registry / @graphit/cli / 0.2.82

@graphit/cli@0.2.82

Graphit CLI - Build custom dashboards from any AI coding assistant

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 31 file(s), 210 KB of source, external domains: 127.0.0.1, api.graphit-app.com, graphit-app.com, registry.npmjs.org, securetoken.googleapis.com

Source & flagged code

4 flagged

dist/auth/token.jsView file

Lines 1-23javascript

1import { readCredentials, writeCredentials } from "./credentials.js";

2const FIREBASE_TOKEN_URL = "https://securetoken.googleapis.com/v1/token";

3const FIREBASE_API_KEY = process.env.GRAPHIT_FIREBASE_API_KEY || "AIzaSyCxahikMb2o0BroW1gqn2aWNad6S6-n-gI";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth/token.jsView on unpkg · L3

High

Secret Pattern

Google API key in dist/auth/token.js

dist/auth/token.jsView on unpkg · L3

4const TOKEN_BUFFER_SECONDS = 60;

5// Issue #560: a slow / proxied / sandboxed network can exceed a tight refresh

6// budget (5s tripped under observed ~3.6s securetoken latency). 15s sits between

7// that and the 30s API-client budget.

8const REFRESH_TIMEOUT_MS = 15_000;

9export async function getValidIdToken() {

10 const creds = await readCredentials();

11 if (!creds) {

12 throw new Error("Not logged in. Run `graphit auth login` first.");

13 }

14 if (creds.id_token &&

15 creds.id_token_expiry &&

16 creds.id_token_expiry > Date.now() / 1000 + TOKEN_BUFFER_SECONDS) {

17 return { id_token: creds.id_token, user_id: creds.user_id };

18 }

19 let resp;

20 try {

21 resp = await fetch(`${FIREBASE_TOKEN_URL}?key=${FIREBASE_API_KEY}`, {

22 method: "POST",

23 headers: { "Content-Type": "application/x-www-form-urlencoded" },

dist/update-check.jsView file

Lines 1-27javascript

1import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";

2import { spawnSync } from "child_process";

3import { homedir } from "os";

4import { dirname, join, sep } from "path";

5import { fileURLToPath } from "url";

bin/graphit.cmdView file

•path = bin/graphit.cmd kind = build_helper sizeBytes = 431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/graphit.cmdView on unpkg

Source & flagged code

4 flagged · loading source

dist/auth/token.jsView file

3patternName = google_api_key severity = high line = 3 matchedText = const FI...gI";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth/token.jsView on unpkg · L3

3patternName = google_api_key severity = high line = 3 matchedText = const FI...gI";

High

Secret Pattern

Google API key in dist/auth/token.js

dist/auth/token.jsView on unpkg · L3

dist/update-check.jsView file

7import { findOutdatedSkillInstalls, formatSkillStalenessBanner, } from "./sk[redacted]"; L8: const require = createRequire(import.meta.url); L9: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update-check.jsView on unpkg · L7

bin/graphit.cmdView file

•path = bin/graphit.cmd kind = build_helper sizeBytes = 431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/graphit.cmdView on unpkg

Findings

2 High5 Medium5 Low

HighHigh Secretdist/auth/token.js

HighSecret Patterndist/auth/token.js

MediumDynamic Requiredist/update-check.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/graphit.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/auth/token.jsView file

Lines 1-23javascript

1import { readCredentials, writeCredentials } from "./credentials.js";

2const FIREBASE_TOKEN_URL = "https://securetoken.googleapis.com/v1/token";

3const FIREBASE_API_KEY = process.env.GRAPHIT_FIREBASE_API_KEY || "AIzaSyCxahikMb2o0BroW1gqn2aWNad6S6-n-gI";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth/token.jsView on unpkg · L3

High

Secret Pattern

Google API key in dist/auth/token.js

dist/auth/token.jsView on unpkg · L3

4const TOKEN_BUFFER_SECONDS = 60;

5// Issue #560: a slow / proxied / sandboxed network can exceed a tight refresh

6// budget (5s tripped under observed ~3.6s securetoken latency). 15s sits between

7// that and the 30s API-client budget.

8const REFRESH_TIMEOUT_MS = 15_000;

9export async function getValidIdToken() {

10 const creds = await readCredentials();

11 if (!creds) {

12 throw new Error("Not logged in. Run `graphit auth login` first.");

13 }

14 if (creds.id_token &&

15 creds.id_token_expiry &&

16 creds.id_token_expiry > Date.now() / 1000 + TOKEN_BUFFER_SECONDS) {

17 return { id_token: creds.id_token, user_id: creds.user_id };

18 }

19 let resp;

20 try {

21 resp = await fetch(`${FIREBASE_TOKEN_URL}?key=${FIREBASE_API_KEY}`, {

22 method: "POST",

23 headers: { "Content-Type": "application/x-www-form-urlencoded" },

dist/update-check.jsView file

Lines 1-27javascript

1import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";

2import { spawnSync } from "child_process";

3import { homedir } from "os";

4import { dirname, join, sep } from "path";

5import { fileURLToPath } from "url";

bin/graphit.cmdView file

•path = bin/graphit.cmd kind = build_helper sizeBytes = 431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/graphit.cmdView on unpkg