registry / @getrheo/flow-runtime / 2.3.0

@getrheo/flow-runtime@2.3.0

Rheo flow state machine and manifest runtime (transitive dependency).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 475 KB of source

Source & flagged code

2 flagged

dist/templatePreviewPath.jsView file

Lines 728-768javascript

728 const response = previewResponseForInput(input);

729 if (response) return response;

730 }

731 const { oauth, email } = findAuthPreviewLayers(screen);

732 if (oauth) {

733 return {

734 kind: "oauth_login_resolve",

735 layerId: oauth.layerId,

736 provider: oauth.provider,

737 success: true,

738 customerExternalId: "preview-user"

739 };

740 }

741 if (email) {

742 return {

743 kind: "email_password_auth_resolve",

744 layerId: email.layerId,

745 fieldKey: email.fieldKey,

746 mode: email.mode,

747 email: "preview@example.com",

748 password: "preview-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/templatePreviewPath.jsView on unpkg · L748

749 success: true

750 };

751 }

752 return { kind: "cta", action: "primary" };

753};

754var buildTemplatePreviewPath = (manifest, options) => {

755 const maxSteps = options?.maxSteps ?? PREVIEW_MAX_STEPS;

756 const locale = options?.locale ?? manifest.defaultLocale ?? "en";

757 let state = initFlowState(manifest, { locale, platform: "web" });

758 state = startFlow(state);

759 const steps = [];

760 let iterations = 0;

761 while (state.status === "running" && iterations < maxSteps) {

762 iterations += 1;

763 if (state.pendingExternalSurface) {

764 const surface = findExternalSurface(manifest, state.pendingExternalSurface.nodeId);

765 if (!surface) break;

766 const outcome = Object.keys(surface.outcomes)[0];

767 if (!outcome) break;

768 state = submitResponse(state, {

dist/index.jsView file

Lines 4589-4629javascript

4589 const response = previewResponseForInput(input);

4590 if (response) return response;

4591 }

4592 const { oauth, email } = findAuthPreviewLayers(screen);

4593 if (oauth) {

4594

Source & flagged code

2 flagged · loading source

dist/templatePreviewPath.jsView file

748patternName = generic_password severity = medium line = 748 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/templatePreviewPath.jsView on unpkg · L748

dist/index.jsView file

4609patternName = generic_password severity = medium line = 4609 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4609

Findings

2 Medium3 Low

MediumSecret Patterndist/templatePreviewPath.js

MediumSecret Patterndist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/templatePreviewPath.jsView file

Lines 728-768javascript

728 const response = previewResponseForInput(input);

729 if (response) return response;

730 }

731 const { oauth, email } = findAuthPreviewLayers(screen);

732 if (oauth) {

733 return {

734 kind: "oauth_login_resolve",

735 layerId: oauth.layerId,

736 provider: oauth.provider,

737 success: true,

738 customerExternalId: "preview-user"

739 };

740 }

741 if (email) {

742 return {

743 kind: "email_password_auth_resolve",

744 layerId: email.layerId,

745 fieldKey: email.fieldKey,

746 mode: email.mode,

747 email: "preview@example.com",

748 password: "preview-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/templatePreviewPath.jsView on unpkg · L748

749 success: true

750 };

751 }

752 return { kind: "cta", action: "primary" };

753};

754var buildTemplatePreviewPath = (manifest, options) => {

755 const maxSteps = options?.maxSteps ?? PREVIEW_MAX_STEPS;

756 const locale = options?.locale ?? manifest.defaultLocale ?? "en";

757 let state = initFlowState(manifest, { locale, platform: "web" });

758 state = startFlow(state);

759 const steps = [];

760 let iterations = 0;

761 while (state.status === "running" && iterations < maxSteps) {

762 iterations += 1;

763 if (state.pendingExternalSurface) {

764 const surface = findExternalSurface(manifest, state.pendingExternalSurface.nodeId);

765 if (!surface) break;

766 const outcome = Object.keys(surface.outcomes)[0];

767 if (!outcome) break;

768 state = submitResponse(state, {

dist/index.jsView file

Lines 4589-4629javascript

4589 const response = previewResponseForInput(input);

4590 if (response) return response;

4591 }

4592 const { oauth, email } = findAuthPreviewLayers(screen);

4593 if (oauth) {

4594