registry / @indigoai-us/hq-cloud / 6.13.0

@indigoai-us/hq-cloud@6.13.0

HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 265 file(s), 4.42 MB of source, external domains: api.example.com, cognito-idp.eu-west-1.amazonaws.com, cognito-idp.us-east-1.amazonaws.com, example.com, github.com, hqapi.getindigo.ai, s3.test, signed.example, sqs.local, sqs.us-east-1.amazonaws.com, vault-api.example.com, vault-api.test, vault.test, vault.test.example.com

Source & flagged code

11 flagged

dist/vault-client.test.jsView file

Lines 544-609javascript

544 expect(pickCanonicalPersonEntity(list)?.uid).toBe("prs_a");

545 // Both undefined: uid tiebreak

546 const bothUndefined = [

547 { uid: "prs_z", slug: "z", type: "person", status: "active" },

548 { uid: "prs_a", slug: "a", type: "person", status: "active" },

549 ];

550 expect(pickCanonicalPersonEntity(bothUndefined)?.uid).toBe("prs_a");

551 });

552 it("pickCanonicalPersonEntity_filters_out_non_person_types", () => {

553 const mixed = [

554 { uid: "cmp_x", slug: "x", type: "company", status: "active", createdAt: "2025-01-01T00:00:00Z" },

555 { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-02T00:00:00Z" },

556 ];

557 const result = pickCanonicalPersonEntity(mixed);

558 expect(result?.uid).toBe("prs_b");

559 expect(result?.type).toBe("person");

560 });

561 it("sts.vend roundtrips POST /sts/vend with companyUid", async () => {

562 fetchSpy.mockResolvedValueOnce(jsonResponse(200, {

563 credentials: {

564 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/vault-client.test.jsView on unpkg · L564

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L564

565 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

566 sessionToken: "FwoGZXIvYXdzEBY...",

567 },

568 expiresAt: "2026-01-01T01:00:00.000Z",

569 }));

570 const result = await client.sts.vend({ companyUid: "cmp_x" });

571 expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L571

572 expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");

573 expect(typeof result.expiresAt).toBe("string");

574 const [url, init] = fetchSpy.mock.calls[0];

575 expect(url).toBe("https://vault.test.example.com/sts/vend");

576 expect(init.method.toUpperCase()).toBe("POST");

577 expect(JSON.parse(init.body)).toEqual({ companyUid: "cmp_x" });

578 });

579 it("vendSelf_roundtrip", async () => {

580 fetchSpy.mockResolvedValueOnce(jsonResponse(200, {

581 credentials: {

582 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L582

583 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

584 sessionToken: "FwoGZXIvYXdzEBY...",

585 },

586 expiresAt: "2026-01-01T01:00:00.000Z",

587 }));

588 const result = await client.sts.vendSelf({ personUid: "prs_x" });

589 expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L589

590 expect(result.credentials.secretAccessKey).toBe("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");

591 expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");

592 expect(typeof result.expiresAt).toBe("string");

593 const [url, init] = fetchSpy.mock.calls[0];

594 expect(url).toBe("https://vault.test.example.com/sts/vend-self");

595 expect(init.method.toUpperCase()).toBe("POST");

596 expect(JSON.parse(init.body)).toEqual({ personUid: "prs_x" });

597 });

598});

599// ---------------------------------------------------------------------------

600// Browse-vs-sync SDK methods (US-004)

601//

602// listMyExplicitGrants, getMembershipSyncConfig, setMembershipSyncConfig

603// wrap the US-002/US-003 hq-pro endpoints. Tests assert URL shape, payload

604// shape, error mapping (401/404/network), and the empty-grants fallback

605// that lets call sites treat "no grants" as a normal state.

606// ---------------------------------------------------------------------------

607describe("listMyExplicitGrants (US-004)", () => {

608 it("GETs /v1/files/grants with the company query param and returns grants[]", async () => {

609 const grant = {

dist/cli/share.jsView file

Lines 1081-1121javascript

1081 // check matches the walkDir gate so behavior is identical whether the

1082 // mirror is the user-supplied path or found during directory recursion.

1083 if (isEphemeralPath(path.basename(absolutePath)))

1084 continue;

1085 // existsSync follows symlinks: a dangling top-level link will report

1086 // not-existing and be skipped here. lstatSync below handles the

1087 // valid-link case directly without needing the existsSync gate.

scripts/vault-rescue.shView file

•path = scripts/vault-rescue.sh kind = build_helper sizeBytes = 10887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/vault-rescue.shView on unpkg

src/vault-client.test.tsView file

Lines 731-781typescript

731 { uid: "prs_z", slug: "z", type: "person", status: "active" } as EntityInfo,

732 { uid: "prs_a", slug: "a", type: "person", status: "active" }

Source & flagged code

11 flagged · loading source

dist/vault-client.test.jsView file

564patternName = aws_access_key severity = critical line = 564 matchedText = accessKe...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/vault-client.test.jsView on unpkg · L564

564patternName = aws_access_key severity = critical line = 564 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L564

571patternName = aws_access_key severity = critical line = 571 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L571

582patternName = aws_access_key severity = critical line = 582 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L582

589patternName = aws_access_key severity = critical line = 589 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L589

dist/cli/share.jsView file

1101// target lives outside the company folder (e.g. companies/{co}/ L1102: // knowledge → repos/private/knowledge-{co}/) — the LINK itself is L1103: // inside the company folder and is exactly what we want to record, ... L1369: function isBulkAsymmetryOverride() { L1370: const v = (process.env.HQ_SYNC_DELETE_BULK_OVERRIDE ?? "").toLowerCase(); L1371: return v === "1" || v === "true" || v === "yes";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/share.jsView on unpkg · L1101

scripts/vault-rescue.shView file

•path = scripts/vault-rescue.sh kind = build_helper sizeBytes = 10887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/vault-rescue.shView on unpkg

src/vault-client.test.tsView file

751patternName = aws_access_key severity = critical line = 751 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L751

761patternName = aws_access_key severity = critical line = 761 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L761

775patternName = aws_access_key severity = critical line = 775 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L775

785patternName = aws_access_key severity = critical line = 785 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L785

Findings

9 Critical4 Medium6 Low

CriticalCritical Secretdist/vault-client.test.js

CriticalSecret Patterndist/vault-client.test.js

CriticalSecret Patternsrc/vault-client.test.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/vault-rescue.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli/share.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

dist/vault-client.test.jsView file

Lines 544-609javascript

544 expect(pickCanonicalPersonEntity(list)?.uid).toBe("prs_a");

545 // Both undefined: uid tiebreak

546 const bothUndefined = [

547 { uid: "prs_z", slug: "z", type: "person", status: "active" },

548 { uid: "prs_a", slug: "a", type: "person", status: "active" },

549 ];

550 expect(pickCanonicalPersonEntity(bothUndefined)?.uid).toBe("prs_a");

551 });

552 it("pickCanonicalPersonEntity_filters_out_non_person_types", () => {

553 const mixed = [

554 { uid: "cmp_x", slug: "x", type: "company", status: "active", createdAt: "2025-01-01T00:00:00Z" },

555 { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-02T00:00:00Z" },

556 ];

557 const result = pickCanonicalPersonEntity(mixed);

558 expect(result?.uid).toBe("prs_b");

559 expect(result?.type).toBe("person");

560 });

561 it("sts.vend roundtrips POST /sts/vend with companyUid", async () => {

562 fetchSpy.mockResolvedValueOnce(jsonResponse(200, {

563 credentials: {

564 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/vault-client.test.jsView on unpkg · L564

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L564

565 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

566 sessionToken: "FwoGZXIvYXdzEBY...",

567 },

568 expiresAt: "2026-01-01T01:00:00.000Z",

569 }));

570 const result = await client.sts.vend({ companyUid: "cmp_x" });

571 expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L571

572 expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");

573 expect(typeof result.expiresAt).toBe("string");

574 const [url, init] = fetchSpy.mock.calls[0];

575 expect(url).toBe("https://vault.test.example.com/sts/vend");

576 expect(init.method.toUpperCase()).toBe("POST");

577 expect(JSON.parse(init.body)).toEqual({ companyUid: "cmp_x" });

578 });

579 it("vendSelf_roundtrip", async () => {

580 fetchSpy.mockResolvedValueOnce(jsonResponse(200, {

581 credentials: {

582 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L582

583 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

584 sessionToken: "FwoGZXIvYXdzEBY...",

585 },

586 expiresAt: "2026-01-01T01:00:00.000Z",

587 }));

588 const result = await client.sts.vendSelf({ personUid: "prs_x" });

589 expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L589

590 expect(result.credentials.secretAccessKey).toBe("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");

591 expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");

592 expect(typeof result.expiresAt).toBe("string");

593 const [url, init] = fetchSpy.mock.calls[0];

594 expect(url).toBe("https://vault.test.example.com/sts/vend-self");

595 expect(init.method.toUpperCase()).toBe("POST");

596 expect(JSON.parse(init.body)).toEqual({ personUid: "prs_x" });

597 });

598});

599// ---------------------------------------------------------------------------

600// Browse-vs-sync SDK methods (US-004)

601//

602// listMyExplicitGrants, getMembershipSyncConfig, setMembershipSyncConfig

603// wrap the US-002/US-003 hq-pro endpoints. Tests assert URL shape, payload

604// shape, error mapping (401/404/network), and the empty-grants fallback

605// that lets call sites treat "no grants" as a normal state.

606// ---------------------------------------------------------------------------

607describe("listMyExplicitGrants (US-004)", () => {

608 it("GETs /v1/files/grants with the company query param and returns grants[]", async () => {

609 const grant = {

dist/cli/share.jsView file

Lines 1081-1121javascript

1081 // check matches the walkDir gate so behavior is identical whether the

1082 // mirror is the user-supplied path or found during directory recursion.

1083 if (isEphemeralPath(path.basename(absolutePath)))

1084 continue;

1085 // existsSync follows symlinks: a dangling top-level link will report

1086 // not-existing and be skipped here. lstatSync below handles the

1087 // valid-link case directly without needing the existsSync gate.

scripts/vault-rescue.shView file

•path = scripts/vault-rescue.sh kind = build_helper sizeBytes = 10887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/vault-rescue.shView on unpkg

src/vault-client.test.tsView file

Lines 731-781typescript

731 { uid: "prs_z", slug: "z", type: "person", status: "active" } as EntityInfo,

732 { uid: "prs_a", slug: "a", type: "person", status: "active" }