registry / @itentialopensource/adapter-thales_cipher_trust_manager / 1.0.6

@itentialopensource/adapter-thales_cipher_trust_manager@1.0.6

This adapter integrates with system described as: ciphertrustManagerApi.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 398 KB of source, external domains: adapters.itential.io, registry.npmjs.org

Oversized source lightweight scan

adapter.js7.18 MB file, sampled 256 KB

DynamicRequireHighEntropyStrings

Source & flagged code

13 flagged

package.jsonView file

Lines 1-31json

2 "name": "@itentialopensource/adapter-thales_cipher_trust_manager",

3 "version": "1.0.6",

4 "description": "This adapter integrates with system described as: ciphertrustManagerApi.",

5 "main": "adapter.js",

6 "systemName"

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.preinstall = node utils/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView file

12patternName = private_key_rsa severity = critical line = 12 matchedText = "materia...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView on unpkg · L12

12patternName = private_key_rsa severity = critical line = 12 matchedText = "materia...--",

Critical

Secret Pattern

RSA private key in entities/Keys/mockdatafiles/postVaultKeys2idExport-default.json

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView on unpkg · L12

utils/checkMigrate.jsView file

11L12: const { execSync } = require('child_process'); L13: const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

utils/checkMigrate.jsView on unpkg · L11

utils/pre-commit.shView file

•path = utils/pre-commit.sh kind = build_helper sizeBytes = 824 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utils/pre-commit.shView on unpkg

test/integration/adapterTestIntegration.jsView file

•path = [redacted].js kind = payload_in_excluded_dir sizeBytes = 2154567 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/adapterTestIntegration.jsView on unpkg

adapter.jsView file

•path = adapter.js kind = oversized_source_file sizeBytes = 7524065 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

adapter.jsView on unpkg

test/unit/adapterTestUnit.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = // samPr...rd';

Medium

Secret Pattern

Hardcoded password in test/unit/adapterTestUnit.js

test/unit/adapterTestUnit.jsView on unpkg · L43

test/unit/adapterBaseTestUnit.jsView file

30patternName = generic_password severity = medium line = 30 matchedText = const pa...rd';

Medium

Secret Pattern

Hardcoded password in test/unit/adapterBaseTestUnit.js

test/unit/adapterBaseTestUnit.jsView on unpkg · L30

utils/testRunner.jsView file

19patternName = generic_password severity = medium line = 19 matchedText = let pass...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L19

29patternName = generic_password severity = medium line = 29 matchedText = const dp...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L29

89patternName = generic_password severity = medium line = 89 matchedText = intTest ...;`);

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L89

entities/CertificateAuthority/mockdatafiles/postCaCsr-default.jsonView file

3patternName = private_key_ec severity = critical line = 3 matchedText = "key": "...---"

Critical

Secret Pattern

EC private key in entities/CertificateAuthority/mockdatafiles/postCaCsr-default.json

entities/CertificateAuthority/mockdatafiles/postCaCsr-default.jsonView on unpkg · L3

Findings

3 Critical3 High10 Medium4 Low

CriticalCritical Secretentities/Keys/mockdatafiles/postVaultKeys2idExport-default.json

CriticalSecret Patternentities/Keys/mockdatafiles/postVaultKeys2idExport-default.json

CriticalSecret Patternentities/CertificateAuthority/mockdatafiles/postCaCsr-default.json

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtest/integration/adapterTestIntegration.js

HighOversized Source Fileadapter.js

MediumDynamic Requireutils/checkMigrate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperutils/pre-commit.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/unit/adapterTestUnit.js

MediumSecret Patterntest/unit/adapterBaseTestUnit.js

MediumSecret Patternutils/testRunner.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView file

Lines 1-29json

2 "resources": [

3 {

4 "id": "13097490-acc2-491c-9d3a-b7fbb699961e",

5 "uri": "kylo:kylo:vault:keys:sample-rsa-key-v1",

6 "account": "kylo:kylo:admin:accounts:kylo",

7 "application": "ncryptify:gemalto:admin:apps:kylo",

8 "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",

9 "createdAt": "2016-12-02T21:37:24.597165Z",

10 "name": "sample RSA key",

11 "updatedAt": "2016-12-02T21:37:24.597165Z",

12 "material": "-----BEGIN PRIVATE KEY-----\nMIICdAIBADALBgkqhkiG9w0BAQEEggJgMIICXAIBAAKBgQDQSuQFFeK1fQBljzL/\nR+zCJc5X3ToLDmD4dQ8Cn+kU21ekjNhtfFoJVSY97ZRh7PzIpMNdYZ+8Ye3nkUWv\nALFmDMIgNAw9nUkDgmh1QtJj9I9zntudLXWjRUSUuzJ2JCNngKY403mphZXmBaGD\n/Zn3hdu1C4qyM+IiblGDnKjCmwIDAQABAoGAEsout6a5xNV56693UkASw5DVhGeY\njNbHOKKWsA3s4MzIozdxbq8BEEZ2JLAB6rOOOiti1FGyLzRGWdVpC9hsKDbcYwR6\nUzgPZHuwQXYFF2oMzs4BNNanaBZXudmQW7l+G2Ek4TsU3sSHT/5WIxq5NZskfnyC\nItWDv+Z+5LTf0MECQQDwV3ruOR3wXjl6G0nT5neRgc2Je0kuW5P0ZXb4Lsg08T+p\nxbvtQkyWhoGHxHG3GibKZhqxPyr6o4ibXVWva/TtAkEA3dzhguidUgsnxvhr8OO4\ndkUJup2FMX6TDPuDjTl9s+E6 ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView on unpkg · L12

13 "usageMask": 12,

14 "meta": "Object",

15 "myTag": "myValue",

16 "version": 1,

17 "algorithm": "RSA",

18 "size": 1024,

19 "unexportable": false,

20 "undeletable": false,

21 "publickey": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQSuQFFeK1fQBljzL/R+zCJc5X\n3ToLDmD4dQ8Cn+kU21ekjNhtfFoJVSY97ZRh7PzIpMNdYZ+8Ye3nkUWvALFmDMIg\nNAw9nUkDgmh1QtJj9I9zntudLXWjRUSUuzJ2JCNngKY

22 "uuid": "75f471a8-970a-4998-a05e-adfb9ec44dbf",

23 "labels": {

24 "region": "noram",

25 "team": "sales"

26 }

27 }

28 ]

29}

Long lines were clipped for display.

12patternName = private_key_rsa severity = critical line = 12 matchedText = "materia...--",

Critical

Secret Pattern

RSA private key in entities/Keys/mockdatafiles/postVaultKeys2idExport-default.json

entities/Keys/mockdatafiles/postVaultKeys2idExport-default.jsonView on unpkg · L12

utils/checkMigrate.jsView file

Lines 1-31javascript

1/* @copyright Itential, LLC 2025 */

3/**

4 * This script will determine if the adapter needs to be upgraded, a migration is needed or

5 * a remediation is needed. This is self contained and depends on accessing GitLab repos as well as

6 * finding files within the adapter to gather and compare information.

7 *

8 * This utility is executed from a script in the package.json by `npm run adapter:checkMigrate`. As a result,

9 * this utility is exposed and available to customers but exclusively through the CLI.

10 */

12const { execSync } = require('child_process');

13const semver = require('semver');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

utils/checkMigrate.jsView on unpkg · L11

14const packageJson = require('../package.json');

15const { get } = require('./tbUtils');

17const localAdaptVer = packageJson.version;

18const localEngineVer = packageJson.engineVersion;

19const localUtils = execSync('npm list @itentialopensource/adapter-utils', { encoding: 'utf-8' });

20const localUtilsVer = localUtils.split('@').pop().replace(/(\r\n|\n|\r| )/gm, '');

22/**

23 * @summary Checks if adapter is the latest version

24 *

25 * @function updateNeeded

26 */

27async function updateNeeded() {

28 const adapterUrl = `https://registry.npmjs.org/${packageJson.name}`;

29 const latestAdapterVer = (await get(adapterUrl)).data['dist-tags'].latest;

30 console.log('\n[Upgrade Check]');

31 console.log(`Local Adapter Version : ${localAdaptVer}`);

test/unit/adapterBaseTestUnit.jsView file

Lines 10-50javascript

10const mocha = require('mocha');

11const winston = require('winston');

12const { expect } = require('chai');

13const { use } = require('chai');

14const td = require('testdouble');

15const entitiesToDB = require('../../utils/entitiesToDB');

16const troubleshootingAdapter = require('../../utils/troubleshootingAdapter');

17const log = require('../../utils/logger');

19const anything = td.matchers.anything();

21// stub and attemptTimeout are used throughout the code so set them here

22const stub = true;

23const isRapidFail = false;

24const attemptTimeout = 120000;

26// these variables can be changed to run in integrated mode so easier to set them here

27// always check these in with bogus data!!!

28const host = 'replace.hostorip.here';

29const username = 'username';

30const password = 'password';

Medium

Secret Pattern

Hardcoded password in test/unit/adapterBaseTestUnit.js

test/unit/adapterBaseTestUnit.jsView on unpkg · L30

31const protocol = 'http';

32const port = 80;

33const sslenable = false;

34const sslinvalid = false;

36// these are the adapter properties. You generally should not need to alter

37// any of these after they are initially set up

38global.pronghornProps = {

39 pathProps: {

40 encrypted: false

41 },

42 adapterProps: {

43 adapters: [{

44 id: 'Test-Base',

45 type: 'ABase',

46 properties: {

47 host,

48 port,

49 base_path: '/',

50 version: '',

utils/testRunner.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2/* @copyright Itential, LLC 2019 */

4const execute = require('child_process').exec;

5const fs = require('fs-extra');

6const rl = require('readline-sync');

8/**

9 * This script will determine the type of integration test to run

10 * based on input. If other information is needed, it will solicit

11 * that input and then edit the integration test accordingly.

12 */

14let stub = true;

15let isRapidFail = false;

16let isSaveMockData = false;

17let host = 'replace.hostorip.here';

18let username = 'username';

19let password = 'password';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L19

20let protocol = 'http';

21let port = 80;

22let sslenable = false;

23let sslinvalid = false;

24const dstub = true;

25const disRapidFail = false;

26const disSaveMockData = false;

27const dhost = 'replace.hostorip.here';

28const dusername = 'username';

29const dpassword = 'password';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L29

30const dprotocol = 'http';

31const dport = 80;

32const dsslenable = false;

33const dsslinvalid = false;

35let stderror = false;

36let running = false;

38/**

39 * Updates the integration test file with the proper vars

40 */

41function replaceTestVars(test) {

42 if (!fs.existsSync(test)) {

43 console.log(`Could not find ${test}`);

44 return 'error';

45 }

47 let intTest = fs.readFileSync(test, 'utf8');

49 // replace stub variable but check if it exists first

Lines 69-109javascript

69 if (sindex > -1) {

70 intTest = intTest.replace(replStr, `const isSaveMockData = ${isSaveMockData};`);

71 }

73 // replace host variable

74 sindex = intTest.indexOf('samProps.host');

75 eindex = intTest.indexOf(';'