registry / @groundnuty/macf-core / 0.2.54

@groundnuty/macf-core@0.2.54

Shared internals consumed by the MACF CLI and channel-server packages. Not intended for direct external use — will be marked deprecated-internal on first npm publish per DR-022 Amendment A.

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 226 KB of source, external domains: api.github.com

Source & flagged code

6 flagged

dist/certs/agent-cert.jsView file

Lines 1-62javascript

1import { randomBytes } from 'node:crypto';

2import { writeFileSync } from 'node:fs';

3import { x509, webcrypto, RSA_ALGORITHM, AGENT_CERT_VALIDITY_YEARS, } from './crypto-provider.js';

4import { MacfError } from '../errors.js';

5export class AgentCertError extends MacfError {

6 constructor(message) {

7 super('AGENT_CERT_ERROR', message);

8 this.name = 'AgentCertError';

9 }

10}

11function exportKeyToPem(exported) {

12 const b64 = Buffer.from(exported).toString('base64');

13 const lines = b64.match(/.{1,64}/g) ?? [];

14 return `-----BEGIN PRIVATE KEY-----\n${lines.join('\n')}\n-----END PRIVATE KEY-----\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/certs/agent-cert.jsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L14

15}

16/**

17 * Import a PEM private key into a WebCrypto CryptoKey for signing.

18 *

19 * Return type was `Promise<unknown>` historically — DOM CryptoKey types

20 * weren't exposed via @types/node < v25. Since @types/node v25 (#17 /

21 * PR #130) CryptoKey is resolvable from `globalThis`, so we return

22 * the precise type instead of laundering through `unknown` at each

23 * call site.

24 *

25 * Rejects input that contains zero or multiple BEGIN/END marker pairs

26 * (e.g. two keys accidentally concatenated) — ultrareview finding H4.

27 * Without this shape check, `webcrypto.subtle.importKey` would be

28 * handed a concatenated base64 blob and throw a generic DataError,

29 * which propagates upstream with no hint that the input file itself

30 * was malformed.

31 */

32export async function importPrivateKey(keyPem) {

33 const beginMatches = keyPem.match(/-----BEGIN PRIVATE KEY-----/g);

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L33

34 const endMatches = keyPem.match(/-----END PRIVATE KEY-----/g);

35 if (!beginMatches || beginMatches.length !== 1) {

36 throw new AgentCertError(`Malformed private key PEM: expected exactly one BEGIN marker, got ${beginMatches?.length ?? 0}`);

37 }

38 if (!endMatches || endMatches.length !== 1) {

39 throw new AgentCertError(`Malformed private key PEM: expected exactly one END marker, got ${endMatches?.length ?? 0}`);

40 }

41 const stripped = keyPem

42 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L42

43 .replace(/-----END PRIVATE KEY-----/g, '')

44 .replace(/\s/g, '');

45 const der = Buffer.from(stripped, 'base64');

46 return webcrypto.subtle.importKey('pkcs8', der, RSA_ALGORITHM, false, ['sign']);

47}

48/**

49 * Classify a host string as an IP or DNS name for SubjectAlternativeName

50 * entries. Shape-only check (matches `999.999.999.999` too — cert

51 * generation doesn't validate octet ranges, and we'd rather keep the

52 * classifier forgiving than have it silently misclassify a typo'd IP

53 * as DNS). IPv6 not handled here; add `:` detection + `[]` URL-wrapping

54 * when there's an actual ask.

55 */

56function hostToSan(host) {

57 const ipv4Shape = /^(\d{1,3}\.){3}\d{1,3}$/;

58 return ipv4Shape.test(host)

59 ? { type: 'ip', value: host }

60 : { type: 'dns', value: host };

61}

62/**

dist/certs/ca.jsView file

Lines 9-49javascript

9 super('CA_ERROR', message);

10 this.name = 'CaError';

11 }

12}

13// Tight perms on the leaf so the CA private key's parent dir isn't

14// world-traversable even when this path is hit outside `certs init`

15// (e.g. recoverCAKey in a fresh env). mkdirSync's `mode` is ANDed

16// with the process umask, so follow up with chmodSync to guarantee

17// 0o700 regardless of umask. Intermediate dirs keep umask defaults —

Source & flagged code

6 flagged · loading source

dist/certs/agent-cert.jsView file

14patternName = private_key_rsa severity = critical line = 14 matchedText = return `...\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/certs/agent-cert.jsView on unpkg · L14

14patternName = private_key_rsa severity = critical line = 14 matchedText = return `...\n`;

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L14

33patternName = private_key_rsa severity = critical line = 33 matchedText = const be.../g);

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L33

42patternName = private_key_rsa severity = critical line = 42 matchedText = .replace... '')

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L42

dist/certs/ca.jsView file

29patternName = private_key_rsa severity = critical line = 29 matchedText = return `...\n`;

Critical

Secret Pattern

RSA private key in dist/certs/ca.js

dist/certs/ca.jsView on unpkg · L29

282patternName = private_key_rsa severity = critical line = 282 matchedText = // PKCS#...nts.

Critical

Secret Pattern

RSA private key in dist/certs/ca.js

dist/certs/ca.jsView on unpkg · L282

Findings

6 Critical2 Medium4 Low

CriticalCritical Secretdist/certs/agent-cert.js

CriticalSecret Patterndist/certs/agent-cert.js

CriticalSecret Patterndist/certs/ca.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/certs/agent-cert.jsView file

Lines 1-62javascript

1import { randomBytes } from 'node:crypto';

2import { writeFileSync } from 'node:fs';

3import { x509, webcrypto, RSA_ALGORITHM, AGENT_CERT_VALIDITY_YEARS, } from './crypto-provider.js';

4import { MacfError } from '../errors.js';

5export class AgentCertError extends MacfError {

6 constructor(message) {

7 super('AGENT_CERT_ERROR', message);

8 this.name = 'AgentCertError';

9 }

10}

11function exportKeyToPem(exported) {

12 const b64 = Buffer.from(exported).toString('base64');

13 const lines = b64.match(/.{1,64}/g) ?? [];

14 return `-----BEGIN PRIVATE KEY-----\n${lines.join('\n')}\n-----END PRIVATE KEY-----\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/certs/agent-cert.jsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L14

15}

16/**

17 * Import a PEM private key into a WebCrypto CryptoKey for signing.

18 *

19 * Return type was `Promise<unknown>` historically — DOM CryptoKey types

20 * weren't exposed via @types/node < v25. Since @types/node v25 (#17 /

21 * PR #130) CryptoKey is resolvable from `globalThis`, so we return

22 * the precise type instead of laundering through `unknown` at each

23 * call site.

24 *

25 * Rejects input that contains zero or multiple BEGIN/END marker pairs

26 * (e.g. two keys accidentally concatenated) — ultrareview finding H4.

27 * Without this shape check, `webcrypto.subtle.importKey` would be

28 * handed a concatenated base64 blob and throw a generic DataError,

29 * which propagates upstream with no hint that the input file itself

30 * was malformed.

31 */

32export async function importPrivateKey(keyPem) {

33 const beginMatches = keyPem.match(/-----BEGIN PRIVATE KEY-----/g);

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L33

34 const endMatches = keyPem.match(/-----END PRIVATE KEY-----/g);

35 if (!beginMatches || beginMatches.length !== 1) {

36 throw new AgentCertError(`Malformed private key PEM: expected exactly one BEGIN marker, got ${beginMatches?.length ?? 0}`);

37 }

38 if (!endMatches || endMatches.length !== 1) {

39 throw new AgentCertError(`Malformed private key PEM: expected exactly one END marker, got ${endMatches?.length ?? 0}`);

40 }

41 const stripped = keyPem

42 .replace(/-----BEGIN PRIVATE KEY-----/g, '')

Critical

Secret Pattern

RSA private key in dist/certs/agent-cert.js

dist/certs/agent-cert.jsView on unpkg · L42

43 .replace(/-----END PRIVATE KEY-----/g, '')

44 .replace(/\s/g, '');

45 const der = Buffer.from(stripped, 'base64');

46 return webcrypto.subtle.importKey('pkcs8', der, RSA_ALGORITHM, false, ['sign']);

47}

48/**

49 * Classify a host string as an IP or DNS name for SubjectAlternativeName

50 * entries. Shape-only check (matches `999.999.999.999` too — cert

51 * generation doesn't validate octet ranges, and we'd rather keep the

52 * classifier forgiving than have it silently misclassify a typo'd IP

53 * as DNS). IPv6 not handled here; add `:` detection + `[]` URL-wrapping

54 * when there's an actual ask.

55 */

56function hostToSan(host) {

57 const ipv4Shape = /^(\d{1,3}\.){3}\d{1,3}$/;

58 return ipv4Shape.test(host)

59 ? { type: 'ip', value: host }

60 : { type: 'dns', value: host };

61}

62/**

dist/certs/ca.jsView file

Lines 9-49javascript

9 super('CA_ERROR', message);

10 this.name = 'CaError';

11 }

12}

13// Tight perms on the leaf so the CA private key's parent dir isn't

14// world-traversable even when this path is hit outside `certs init`

15// (e.g. recoverCAKey in a fresh env). mkdirSync's `mode` is ANDed

16// with the process umask, so follow up with chmodSync to guarantee

17// 0o700 regardless of umask. Intermediate dirs keep umask defaults —