registry / @florent-uzio/custody / 2.6.4

@florent-uzio/custody@2.6.4

An SDK to interact with the Ripple Custody API

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime networking is the stated SDK function and targets caller-configured Custody API/auth endpoints; generated private keys and signatures remain in process/caller-controlled request flow.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer constructs `RippleCustody` and invokes authentication, API, or optional version-detection methods.

Impact

Performs intended Ripple Custody authentication and API operations; no unconsented persistence, exfiltration, or install-time mutation was identified.

Mechanism

Caller-configured HTTP API client with local cryptographic signing.

Rationale

The flagged secret-like pattern is legitimate PEM private-key handling for a custody SDK, not an embedded credential or exfiltration chain. Source inspection found only consumer-configured, package-aligned HTTP behavior and no malicious execution or persistence mechanism.

Evidence

package.jsondist/index.jsdist/ripple-custody.jsdist/services/apis/api.service.jsdist/services/auth/auth.service.jsdist/services/keypairs/secp256k1.service.jsdist/services/keypairs/ed25519.service.jsdist/versioning/detect.jsREADME.md

Network endpoints2

api.ripple.comauth.api.ripple.com/token

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has only `prepare` and `prepublishOnly` build/test hooks; no install payload script.
`dist/index.js` only re-exports SDK APIs and has no import-time network or filesystem action.
`dist/services/keypairs/secp256k1.service.js` generates/signs with caller-provided private keys and returns results to the caller.
`dist/services/apis/api.service.js` sends signed API requests only to the caller-configured `apiUrl`.
No filesystem, environment harvesting, shell execution, eval/vm, native loading, or AI-agent config mutation was found in `dist`.
`dist/versioning/detect.js` fetches a caller-derived OpenAPI URL only when version auto-detection is used.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 601 KB of source

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *

Source & flagged code

4 flagged · loading source

dist/services/keypairs/secp256k1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

dist/services/keypairs/ed25519.service.jsView file

50patternName = private_key_rsa severity = critical line = 50 matchedText = if (!isS...)) {

Critical

Secret Pattern

RSA private key in dist/services/keypairs/ed25519.service.js

dist/services/keypairs/ed25519.service.jsView on unpkg · L50

dist/services/keypairs/secp256r1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256r1.service.js

dist/services/keypairs/secp256r1.service.jsView on unpkg · L58

Findings

4 Critical1 Medium3 Low

CriticalCritical Secretdist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/ed25519.service.js

CriticalSecret Patterndist/services/keypairs/secp256r1.service.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *