registry / @h-rig/notifications-plugin / 0.0.6-alpha.238

@h-rig/notifications-plugin@0.0.6-alpha.238

First-party notification policy/channels capability plugin for Rig.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 3 file(s), 26.6 KB of source

Source & flagged code

1 flagged

dist/src/index.jsView file

Lines 9-49javascript

9 __defProp(target, name, {

10 get: all[name],

11 enumerable: true,

12 configurable: true,

13 set: __exportSetter.bind(all, name)

14 });

15};

16var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

18// packages/notifications-plugin/src/notifications.ts

19var exports_notifications = {};

20__export(exports_notifications, {

21 validateNotificationTargetUrl: () => validateNotificationTargetUrl,

22 resolveNotifyTimeoutMs: () => resolveNotifyTimeoutMs,

23 resolveNotifyAllowHttpLocalhost: () => resolveNotifyAllowHttpLocalhost,

24 resolveNotificationTargetUrl: () => resolveNotificationTargetUrl,

25 loadNotificationConfig: () => loadNotificationConfig,

26 dispatchEventToTargets: () => dispatchEventToTargets,

27 buildTargetPayload: () => buildTargetPayload,

28 NOTIFY_LOCALHOST_HTTP_OPT_IN_ENV: () => NOTIFY_LOCALHOST_HTTP_OPT_IN_ENV

29});

30import { lookup as dnsLookup } from "dns/promises";

31import { isIP } from "net";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/index.jsView on unpkg · L29

32import { Duration, Effect } from "effect";

33function normalizeTargetHost(host) {

34 return host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");

35}

36function blockedTargetHostReason(host) {

37 const normalizedHost = normalizeTargetHost(host);

38 if (normalizedHost === "localhost" || normalizedHost === "::1") {

39 return "loopback addresses are not allowed";

40 }

41 if (METADATA_HOSTS[normalizedHost])

42 return "cloud metadata hosts are not allowed";

43 const embeddedIpv4 = normalizedHost.match(/(?:^|:)(\d+\.\d+\.\d+\.\d+)$/)?.[1];

44 if (embeddedIpv4 && isIP(normalizedHost) === 6) {

45 return blockedTargetHostReason(embeddedIpv4);

46 }

47 const ipv4Parts = normalizedHost.split(".");

48 if (ipv4Parts.length === 4 && ipv4Parts.every((part) => /^\d+$/.test(part))) {

49 const a = Number.parseInt(ipv4Parts[0], 10);

Source & flagged code

1 flagged · loading source

dist/src/index.jsView file

29}); L30: import { lookup as dnsLookup } from "dns/promises"; L31: import { isIP } from "net"; ... L61: if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168) { L62: return "RFC1918/private addresses are not allowed"; L63: } ... L74: } L75: function resolveNotifyAllowHttpLocalhost(raw = process.env[NOTIFY_LOCALHOST_HTTP_OPT_IN_ENV]) { L76: return typeof raw === "string" && TRUE_LIKE[raw.trim().toLowerCase()] === true; ... L139: try { L140: const parsed = await Bun.file(path).json(); L141: return {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/index.jsView on unpkg · L29

Findings

1 High1 Medium1 Low

HighCloud Metadata Accessdist/src/index.js

MediumEnvironment Vars

LowNo License

Source & flagged code

1 flagged

dist/src/index.jsView file

Lines 9-49javascript

9 __defProp(target, name, {

10 get: all[name],

11 enumerable: true,

12 configurable: true,

13 set: __exportSetter.bind(all, name)

14 });

15};

16var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

18// packages/notifications-plugin/src/notifications.ts

19var exports_notifications = {};

20__export(exports_notifications, {

21 validateNotificationTargetUrl: () => validateNotificationTargetUrl,

22 resolveNotifyTimeoutMs: () => resolveNotifyTimeoutMs,

23 resolveNotifyAllowHttpLocalhost: () => resolveNotifyAllowHttpLocalhost,

24 resolveNotificationTargetUrl: () => resolveNotificationTargetUrl,

25 loadNotificationConfig: () => loadNotificationConfig,

26 dispatchEventToTargets: () => dispatchEventToTargets,

27 buildTargetPayload: () => buildTargetPayload,

28 NOTIFY_LOCALHOST_HTTP_OPT_IN_ENV: () => NOTIFY_LOCALHOST_HTTP_OPT_IN_ENV

29});

30import { lookup as dnsLookup } from "dns/promises";

31import { isIP } from "net";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/index.jsView on unpkg · L29

32import { Duration, Effect } from "effect";

33function normalizeTargetHost(host) {

34 return host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");

35}

36function blockedTargetHostReason(host) {

37 const normalizedHost = normalizeTargetHost(host);

38 if (normalizedHost === "localhost" || normalizedHost === "::1") {

39 return "loopback addresses are not allowed";

40 }

41 if (METADATA_HOSTS[normalizedHost])

42 return "cloud metadata hosts are not allowed";

43 const embeddedIpv4 = normalizedHost.match(/(?:^|:)(\d+\.\d+\.\d+\.\d+)$/)?.[1];

44 if (embeddedIpv4 && isIP(normalizedHost) === 6) {

45 return blockedTargetHostReason(embeddedIpv4);

46 }

47 const ipv4Parts = normalizedHost.split(".");

48 if (ipv4Parts.length === 4 && ipv4Parts.every((part) => /^\d+$/.test(part))) {

49 const a = Number.parseInt(ipv4Parts[0], 10);