registry / @flun/webauthn-server / 2.1.1

@flun/webauthn-server@2.1.1

这是一个专为 Node.js 环境设计的 WebAuthn（含 Passkeys）服务端工具库,提供简洁的 TypeScript 实现,并内置对证书、密钥及 CBOR 编码的完整处理能力,适用于构建 FIDO2/Passkey 身份验证后端

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 188 KB of source, external domains: fidoalliance.org, mds.fidoalliance.org, mds3.fidoalliance.org, www.rfc-editor.org

Source & flagged code

3 flagged

package.jsonView file

Lines 1-41json

2 "name": "@flun/webauthn-server",

3 "version": "2.1.1",

4 "description": "这是一个专为 Node.js 环境设计的 WebAuthn（含 Passkeys）服务端工具库,提供简洁的 TypeScript 实现,并内置对证书、密钥及 CBOR 编码的完整处理能力,适用于构建 FIDO2/Passkey 身份验证后端",

5 "keywords": [

6 "typescript",

7 "webauthn",

8 "passkeys",

9 "fido",

10 "node"

11 ],

12 "type": "module",

13 "types": "index.d.ts",

14 "main": "index.js",

15 "module": "./index.js",

16 "exports": {

17 ".": "./index.js",

18 "./helpers": "./helpers/index.js"

19 },

20 "scripts": {

21 "postinstall": "electron-rebuild -f -w passport-desktop-win32-x64-msvc passport-desktop-win32-ia32-msvc || echo 'Skipping rebuild'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "files": [

24 "index.js",

25 "index.d.ts",

26 "helpers/",

27 "authentication/",

28 "metadata/",

29 "registration/",

30 "types/",

31 "CHANGELOG.md",

32 "LICENSE.md",

33 "README.md"

34 ],

35 "author": "flun <open@flun.top>",

36 "publishConfig": {

37 "access": "public"

38 },

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/OpenFlun/webauthn-server.git"

helpers/common.jsView file

Lines 1-24javascript

1import { createRequire } from 'module';

2import { decodeClientDataJSON } from './decodeClientDataJSON.js';

4let PassportClass = null, nativeLoaded = false;

5const

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = electron-rebuild -f -w passport-desktop-win32-x64-msvc passport-desktop-win32-ia32-msvc || echo 'Skipping rebuild'

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code