registry / @gr4vy/sdk / 2.3.14

@gr4vy/sdk@2.3.14

Developer-friendly & type-safe TypeScript SDK specifically catered to leverage the **Gr4vy** API.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1,309 file(s), 4.04 MB of source, external domains: api.sandbox, api.sandbox.e2e.gr4vy.app, apple-pay-gateway.apple.com, example.com

Source & flagged code

5 flagged

lib/helpers.jsView file

Lines 81-121javascript

81 * Expected key format:

82 * - PKCS#8 PEM-encoded private key

83 * - EC P-521 curve (matches ES512 signing)

84 *

85 * Steps:

86 * 1. Decode PEM to PKCS#8 DER bytes.

87 * 2. Import key through Web Crypto.

88 * 3. Export as JWK and validate required fields.

89 * 4. Hash the canonical RFC 7638 thumbprint input with SHA-256.

90 * 5. Return base64url encoded digest.

91 *

92 * @param privateKey PEM-encoded PKCS#8 EC private key.

93 * @returns The base64url-encoded JWK thumbprint used as JWT `kid`.

94 * @throws If key parsing/import/export/validation/digest fails.

95 */

96async function getKeyId(privateKey) {

97 try {

98 const runtimeCrypto = await resolveWebCrypto();

99 // Parse PEM to DER binary

100 const pemBody = privateKey

101 .replace(/-----BEGIN PRIVATE KEY-----/, "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/helpers.jsView on unpkg · L101

Critical

Secret Pattern

RSA private key in lib/helpers.js

lib/helpers.jsView on unpkg · L101

102 .replace(/-----END PRIVATE KEY-----/, "")

103 .replace(/\s/g, "");

104 const der = (0, base64_1.bytesFromBase64)(pemBody);

105 // Import as extractable CryptoKey (ES512 = P-521)

106 const key = await runtimeCrypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-521" }, true, ["sign"]);

107 // Export as JWK and validate fields required to build an RFC 7638 thumbprint.

108 const jwk = await runtimeCrypto.subtle.exportKey("jwk", key);

109 const requiredFields = ["kty", "crv", "x", "y"];

110 const invalidFields = requiredFields.filter((field) => {

111 const value = jwk[field];

112 return typeof value !== "string" || value.length === 0;

113 });

114 if (invalidFields.length > 0) {

115 throw new Error(`Exported JWK is missing required string field(s): ${invalidFields.join(", ")}`);

116 }

117 if (jwk.kty !== "EC" || jwk.crv !== "P-521") {

118 throw new Error("Imported key is not an EC P-521 private key");

119 }

120 // RFC 7638 canonical member set for EC keys: crv, kty, x, y.

121 const input = JSON.stringify({

types/enums.jsView file

Lines 22-62javascript

22 var ownKeys = function(o) {

23 ownKeys = Object.getOwnPropertyNames || function (o) {

24 var ar = [];

25 for (var k in o) if (Object

tests/auth.test.jsView file

Lines 1-28javascript

1import jwt from "jsonwebtoken";

2import snakecaseKeys from "snakecase-keys";

3import timekeeper from "timekeeper";

4import { describe, expect, test, vi } from "vitest";

5import { version } from "../package.json";

src/lib/helpers.tsView file

Lines 94-134typescript

94 * - PKCS#8 PEM-encoded private key

95 * - EC P-521 curve (matches ES512 signing)

96 *

97 * Steps:

Source & flagged code

5 flagged · loading source

lib/helpers.jsView file

101patternName = private_key_rsa severity = critical line = 101 matchedText = .replace... "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/helpers.jsView on unpkg · L101

101patternName = private_key_rsa severity = critical line = 101 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in lib/helpers.js

lib/helpers.jsView on unpkg · L101

types/enums.jsView file

42exports.outboundSchemaInt = outboundSchemaInt; L43: const z = __importStar(require("zod/v3")); L44: const unrecognized_js_1 = require("./unrecognized.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

types/enums.jsView on unpkg · L42

tests/auth.test.jsView file

8patternName = private_key_rsa severity = critical line = 8 matchedText = const pr...----

Critical

Secret Pattern

RSA private key in tests/auth.test.js

tests/auth.test.jsView on unpkg · L8

src/lib/helpers.tsView file

114patternName = private_key_rsa severity = critical line = 114 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in src/lib/helpers.ts

src/lib/helpers.tsView on unpkg · L114

Findings

4 Critical3 Medium6 Low

CriticalCritical Secretlib/helpers.js

CriticalSecret Patterntests/auth.test.js

CriticalSecret Patternlib/helpers.js

CriticalSecret Patternsrc/lib/helpers.ts

MediumDynamic Requiretypes/enums.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

lib/helpers.jsView file

Lines 81-121javascript

81 * Expected key format:

82 * - PKCS#8 PEM-encoded private key

83 * - EC P-521 curve (matches ES512 signing)

84 *

85 * Steps:

86 * 1. Decode PEM to PKCS#8 DER bytes.

87 * 2. Import key through Web Crypto.

88 * 3. Export as JWK and validate required fields.

89 * 4. Hash the canonical RFC 7638 thumbprint input with SHA-256.

90 * 5. Return base64url encoded digest.

91 *

92 * @param privateKey PEM-encoded PKCS#8 EC private key.

93 * @returns The base64url-encoded JWK thumbprint used as JWT `kid`.

94 * @throws If key parsing/import/export/validation/digest fails.

95 */

96async function getKeyId(privateKey) {

97 try {

98 const runtimeCrypto = await resolveWebCrypto();

99 // Parse PEM to DER binary

100 const pemBody = privateKey

101 .replace(/-----BEGIN PRIVATE KEY-----/, "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/helpers.jsView on unpkg · L101

Critical

Secret Pattern

RSA private key in lib/helpers.js

lib/helpers.jsView on unpkg · L101

102 .replace(/-----END PRIVATE KEY-----/, "")

103 .replace(/\s/g, "");

104 const der = (0, base64_1.bytesFromBase64)(pemBody);

105 // Import as extractable CryptoKey (ES512 = P-521)

106 const key = await runtimeCrypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-521" }, true, ["sign"]);

107 // Export as JWK and validate fields required to build an RFC 7638 thumbprint.

108 const jwk = await runtimeCrypto.subtle.exportKey("jwk", key);

109 const requiredFields = ["kty", "crv", "x", "y"];

110 const invalidFields = requiredFields.filter((field) => {

111 const value = jwk[field];

112 return typeof value !== "string" || value.length === 0;

113 });

114 if (invalidFields.length > 0) {

115 throw new Error(`Exported JWK is missing required string field(s): ${invalidFields.join(", ")}`);

116 }

117 if (jwk.kty !== "EC" || jwk.crv !== "P-521") {

118 throw new Error("Imported key is not an EC P-521 private key");

119 }

120 // RFC 7638 canonical member set for EC keys: crv, kty, x, y.

121 const input = JSON.stringify({

types/enums.jsView file

Lines 22-62javascript

22 var ownKeys = function(o) {

23 ownKeys = Object.getOwnPropertyNames || function (o) {

24 var ar = [];

25 for (var k in o) if (Object

tests/auth.test.jsView file

Lines 1-28javascript

1import jwt from "jsonwebtoken";

2import snakecaseKeys from "snakecase-keys";

3import timekeeper from "timekeeper";

4import { describe, expect, test, vi } from "vitest";

5import { version } from "../package.json";

src/lib/helpers.tsView file

Lines 94-134typescript

94 * - PKCS#8 PEM-encoded private key

95 * - EC P-521 curve (matches ES512 signing)

96 *

97 * Steps: