registry / @florent-uzio/custody / 2.9.0

@florent-uzio/custody@2.9.0

An SDK to interact with the Ripple Custody API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 118 file(s), 602 KB of source

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *

Source & flagged code

4 flagged · loading source

dist/services/keypairs/secp256k1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

dist/services/keypairs/ed25519.service.jsView file

50patternName = private_key_rsa severity = critical line = 50 matchedText = if (!isS...)) {

Critical

Secret Pattern

RSA private key in dist/services/keypairs/ed25519.service.js

dist/services/keypairs/ed25519.service.jsView on unpkg · L50

dist/services/keypairs/secp256r1.service.jsView file

58patternName = private_key_ec severity = critical line = 58 matchedText = const ha...-");

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256r1.service.js

dist/services/keypairs/secp256r1.service.jsView on unpkg · L58

Findings

4 Critical1 Medium3 Low

CriticalCritical Secretdist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/secp256k1.service.js

CriticalSecret Patterndist/services/keypairs/ed25519.service.js

CriticalSecret Patterndist/services/keypairs/secp256r1.service.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/services/keypairs/secp256k1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256k1

41 * 3. Return Base64-encoded DER signature

42 *

43 * @param {string} privateKeyPem - PEM-encoded private key.

44 * @param {string} message - Message to sign (should be canonicalized JSON for a request).

45 * @returns {string} Base64-encoded DER signature.

46 */

47 sign(privateKeyPem, message) {

48 // Validate inputs

49 if (!isString(message)) {

50 throw new CustodyError({ reason: "Message must be a string" });

51 }

52 if (!isString(privateKeyPem)) {

53 throw new CustodyError({

54 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

55 });

56 }

57 // Validate PEM structure: must have both BEGIN and END markers

58 const hasBeginMarker = privateKeyPem.includes("-----BEGIN EC PRIVATE KEY-----");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

Critical

Secret Pattern

EC private key in dist/services/keypairs/secp256k1.service.js

dist/services/keypairs/secp256k1.service.jsView on unpkg · L58

59 const hasEndMarker = privateKeyPem.includes("-----END EC PRIVATE KEY-----");

60 if (!hasBeginMarker || !hasEndMarker) {

61 throw new CustodyError({

62 reason: "Invalid private key: Must be PEM-encoded secp256k1 private key",

63 });

64 }

65 // Validate that the key can be parsed (catches malformed keys early)

66 try {

67 const key = createPrivateKey(privateKeyPem);

68 // Verify it's actually an EC key

69 if (key.asymmetricKeyType !== "ec") {

70 throw new CustodyError({

71 reason: "Invalid private key: Must be a secp256k1 private key",

72 });

73 }

74 // Verify it's secp256k1 curve (if details are available)

75 const keyDetails = key.asymmetricKeyDetails;

76 if (keyDetails && keyDetails.namedCurve !== "secp256k1") {

77 throw new CustodyError({

78 reason: "Invalid private key: Must be a secp256k1 private key",

dist/services/keypairs/ed25519.service.jsView file

Lines 30-70javascript

30 publicKey: publicKeyDerBase64,

31 };

32 }

33 /**

34 * Signs a message using the provided PEM-encoded Ed25519 private key.

35 * This implementation follows the Ripple Custody documentation exactly:

36 * 1. Create SHA256 hash of canonicalized JSON

37 * 2. Sign the hash with Ed25519

38 * 3. Format as DER signature

39 * 4. Base64 encode

dist/services/keypairs/secp256r1.service.jsView file

Lines 38-78javascript

38 * This implementation follows the pattern:

39 * 1. Create a Buffer from the message

40 * 2. Sign the message with secp256r1

41 * 3. Return Base64-encoded DER signature

42 *