to consumer-configured Ripple Custody endpoints. Source inspection found no install-time execution, secret harvesting, exfiltration, persistence, destructive actions, or dynamic payload execution.

Evidence

package.jsondist/index.jsdist/ripple-custody.jsdist/services/apis/api.service.jsdist/services/auth/auth.service.jsdist/services/keypairs/secp256k1.service.jsdist/versioning/detect.jsREADME.md

Network endpoints2

api.ripple.comauth.api.ripple.com/token

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has only prepare/prepublishOnly build/test hooks; no install hook.
dist/index.js only re-exports SDK APIs; import performs no network or filesystem action.
dist/services/apis/api.service.js signs a caller-provided challenge and sends requests only to caller-supplied apiUrl.
dist/services/auth/auth.service.js posts signed auth data only to caller-supplied authUrl and retains JWT in memory.
dist/services/keypairs/secp256k1.service.js generates/signs with supplied keys; no embedded secret or exfiltration.
No filesystem writes, child-process use, dynamic evaluation/loading, or AI-agent configuration paths found in dist.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 601 KB of source

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *

Source & flagged code

4 flagged · loading source

dist/services/keypairs/secp256k1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

dist/services/keypairs/ed25519.service.jsView file

50patternName = private_key_rsa severity = critical line = 50 matchedText = if (!isS...)) {

Critical

Secret Pattern

RSA private key in dist/services/keypairs/ed25519.service.js

dist/services/keypairs/ed25519.service.jsView on unpkg · L50

dist/services/keypairs/secp256r1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256r1.service.js

dist/services/keypairs/secp256r1.service.jsView on unpkg · L58

Findings

4 Critical1 Medium3 Low

CriticalCritical Secretdist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/ed25519.service.js

CriticalSecret Patterndist/services/keypairs/secp256r1.service.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *