registry / @forgerock/fr-config-manager / 1.8.0

@forgerock/fr-config-manager@1.8.0

Sample tools for managing PingOne Advanced Identity Cloud configuration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 125 file(s), 350 KB of source, external domains: example.com, override.example.com, tenant.example.com, www.example.com

Source & flagged code

4 flagged

packages/fr-config-common/src/authenticate.jsView file

Lines 1-33javascript

1const fs = require("fs");

2const jose = require("jose");

3const uuid = require("uuid");

Source & flagged code

4 flagged · loading source

packages/fr-config-common/src/authenticate.jsView file

13patternName = private_key_rsa severity = critical line = 13 matchedText = return p...--")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

packages/fr-config-common/src/authenticate.jsView on unpkg · L13

13patternName = private_key_rsa severity = critical line = 13 matchedText = return p...--")

Critical

Secret Pattern

RSA private key in packages/fr-config-common/src/authenticate.js

packages/fr-config-common/src/authenticate.jsView on unpkg · L13

scripts/update-versions.jsView file

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/update-versions.jsView on unpkg · L2

packages/fr-config-common/tests/authenticate.test.jsView file

135patternName = private_key_rsa severity = critical line = 135 matchedText = "-----BE...--";

Critical

Secret Pattern

RSA private key in packages/fr-config-common/tests/authenticate.test.js

packages/fr-config-common/tests/authenticate.test.jsView on unpkg · L135

Findings

3 Critical3 Medium5 Low

CriticalCritical Secretpackages/fr-config-common/src/authenticate.js

CriticalSecret Patternpackages/fr-config-common/tests/authenticate.test.js

CriticalSecret Patternpackages/fr-config-common/src/authenticate.js

MediumDynamic Requirescripts/update-versions.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

scripts/update-versions.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/update-versions.jsView on unpkg · L2

6// Read main package.json version

7const mainPackageJson = JSON.parse(fs.readFileSync('./package.json', 'utf8'));

8const targetVersion = mainPackageJson.version;

10console.log(`Updating all packages to version: ${targetVersion}`);

12// Get all package directories

13const packagesDir = './packages';

14const packages = fs.readdirSync(packagesDir, { withFileTypes: true })

15 .filter(dirent => dirent.isDirectory())

16 .map(dirent => dirent.name);

18packages.forEach(packageName => {

19 const packageJsonPath = path.join(packagesDir, packageName, 'package.json');

21 if (fs.existsSync(packageJsonPath)) {

22 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

packages/fr-config-common/tests/authenticate.test.jsView file

Lines 115-155javascript

115 const token = await getToken();

116

117 expect(jose.importJWK).toHaveBeenCalledWith(

118 JSON.parse(REQUIRED_CLOUD_ENV.SERVICE_ACCOUNT_KEY),

119 "RS256"

120 );

121 expect(restForm).toHaveBeenCalledWith(

122 `${REQUIRED_CLOUD_ENV.TENANT_BASE_URL}/am/oauth2/access_token`,

123 expect.objectContaining({

124 grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",

125 client_id: REQUIRED_CLOUD_ENV.SERVICE_ACCOUNT_CLIENT_ID,

126 scope: REQUIRED_CLOUD_ENV.SERVICE_ACCOUNT_SCOPE,

127 assertion: "mock-jwt",

128 })

129 );

130 expect(token).toBe("cloud-token");

131 });

132

133 test("Loads SERVICE_ACCOUNT_KEY in PEM format", async () => {

134 process.env.SERVICE_ACCOUNT_KEY =

135 "-----BEGIN RSA PRIVATE KEY-----\nfakekey\n-----END RSA PRIVATE KEY-----";

Critical

Secret Pattern

RSA private key in packages/fr-config-common/tests/authenticate.test.js

packages/fr-config-common/tests/authenticate.test.jsView on unpkg · L135

136 mockImportPKCS8.mockResolvedValue("mock-pem-key");

137

138 const { getToken } = loadAuthenticate();

139 const jose = require("jose");

140

141 await getToken();

142

143 expect(jose.importPKCS8).toHaveBeenCalledWith(process.env.SERVICE_ACCOUNT_KEY, "RS256");

144 });

145

146 test("returns token from FCM_ACCESS_TOKEN env var without making network call", async () => {

147 process.env.FCM_ACCESS_TOKEN = "env-access-token";

148 const { getToken } = loadAuthenticate();

149 const { restForm } = require("../src/restClient");

150

151 const token = await getToken();

152

153 expect(token).toBe("env-access-token");

154 expect(restForm).not.toHaveBeenCalled();

155 });