registry / @gmacko/emulate / 0.5.3

@gmacko/emulate@0.5.3

Local drop-in replacement services for CI and no-network sandboxes

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 2.01 MB of source, external domains: calendar.google.com, docs.github.com, drive.google.com, emulate.dev, github.com, img.clerk.com, lh3.googleusercontent.com, meet.google.com

Source & flagged code

12 flagged

dist/dist-LDUHEJAN.jsView file

Lines 13-53javascript

13 sqsQueues: store.collection("aws.sqs_queues", ["queue_name", "queue_url"]),

14 sqsMessages: store.collection("aws.sqs_messages", ["message_id", "queue_name"]),

15 iamUsers: store.collection("aws.iam_users", ["user_name", "user_id"]),

16 iamRoles: store.collection("aws.iam_roles", ["role_name", "role_id"])

17 };

18}

19var ACCOUNT_ID = "123456789012";

20var DEFAULT_REGION = "us-east-1";

21function generateAwsId(prefix) {

22 return prefix + randomBytes(8).toString("hex").toUpperCase();

23}

24function generateMessageId() {

25 return [

26 randomBytes(4).toString("hex"),

27 randomBytes(2).toString("hex"),

28 randomBytes(2).toString("hex"),

29 randomBytes(2).toString("hex"),

30 randomBytes(6).toString("hex")

31 ].join("-");

32}

33function generateReceiptHandle() {

34 return randomBytes(48).toString("base64url");

35}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-LDUHEJAN.jsView on unpkg · L33

36function md5(content) {

37 return createHash("md5").update(content).digest("hex");

38}

39function getAccountId() {

40 return ACCOUNT_ID;

41}

42function getDefaultRegion() {

43 return DEFAULT_REGION;

44}

45function awsXmlResponse(c, xml, status = 200) {

46 return c.text(xml, status, { "Content-Type": "application/xml" });

47}

48function awsErrorXml(c, code, message, status = 400) {

49 const xml = `<?xml version="1.0" encoding="UTF-8"?>

50<ErrorResponse>

51 <Error>

52 <Code>${escapeXml(code)}</Code>

53 <Message>${escapeXml(message)}</Message>

Lines 1540-1580javascript

1540 const queueName = "emulate-default-queue";

1541 aws.sqsQueues.insert({

1542 queue_name: queueName,

1543 queue_url: `${baseUrl}/sqs/${accountId}/${queueName}`,

1544 arn: `arn:aws:sqs:${region}:${accountId}:${queueName}`,

1545 visibility_timeout: 30,

dist/chunk-VBCANQAD.jsView file

Lines 3-43javascript

3var i2 = Object.defineProperty;

4var c = Object.getOwnPropertyDescriptor;

5var f = Object.getOwnPropertyNames;

6var l = Object.getPrototypeOf;

7var s = Object.prototype.hasOwnProperty;

8var a = (

dist/pglite.wasmView file

•path = dist/pglite.wasm kind = wasm_module sizeBytes = 8739902 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/pglite.wasmView on unpkg

dist/fonts/geist-sans.woff2View file

•path = dist/fonts/geist-sans.woff2 kind = high_entropy_blob sizeBytes = 28400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/fonts/geist-sans.woff2View on unpkg

dist/index.jsView file

Lines 388-428javascript

388 }

389 },

390 clerk: {

391 label: "Clerk authentication and user management emulator",

392 endpoints: "OIDC discovery, JWKS, OAuth authorize/token/userinfo, users, email addresses, organizations, memberships, invitations, sessions",

393 async load() {

394 const mod = await

dist/chunk-D6EKRYGP.jsView file

Lines 1444-1484javascript

1444 case "P-521": {

1445 algorithm = { name: "ECDH", namedCurve: crv };

1446 break;

1447 }

1448 case "X25519":

1449 algorithm = { name: "X25519" };

1450 break;

dist/api.jsView file

Lines 367-407javascript

367 }

368 },

369 clerk: {

370 label: "Clerk authentication and user management emulator",

371 endpoints: "OIDC discovery, JWKS, OAuth authorize/token/userinfo, users, email addresses, organizations, memberships, invitations, sessions",

372 async load() {

373 const mod = await

README.mdView file

345patternName = private_key_rsa severity = critical line = 345 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L345

842patternName = aws_access_key severity = critical line = 842 matchedText = **AWS**:...EY`.

Critical

Secret Pattern

AWS access key ID in README.md

README.mdView on unpkg · L842

Source & flagged code

12 flagged · loading source

dist/dist-LDUHEJAN.jsView file

1560patternName = aws_access_key severity = critical line = 1560 matchedText = access_k...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/dist-LDUHEJAN.jsView on unpkg · L1560

1560patternName = aws_access_key severity = critical line = 1560 matchedText = access_k...LE",

Critical

Secret Pattern

AWS access key ID in dist/dist-LDUHEJAN.js

dist/dist-LDUHEJAN.jsView on unpkg · L1560

33function generateReceiptHandle() { L34: return randomBytes(48).toString("base64url"); L35: } ... L62: function parseQueryString(body) { L63: const params = new URLSearchParams(body); L64: const result = {}; ... L107: creation_date: (/* @__PURE__ */ new Date()).toISOString(), L108: acl: "private", L109: versioning_enabled: false ... L1096: var errorHandler = createErrorHandler(); L1097: var isDebug = typeof process !== "undefined" && (process.env.DEBUG === "1" || process.env.DEBUG === "true" || process.env.EMULATE_DEBUG === "1"); L1098: var __dirname = dirname(fileURLToPath(import.meta.url));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-LDUHEJAN.jsView on unpkg · L33

dist/chunk-VBCANQAD.jsView file

23var n = (t, e, o2) => e.has(t) || a("Cannot " + o2); L24: var h = (t, e, o2) => (n(t, e, "read from private field"), o2 ? o2.call(t) : e.get(t)); L25: var R = (t, e, o2) => e.has(t) ? a("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(t) : e.set(t, o2); ... L47: async function c2(t) { L48: s2 || r.has(t.toString()) || r.set(t.toString(), fetch(t)); L49: } ... L65: async function p2(t) { L66: return s2 ? (await (await import("fs/promises")).readFile(t)).buffer : (c2(t), (await r.get(t.toString())).clone().arrayBuffer()); L67: } ... L335: e = Q.map(e, function(n2) { L336: return Q.extend({}, n2, { data: Q.toUint8Array(n2.data) }); L337: });

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-VBCANQAD.jsView on unpkg · L23

893var func = `(${args}) => { ${body} };`; L894: ASM_CONSTS[start] = eval(func); L895: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-VBCANQAD.jsView on unpkg · L893

dist/pglite.wasmView file

•path = dist/pglite.wasm kind = wasm_module sizeBytes = 8739902 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/pglite.wasmView on unpkg

dist/fonts/geist-sans.woff2View file

•path = dist/fonts/geist-sans.woff2 kind = high_entropy_blob sizeBytes = 28400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/fonts/geist-sans.woff2View on unpkg

dist/index.jsView file

408patternName = generic_password severity = medium line = 408 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L408

dist/chunk-D6EKRYGP.jsView file

1464patternName = private_key_rsa severity = critical line = 1464 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in dist/chunk-D6EKRYGP.js

dist/chunk-D6EKRYGP.jsView on unpkg · L1464

dist/api.jsView file

387patternName = generic_password severity = medium line = 387 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in dist/api.js

dist/api.jsView on unpkg · L387

README.mdView file

345patternName = private_key_rsa severity = critical line = 345 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L345

842patternName = aws_access_key severity = critical line = 842 matchedText = **AWS**:...EY`.

Critical

Secret Pattern

AWS access key ID in README.md

README.mdView on unpkg · L842

Findings

5 Critical2 High6 Medium6 Low

CriticalCritical Secretdist/dist-LDUHEJAN.js

CriticalSecret Patterndist/dist-LDUHEJAN.js

CriticalSecret Patterndist/chunk-D6EKRYGP.js

CriticalSecret PatternREADME.md

HighObfuscated Payload Loaderdist/chunk-VBCANQAD.js

HighShips High Entropy Blobdist/fonts/geist-sans.woff2

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/pglite.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.js

MediumSecret Patterndist/api.js

LowScripts Present

LowEvaldist/chunk-VBCANQAD.js

LowWeak Cryptodist/dist-LDUHEJAN.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

dist/dist-LDUHEJAN.jsView file

Lines 13-53javascript

13 sqsQueues: store.collection("aws.sqs_queues", ["queue_name", "queue_url"]),

14 sqsMessages: store.collection("aws.sqs_messages", ["message_id", "queue_name"]),

15 iamUsers: store.collection("aws.iam_users", ["user_name", "user_id"]),

16 iamRoles: store.collection("aws.iam_roles", ["role_name", "role_id"])

17 };

18}

19var ACCOUNT_ID = "123456789012";

20var DEFAULT_REGION = "us-east-1";

21function generateAwsId(prefix) {

22 return prefix + randomBytes(8).toString("hex").toUpperCase();

23}

24function generateMessageId() {

25 return [

26 randomBytes(4).toString("hex"),

27 randomBytes(2).toString("hex"),

28 randomBytes(2).toString("hex"),

29 randomBytes(2).toString("hex"),

30 randomBytes(6).toString("hex")

31 ].join("-");

32}

33function generateReceiptHandle() {

34 return randomBytes(48).toString("base64url");

35}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-LDUHEJAN.jsView on unpkg · L33

36function md5(content) {

37 return createHash("md5").update(content).digest("hex");

38}

39function getAccountId() {

40 return ACCOUNT_ID;

41}

42function getDefaultRegion() {

43 return DEFAULT_REGION;

44}

45function awsXmlResponse(c, xml, status = 200) {

46 return c.text(xml, status, { "Content-Type": "application/xml" });

47}

48function awsErrorXml(c, code, message, status = 400) {

49 const xml = `<?xml version="1.0" encoding="UTF-8"?>

50<ErrorResponse>

51 <Error>

52 <Code>${escapeXml(code)}</Code>

53 <Message>${escapeXml(message)}</Message>

Lines 1540-1580javascript

1540 const queueName = "emulate-default-queue";

1541 aws.sqsQueues.insert({

1542 queue_name: queueName,

1543 queue_url: `${baseUrl}/sqs/${accountId}/${queueName}`,

1544 arn: `arn:aws:sqs:${region}:${accountId}:${queueName}`,

1545 visibility_timeout: 30,

dist/chunk-VBCANQAD.jsView file

Lines 3-43javascript

3var i2 = Object.defineProperty;

4var c = Object.getOwnPropertyDescriptor;

5var f = Object.getOwnPropertyNames;

6var l = Object.getPrototypeOf;

7var s = Object.prototype.hasOwnProperty;

8var a = (

dist/pglite.wasmView file

•path = dist/pglite.wasm kind = wasm_module sizeBytes = 8739902 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/pglite.wasmView on unpkg

dist/fonts/geist-sans.woff2View file

•path = dist/fonts/geist-sans.woff2 kind = high_entropy_blob sizeBytes = 28400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/fonts/geist-sans.woff2View on unpkg

dist/index.jsView file

Lines 388-428javascript

388 }

389 },

390 clerk: {

391 label: "Clerk authentication and user management emulator",

392 endpoints: "OIDC discovery, JWKS, OAuth authorize/token/userinfo, users, email addresses, organizations, memberships, invitations, sessions",

393 async load() {

394 const mod = await

dist/chunk-D6EKRYGP.jsView file

Lines 1444-1484javascript

1444 case "P-521": {

1445 algorithm = { name: "ECDH", namedCurve: crv };

1446 break;

1447 }

1448 case "X25519":

1449 algorithm = { name: "X25519" };

1450 break;

dist/api.jsView file

Lines 367-407javascript

367 }

368 },

369 clerk: {

370 label: "Clerk authentication and user management emulator",

371 endpoints: "OIDC discovery, JWKS, OAuth authorize/token/userinfo, users, email addresses, organizations, memberships, invitations, sessions",

372 async load() {

373 const mod = await

README.mdView file

345patternName = private_key_rsa severity = critical line = 345 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L345

842patternName = aws_access_key severity = critical line = 842 matchedText = **AWS**:...EY`.

Critical

Secret Pattern

AWS access key ID in README.md

README.mdView on unpkg · L842