registry / @hugo-fixit/post-encrypt / 0.2.0

@hugo-fixit/post-encrypt@0.2.0

Post-build AES-256-GCM encryption tool for the FixIt Hugo theme

Static Scan Results

scanned 10h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.88 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 176-216javascript

176 while (true) {

177 const matches = findEncryptionTemplates(result);

178 const pending = matches.filter(m => !hasNestedUnencryptedTemplate(m)

179 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v2"')

180 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v1"'));

181 if (pending.length === 0)

182 break;

183 // Process in reverse order to preserve positions

184 for (let i = pending.length - 1; i >= 0; i--) {

185 const match = pending[i];

186 const attrs = String(match.attrs);

187 const passwordMatch = attrs.match(/\bdata-password\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/);

188 if (!passwordMatch)

189 continue;

190 const passwordHash = passwordMatch[1] || passwordMatch[2] || passwordMatch[3];

191 if (!passwordHash)

192 continue;

193 // Replace raw SHA-256 hash with PBKDF2 verification hash

194 const { hash: verifyHash, salt: verifySalt } = deriveVerificationHash(passwordHash);

195 const encryptedPayload = encryptPayload(match.content, passwordHash);

196 const replacedAttrs = attrs.replace(/\bdata-password\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/, `data-password="${verifyHash}"`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L196

197 const newAttrs = `${replacedAttrs} data-verify-salt="${verifySalt.toString('base64')}" data-cipher="${AES_MARKER}"`;

198 const newBlock = `<template${newAttrs}>${encryptedPayload}</template>`;

199 result = result.slice(0, match.openStart) + newBlock + result.slice(match.closeEnd);

200 changed = true;

201 }

202 }

203 return { content: result, changed };

204}

205function hasUnencryptedTemplate(matches) {

206 return matches.some((match) => {

207 const attrs = String(match.attrs);

208 const hasAesMarker = /\bdata-cipher\s*=\s*"aes-256-gcm-v[12]"/.test(attrs);

209 return !hasAesMarker;

210 });

211}

212function main() {

213 const options = parseArgs(process.argv.slice(2));

214 if (options.helpRequested) {

215 printHelp();

216 return;

Source & flagged code

1 flagged · loading source

dist/index.jsView file

196patternName = generic_password severity = medium line = 196 matchedText = const re..."`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L196

Findings

2 Medium3 Low

MediumSecret Patterndist/index.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

1 flagged

dist/index.jsView file

Lines 176-216javascript

176 while (true) {

177 const matches = findEncryptionTemplates(result);

178 const pending = matches.filter(m => !hasNestedUnencryptedTemplate(m)

179 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v2"')

180 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v1"'));

181 if (pending.length === 0)

182 break;

183 // Process in reverse order to preserve positions

184 for (let i = pending.length - 1; i >= 0; i--) {

185 const match = pending[i];

186 const attrs = String(match.attrs);

187 const passwordMatch = attrs.match(/\bdata-password\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/);

188 if (!passwordMatch)

189 continue;

190 const passwordHash = passwordMatch[1] || passwordMatch[2] || passwordMatch[3];

191 if (!passwordHash)

192 continue;

193 // Replace raw SHA-256 hash with PBKDF2 verification hash

194 const { hash: verifyHash, salt: verifySalt } = deriveVerificationHash(passwordHash);

195 const encryptedPayload = encryptPayload(match.content, passwordHash);

196 const replacedAttrs = attrs.replace(/\bdata-password\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/, `data-password="${verifyHash}"`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L196

197 const newAttrs = `${replacedAttrs} data-verify-salt="${verifySalt.toString('base64')}" data-cipher="${AES_MARKER}"`;

198 const newBlock = `<template${newAttrs}>${encryptedPayload}</template>`;

199 result = result.slice(0, match.openStart) + newBlock + result.slice(match.closeEnd);

200 changed = true;

201 }

202 }

203 return { content: result, changed };

204}

205function hasUnencryptedTemplate(matches) {

206 return matches.some((match) => {

207 const attrs = String(match.attrs);

208 const hasAesMarker = /\bdata-cipher\s*=\s*"aes-256-gcm-v[12]"/.test(attrs);

209 return !hasAesMarker;

210 });

211}

212function main() {

213 const options = parseArgs(process.argv.slice(2));

214 if (options.helpRequested) {

215 printHelp();

216 return;