registry / @indigoai-us/hq-cloud / 6.14.6

@indigoai-us/hq-cloud@6.14.6

HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 277 file(s), 4.89 MB of source, external domains: api.example.com, cognito-idp.eu-west-1.amazonaws.com, cognito-idp.us-east-1.amazonaws.com, example.com, github.com, hqapi.hq.computer, s3.test, signed.example, sqs.local, sqs.us-east-1.amazonaws.com, vault-api.example.com, vault-api.test, vault.test, vault.test.example.com

Source & flagged code

12 flagged

dist/vault-client.test.jsView file

Lines 573-638javascript

573 expect(pickCanonicalPersonEntity(list)?.uid).toBe("prs_a");

574 // Both undefined: uid tiebreak

575 const bothUndefined = [

576 { uid: "prs_z", slug: "z", type: "person", status: "active"

Source & flagged code

12 flagged · loading source

dist/vault-client.test.jsView file

593patternName = aws_access_key severity = critical line = 593 matchedText = accessKe...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/vault-client.test.jsView on unpkg · L593

593patternName = aws_access_key severity = critical line = 593 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L593

600patternName = aws_access_key severity = critical line = 600 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L600

611patternName = aws_access_key severity = critical line = 611 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L611

618patternName = aws_access_key severity = critical line = 618 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in dist/vault-client.test.js

dist/vault-client.test.jsView on unpkg · L618

dist/lib/machine-id.jsView file

23* Resolution order (first hit wins, every miss falls through): L24: * 1. `process.env.HQ_MACHINE_ID` — explicit override for CI / tests. L25: * 2. `<hqRoot>/.hq/machine-id` — source-of-truth on the host. ... L42: * load) so tests overriding `HOME` post-import see the right file. Going L43: * through `os.homedir()` rather than `process.env.HOME` keeps the Windows L44: * USERPROFILE fallback intact. ... L75: const raw = fs.readFileSync(menubarJsonPath(), "utf-8"); L76: const parsed = JSON.parse(raw); L77: if (typeof parsed.machineId === "string" && parsed.machineId.length > 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/machine-id.jsView on unpkg · L23

scripts/vault-rescue.shView file

•path = scripts/vault-rescue.sh kind = build_helper sizeBytes = 10887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/vault-rescue.shView on unpkg

dist/cli/rescue-core.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @indigoai-us/hq-cloud@6.14.1 matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsb3Vk:6.14.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/rescue-core.jsView on unpkg

src/vault-client.test.tsView file

786patternName = aws_access_key severity = critical line = 786 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L786

796patternName = aws_access_key severity = critical line = 796 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L796

810patternName = aws_access_key severity = critical line = 810 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L810

820patternName = aws_access_key severity = critical line = 820 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L820

Findings

9 Critical1 High4 Medium6 Low

CriticalCritical Secretdist/vault-client.test.js

CriticalSecret Patterndist/vault-client.test.js

CriticalSecret Patternsrc/vault-client.test.ts

HighPrevious Version Dangerous Deltadist/cli/rescue-core.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/vault-rescue.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/lib/machine-id.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/lib/machine-id.jsView file

Lines 3-43javascript

3 * conflict mirrors, telemetry rows, and `.hq-conflicts/index.json` entries.

4 *

5 * Historically the menubar app (`indigoai-us/hq-sync`) was the sole writer

6 * of `machineId` via `~/.hq/menubar.json`, and every other sync caller

7 * best-effort read from there. That arrangement is backwards: hq-cloud is

8 * the engine that runs on every sync host (macOS-with-menubar, macOS CLI,

9 * Linux HQ Pro Outposts, future Windows), while the menubar is an optional

10 * macOS-only UI. Linux outposts therefore had no menubar.json, so

11 * `readShortMachineId()` returned the literal string `"unknown"` and

12 * every conflict file on those hosts was tagged `-unknown` (which then

13 * also slipped past `EPHEMERAL_PATH_PATTERN` in `src/cli/share.ts` — see

14 * Fix 2 — and rode S3 round-trips as a regular file).

15 *

16 * This module flips ownership: hq-cloud provisions a UUID on first call

17 * and persists it to `<hqRoot>/.hq/machine-id` (one line, plain text).

18 * Every subsequent call hits the persisted file. Existing macOS installs

19 * with menubar-written IDs are migrated forward on first call: tier 3

20 * picks up the menubar.json value, writes it to `<hqRoot>/.hq/machine-id`,

21 * and returns it — so the id is stable across the migration window.

22 *

23 * Resolution order (first hit wins, every miss falls through):

24 * 1. `process.env.HQ_MACHINE_ID` — explicit override for CI / tests.

25 * 2. `<hqRoot>/.hq/machine-id` — source-of-truth on the host.

26 * 3. `~/.hq/menubar.json` `machineId` field — back-compat for existing

27 * macOS installs; migrated forward to tier 2 on first read.

28 * 4. Autogen — write a fresh UUID to `<hqRoot>/.hq/machine-id` and return.

29 *

30 * Concurrent autogen race is benign: two writers each pick a fresh UUID,

31 * last-writer-wins on disk, both processes re-read the now-stable file on

32 * their next call. The window is narrow (single sync run startup) and the

33 * downside (one extra conflict-file rename across a single race window) is

34 * trivial compared to the litter-ratchet bug it replaces.

35 */

36import { createHash, randomUUID } from "node:crypto";

37import * as fs from "node:fs";

38import * as os from "node:os";

39import * as path from "node:path";

40/**

41 * Path to `~/.hq/menubar.json`. Evaluated lazily at call time (not module

42 * load) so tests overriding `HOME` post-import see the right file. Going

43 * through `os.homedir()` rather than `process.env.HOME` keeps the Windows

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/machine-id.jsView on unpkg · L23

src/vault-client.test.tsView file

Lines 766-816typescript

766 { uid: "prs_z", slug: "z", type: "person", status: "active" } as EntityInfo,

767 { uid: "prs_a", slug: "a", type: "person", status: "active" } as EntityInfo,

768 ];

769 expect(pickCanonicalPersonEntity(bothUndefined)?.uid).toBe("prs_a");

770 });

771

772 it("pickCanonicalPersonEntity_filters_out_non_person_types", () => {

773 const mixed: EntityInfo[] = [

774 { uid: "cmp_x", slug: "x", type: "company", status: "active", createdAt: "2025-01-01T00:00:00Z" } as EntityInfo,

775 { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-02T00:00:00Z" } as EntityInfo,

776 ];

777 const result = pickCanonicalPersonEntity(mixed);

778 expect(result?.uid).toBe("prs_b");

779 expect(result?.type).toBe("person");

780 });

781

782 it("sts.vend roundtrips POST /sts/vend with companyUid", async () => {

783 fetchSpy.mockResolvedValueOnce(

784 jsonResponse(200, {

785 credentials: {

786 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L786

787 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

788 sessionToken: "FwoGZXIvYXdzEBY...",

789 },

790 expiresAt: "2026-01-01T01:00:00.000Z",

791 }),

792 );

793

794 const result = await client.sts.vend({ companyUid: "cmp_x" });

795

796 expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L796

797 expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");

798 expect(typeof result.expiresAt).toBe("string");

799

800 const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];

801 expect(url).toBe("https://vault.test.example.com/sts/vend");

802 expect((init.method as string).toUpperCase()).toBe("POST");

803 expect(JSON.parse(init.body as string)).toEqual({ companyUid: "cmp_x" });

804 });

805

806 it("vendSelf_roundtrip", async () => {

807 fetchSpy.mockResolvedValueOnce(

808 jsonResponse(200, {

809 credentials: {

810 accessKeyId: "AKIAIOSFODNN7EXAMPLE",

811 secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

812 sessionToken: "FwoGZXIvYXdzEBY...",

813 },

814 expiresAt: "2026-01-01T01:00:00.000Z",

815 }),

816 );

810patternName = aws_access_key severity = critical line = 810 matchedText = accessKe...LE",

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L810

820patternName = aws_access_key severity = critical line = 820 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in src/vault-client.test.ts

src/vault-client.test.tsView on unpkg · L820