registry / @hugo-fixit/post-encrypt / 0.1.0

@hugo-fixit/post-encrypt@0.1.0

Post-build AES-256-GCM encryption tool for the FixIt Hugo theme

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.24 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 155-195javascript

155 while (true) {

156 const matches = findEncryptionTemplates(result);

157 const pending = matches.filter(m => !hasNestedUnencryptedTemplate(m)

158 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v2"')

159 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v1"'));

160 if (pending.length === 0)

161 break;

162 // Process in reverse order to preserve positions

163 for (let i = pending.length - 1; i >= 0; i--) {

164 const match = pending[i];

165 const attrs = String(match.attrs);

166 const passwordMatch = attrs.match(/\bdata-password\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/);

167 if (!passwordMatch)

168 continue;

169 const passwordHash = passwordMatch[1] || passwordMatch[2] || passwordMatch[3];

170 if (!passwordHash)

171 continue;

172 // Replace raw SHA-256 hash with PBKDF2 verification hash

173 const { hash: verifyHash, salt: verifySalt } = deriveVerificationHash(passwordHash);

174 const encryptedPayload = encryptPayload(match.content, passwordHash);

175 const replacedAttrs = attrs.replace(/\bdata-password\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/, `data-password="${verifyHash}"`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L175

176 const newAttrs = `${replacedAttrs} data-verify-salt="${verifySalt.toString('base64')}" data-cipher="${AES_MARKER}"`;

177 const newBlock = `<template${newAttrs}>${encryptedPayload}</template>`;

178 result = result.slice(0, match.openStart) + newBlock + result.slice(match.closeEnd);

179 changed = true;

180 }

181 }

182 return { content: result, changed };

183}

184function hasUnencryptedTemplate(matches) {

185 return matches.some((match) => {

186 const attrs = String(match.attrs);

187 const hasAesMarker = /\bdata-cipher\s*=\s*"aes-256-gcm-v[12]"/.test(attrs);

188 return !hasAesMarker;

189 });

190}

191function main() {

192 const options = parseArgs(process.argv.slice(2));

193 const targetDir = path.isAbsolute(options.input)

194 ? options.input

195 : path.resolve(options.cwd, options.input);

Source & flagged code

1 flagged · loading source

dist/index.jsView file

175patternName = generic_password severity = medium line = 175 matchedText = const re..."`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L175

Findings

2 Medium3 Low

MediumSecret Patterndist/index.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

1 flagged

dist/index.jsView file

Lines 155-195javascript

155 while (true) {

156 const matches = findEncryptionTemplates(result);

157 const pending = matches.filter(m => !hasNestedUnencryptedTemplate(m)

158 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v2"')

159 && !String(m.attrs).includes('data-cipher="aes-256-gcm-v1"'));

160 if (pending.length === 0)

161 break;

162 // Process in reverse order to preserve positions

163 for (let i = pending.length - 1; i >= 0; i--) {

164 const match = pending[i];

165 const attrs = String(match.attrs);

166 const passwordMatch = attrs.match(/\bdata-password\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/);

167 if (!passwordMatch)

168 continue;

169 const passwordHash = passwordMatch[1] || passwordMatch[2] || passwordMatch[3];

170 if (!passwordHash)

171 continue;

172 // Replace raw SHA-256 hash with PBKDF2 verification hash

173 const { hash: verifyHash, salt: verifySalt } = deriveVerificationHash(passwordHash);

174 const encryptedPayload = encryptPayload(match.content, passwordHash);

175 const replacedAttrs = attrs.replace(/\bdata-password\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/, `data-password="${verifyHash}"`);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L175

176 const newAttrs = `${replacedAttrs} data-verify-salt="${verifySalt.toString('base64')}" data-cipher="${AES_MARKER}"`;

177 const newBlock = `<template${newAttrs}>${encryptedPayload}</template>`;

178 result = result.slice(0, match.openStart) + newBlock + result.slice(match.closeEnd);

179 changed = true;

180 }

181 }

182 return { content: result, changed };

183}

184function hasUnencryptedTemplate(matches) {

185 return matches.some((match) => {

186 const attrs = String(match.attrs);

187 const hasAesMarker = /\bdata-cipher\s*=\s*"aes-256-gcm-v[12]"/.test(attrs);

188 return !hasAesMarker;

189 });

190}

191function main() {

192 const options = parseArgs(process.argv.slice(2));

193 const targetDir = path.isAbsolute(options.input)

194 ? options.input

195 : path.resolve(options.cwd, options.input);