registry / @getrheo/flow-runtime / 2.3.0

@getrheo/flow-runtime@2.3.0

Rheo flow state machine and manifest runtime (transitive dependency).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 475 KB of source

Source & flagged code

2 flagged

dist/templatePreviewPath.jsView file

Lines 728-768javascript

728 const response = previewResponseForInput(input);

729 if (response) return response;

730 }

731 const { oauth, email } = findAuthPreviewLayers(screen);

Source & flagged code

2 flagged · loading source

dist/templatePreviewPath.jsView file

748patternName = generic_password severity = medium line = 748 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/templatePreviewPath.jsView on unpkg · L748

dist/index.jsView file

4609patternName = generic_password severity = medium line = 4609 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4609

Findings

2 Medium3 Low

MediumSecret Patterndist/templatePreviewPath.js

MediumSecret Patterndist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/index.jsView file

Lines 4589-4629javascript

4589 const response = previewResponseForInput(input);

4590 if (response) return response;

4591 }

4592 const { oauth, email } = findAuthPreviewLayers(screen);

4593 if (oauth) {

4594 return {

4595 kind: "oauth_login_resolve",

4596 layerId: oauth.layerId,

4597 provider: oauth.provider,

4598 success: true,

4599 customerExternalId: "preview-user"

4600 };

4601 }

4602 if (email) {

4603 return {

4604 kind: "email_password_auth_resolve",

4605 layerId: email.layerId,

4606 fieldKey: email.fieldKey,

4607 mode: email.mode,

4608 email: "preview@example.com",

4609 password: "preview-password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4609

4610 success: true

4611 };

4612 }

4613 return { kind: "cta", action: "primary" };

4614};

4615var buildTemplatePreviewPath = (manifest, options) => {

4616 const maxSteps = options?.maxSteps ?? PREVIEW_MAX_STEPS;

4617 const locale = options?.locale ?? manifest.defaultLocale ?? "en";

4618 let state = initFlowState(manifest, { locale, platform: "web" });

4619 state = startFlow(state);

4620 const steps = [];

4621 let iterations = 0;

4622 while (state.status === "running" && iterations < maxSteps) {

4623 iterations += 1;

4624 if (state.pendingExternalSurface) {

4625 const surface = findExternalSurface(manifest, state.pendingExternalSurface.nodeId);

4626 if (!surface) break;

4627 const outcome = Object.keys(surface.outcomes)[0];

4628 if (!outcome) break;

4629 state = submitResponse(state, {