registry / @inkbox/sdk / 0.4.18

@inkbox/sdk@0.4.18

TypeScript SDK for the Inkbox API

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 526 KB of source, external domains: inkbox.ai

Source & flagged code

4 flagged

dist/tunnels/client/_cert.jsView file

Lines 148-188javascript

148 throw new Error("private_key.pem: missing PRIVATE KEY block");

149 }

150 const der = pemBlockToDer(block);

151 // Cast to BufferSource's Uint8Array variant — Node's Buffer is

152 // assignable but lib.dom.d.ts disagrees on ArrayBufferLike vs

153 // ArrayBuffer.

154 const privateKey = await subtle.importKey("pkcs8", new Uint8Array(der), ALGORITHM, true, ["sign"]);

155 // Derive the public key from the private — JOSE jwk round-trip.

156 const jwk = await subtle.exportKey("jwk", privateKey);

157 const pubJwk = { ...jwk };

158 delete pubJwk.d;

159 pubJwk.key_ops = ["verify"];

160 const publicKey = await subtle.importKey("jwk", pubJwk, ALGORITHM, true, ["verify"]);

161 return { privateKey, publicKey, privatePem: pem };

162}

163function pkcs8ToPem(der) {

164 const b64 = der.toString("base64");

165 const lines = [];

166 for (let i = 0; i < b64.length; i += 64)

167 lines.push(b64.slice(i, i + 64));

168 return `-----BEGIN PRIVATE KEY-----\n${lines.join("\n")}\n-----END PRIVATE KEY-----\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/tunnels/client/_cert.jsView on unpkg · L168

Critical

Secret Pattern

RSA private key in dist/tunnels/client/_cert.js

dist/tunnels/client/_cert.jsView on unpkg · L168

169}

170function extractFirstPemBlock(pem, label) {

171 const begin = `-----BEGIN ${label}-----`;

172 const end = `-----END ${label}-----`;

173 const beginIdx = pem.indexOf(begin);

174 const endIdx = pem.indexOf(end);

175 if (beginIdx < 0 || endIdx < 0 || endIdx < beginIdx)

176 return null;

177 return pem.slice(beginIdx, endIdx + end.length);

178}

179function pemBlockToDer(block) {

180 const lines = block.split(/\r?\n/).filter((l) => l.length > 0 && !l.startsWith("-----"));

181 return Buffer.from(lines.join(""), "base64");

182}

183function ensureSinglePemTerminator(pem) {

184 // Strip Windows line endings, trailing whitespace, and excess

185 // newlines; ensure a single \n after the final -----END...-----.

186 let out = pem.replace(/\r\n/g, "\n").replace(/[ \t]+\n/g, "\n");

187 while (out.endsWith("\n\n"))

188 out = out.slice(0, -1);

dist/contacts/resources/vcards.jsView file

Lines 1-31javascript

1/**

2 * inkbox-contacts/resources/vcards.ts

3 *

4 * vCard import / export.

5 */

6import { parseContactImportResult, } from "../types.js";

7const BASE = "/contacts";

8const VCARD_CONTENT_TYPE =

dist/tunnels/client/_ws_passthrough.jsView file

Lines 1-23javascript

1/**

2 * inkbox-tunnels/client/_ws_passthrough.ts

3 *

4 * WebSocket support for passthrough mode.

5 *

6 * The h1 parser and h2 transcoder hand a {@link WebSocketSink} to the

7 * dispatcher when the inbound is a WS upgrade. The dispatcher completes

8 * the handshake via `accept` then bridges frames via `sendFrame` /

9 * `recvFrame`. The `bridgeWsHandlerOverSink` helper wires an

10 * `InkboxWsHandler` to one of those sinks so the same handler shape

Source & flagged code

4 flagged · loading source

dist/tunnels/client/_cert.jsView file

168patternName = private_key_rsa severity = critical line = 168 matchedText = return `...\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/tunnels/client/_cert.jsView on unpkg · L168

168patternName = private_key_rsa severity = critical line = 168 matchedText = return `...\n`;

Critical

Secret Pattern

RSA private key in dist/tunnels/client/_cert.js

dist/tunnels/client/_cert.jsView on unpkg · L168

dist/contacts/resources/vcards.jsView file

21*/ L22: async import(content, contentType = VCARD_CONTENT_TYPE) { L23: const data = await this.http.postRaw(`${BASE}/import`, content, contentType);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/contacts/resources/vcards.jsView on unpkg · L21

dist/tunnels/client/_ws_passthrough.jsView file

3* L4: * WebSocket support for passthrough mode. L5: * ... L18: .update(key + WS_GUID, "ascii") L19: .digest("base64"); L20: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tunnels/client/_ws_passthrough.jsView on unpkg · L3

Findings

2 Critical3 Medium6 Low

CriticalCritical Secretdist/tunnels/client/_cert.js

CriticalSecret Patterndist/tunnels/client/_cert.js

MediumDynamic Requiredist/contacts/resources/vcards.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/tunnels/client/_ws_passthrough.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/tunnels/client/_cert.jsView file

Lines 148-188javascript

148 throw new Error("private_key.pem: missing PRIVATE KEY block");

149 }

150 const der = pemBlockToDer(block);

151 // Cast to BufferSource's Uint8Array variant — Node's Buffer is

152 // assignable but lib.dom.d.ts disagrees on ArrayBufferLike vs

153 // ArrayBuffer.

154 const privateKey = await subtle.importKey("pkcs8", new Uint8Array(der), ALGORITHM, true, ["sign"]);

155 // Derive the public key from the private — JOSE jwk round-trip.

156 const jwk = await subtle.exportKey("jwk", privateKey);

157 const pubJwk = { ...jwk };

158 delete pubJwk.d;

159 pubJwk.key_ops = ["verify"];

160 const publicKey = await subtle.importKey("jwk", pubJwk, ALGORITHM, true, ["verify"]);

161 return { privateKey, publicKey, privatePem: pem };

162}

163function pkcs8ToPem(der) {

164 const b64 = der.toString("base64");

165 const lines = [];

166 for (let i = 0; i < b64.length; i += 64)

167 lines.push(b64.slice(i, i + 64));

168 return `-----BEGIN PRIVATE KEY-----\n${lines.join("\n")}\n-----END PRIVATE KEY-----\n`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/tunnels/client/_cert.jsView on unpkg · L168

Critical

Secret Pattern

RSA private key in dist/tunnels/client/_cert.js

dist/tunnels/client/_cert.jsView on unpkg · L168

169}

170function extractFirstPemBlock(pem, label) {

171 const begin = `-----BEGIN ${label}-----`;

172 const end = `-----END ${label}-----`;

173 const beginIdx = pem.indexOf(begin);

174 const endIdx = pem.indexOf(end);

175 if (beginIdx < 0 || endIdx < 0 || endIdx < beginIdx)

176 return null;

177 return pem.slice(beginIdx, endIdx + end.length);

178}

179function pemBlockToDer(block) {

180 const lines = block.split(/\r?\n/).filter((l) => l.length > 0 && !l.startsWith("-----"));

181 return Buffer.from(lines.join(""), "base64");

182}

183function ensureSinglePemTerminator(pem) {

184 // Strip Windows line endings, trailing whitespace, and excess

185 // newlines; ensure a single \n after the final -----END...-----.

186 let out = pem.replace(/\r\n/g, "\n").replace(/[ \t]+\n/g, "\n");

187 while (out.endsWith("\n\n"))

188 out = out.slice(0, -1);

dist/contacts/resources/vcards.jsView file

Lines 1-31javascript

1/**

2 * inkbox-contacts/resources/vcards.ts

3 *

4 * vCard import / export.

5 */

6import { parseContactImportResult, } from "../types.js";

7const BASE = "/contacts";

8const VCARD_CONTENT_TYPE =

dist/tunnels/client/_ws_passthrough.jsView file

Lines 1-23javascript

1/**

2 * inkbox-tunnels/client/_ws_passthrough.ts

3 *

4 * WebSocket support for passthrough mode.

5 *

6 * The h1 parser and h2 transcoder hand a {@link WebSocketSink} to the

7 * dispatcher when the inbound is a WS upgrade. The dispatcher completes

8 * the handshake via `accept` then bridges frames via `sendFrame` /

9 * `recvFrame`. The `bridgeWsHandlerOverSink` helper wires an

10 * `InkboxWsHandler` to one of those sinks so the same handler shape