registry / @jskit-ai/auth-provider-local-core / 0.1.3

@jskit-ai/auth-provider-local-core@0.1.3

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Runtime behavior is a local authentication provider with optional SMTP password recovery and file-backed auth state.

Static reason

One or more suspicious static signals were detected.

Trigger

Application registers/boots AuthLocalServiceProvider or calls exported auth service methods.

Impact

Creates local auth secrets/state and sends recovery links only through configured application SMTP.

Mechanism

local auth state management and optional configured SMTP email

Rationale

Static source inspection shows an auth provider whose env access, token strings, local file writes, and SMTP use are package-aligned and user/runtime configured. The descriptor lists setup mutations, but there are no install-time hooks or unconsented broad control-surface writes in the package source.

Evidence

package.jsonpackage.descriptor.mjssrc/server/providers/AuthLocalServiceProvider.jssrc/server/lib/service.jssrc/server/lib/fileBackend.jssrc/server/lib/tokens.jssrc/server/lib/passwords.js.jskit/auth/session.secret.jskit/auth/users.passwd.jskit/auth/sessions.passwd.jskit/auth/recovery.passwd.jskit/auth/store.lock.jskit/auth/transaction.journal

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

package.descriptor.mjs declares explicit app config mutations for .env and .gitignore, but no npm lifecycle hook applies them automatically.
src/server/providers/AuthLocalServiceProvider.js reads process.env and can create .jskit/auth/session.secret at provider boot when selected.
src/server/lib/service.js can send password recovery email through configured SMTP.

Evidence against

package.json has no preinstall/install/postinstall hooks and only exports server provider/lib entrypoints.
src/server/lib/service.js implements local auth flows: register, login, sessions, password reset, cookies, and SMTP recovery.
src/server/lib/fileBackend.js writes only configured local auth store files users.passwd, sessions.passwd, recovery.passwd, lock, and journal.
No child_process, eval, remote payload loading, credential harvesting, or hardcoded exfiltration endpoint found.
Network use is nodemailer to user-configured SMTP, package-aligned for password recovery.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 8 file(s), 48.9 KB of source

Source & flagged code

19 flagged

src/server/lib/service.jsView file

Lines 128-168javascript

128function buildSessionPayload({ user, session, refreshToken, secret }) {

129 const accessToken = buildAccessToken({ user, session, secret });

130 return {

131 access_token: accessToken,

132 refresh_token: refreshToken,

133 expires_in: ACCESS_TTL_SECONDS,

134 token_type: "bearer",

135 purpose: session.purpose || "normal"

136 };

137}

138

139function validatePasswordInput(password) {

140 const normalizedPassword = String(password || "");

141 if (

142 normalizedPassword.length < AUTH_PASSWORD_MIN_LENGTH ||

143 normalizedPassword.length > AUTH_PASSWORD_MAX_LENGTH

144 ) {

145 throw new AppError(400, "Password must be at least 8 characters.", {

146 details: {

147 fieldErrors: {

148 password: "Password must be at least 8 characters."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/service.jsView on unpkg · L148

149 }

150 }

151 });

152 }

153}

154

155function validateEmailInput(email) {

156 const normalized = normalizeEmail(email);

157 if (!normalized || !normalized.includes("@")) {

158 throw new AppError(400, "Enter a valid email address.", {

159 details: {

160 fieldErrors: {

161 email: "Enter a valid email address."

162 }

163 }

164 });

165 }

166 return normalized;

167}

168

test/providerRuntime.test.jsView file

Lines 86-126javascript

86 AuthProviderServiceProvider,

87 AuthActionsServiceProvider

88 ]

89 });

90 return {

91 app,

92 storeDir

93 };

94}

96test("local auth provider registers, logs in, reads session, and logs out with file backend", async

Source & flagged code

19 flagged · loading source

src/server/lib/service.jsView file

148patternName = generic_password severity = medium line = 148 matchedText = password...rs."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/service.jsView on unpkg · L148

test/providerRuntime.test.jsView file

106patternName = generic_password severity = medium line = 106 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L106

167patternName = generic_password severity = medium line = 167 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L167

173patternName = generic_password severity = medium line = 173 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L173

260patternName = generic_password severity = medium line = 260 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L260

347patternName = generic_password severity = medium line = 347 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L347

353patternName = generic_password severity = medium line = 353 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L353

370patternName = generic_password severity = medium line = 370 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L370

383patternName = generic_password severity = medium line = 383 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L383

415patternName = generic_password severity = medium line = 415 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L415

423patternName = generic_password severity = medium line = 423 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L423

429patternName = generic_password severity = medium line = 429 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L429

439patternName = generic_password severity = medium line = 439 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L439

464patternName = generic_password severity = medium line = 464 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L464

483patternName = generic_password severity = medium line = 483 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L483

513patternName = generic_password severity = medium line = 513 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L513

519patternName = generic_password severity = medium line = 519 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L519

551patternName = generic_password severity = medium line = 551 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L551

579patternName = generic_password severity = medium line = 579 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L579

Findings

20 Medium4 Low

MediumSecret Patternsrc/server/lib/service.js

MediumEnvironment Vars

MediumSecret Patterntest/providerRuntime.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Lines 327-390javascript

327 if (record?.algorithm === "legacy-bcrypt") {

328 return record.hash === password;

329 }

330 return record?.algorithm === "test-scrypt" && record.hash === `hashed-${password}`;

331 }

332 };

333 const authService = createLocalAuthService({

334 backend,

335 passwordStrategy,

336 config: {

337 nodeEnv: "test",

338 sessionSecret: "test-secret",

339 appPublicUrl: "http://localhost:5173",

340 smtpConfigured: false,

341 recoveryDevOutput: "disabled"

342 }

343 });

344

345 const legacyLogin = await authService.login({

346 email: "legacy@example.com",

347 password: "legacy password value"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L347

348 });

349 assert.equal(legacyLogin.actor.email, "legacy@example.com");

350

351 await authService.register({

352 email: "new-strategy@example.com",

353 password: "new password value",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L353

354 displayName: "New Strategy"

355 });

356 assert.deepEqual(usersByEmail.get("new-strategy@example.com").password, {

357 algorithm: "test-scrypt",

358 version: "v1",

359 salt: "test",

360 hash: "hashed-new password value"

361 });

362 assert.equal(sessions.length, 2);

363});

364

365test("local auth provider completes recovery through a recovery-scoped session", async () => {

366 const { app } = await createStartedApp();

367 const authService = app.make("authService");

368 const registered = await authService.register({

369 email: "grace@example.com",

370 password: "old password value",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L370

371 displayName: "Grace"

372 });

373 const normalReply = createReplyFixture();

374 authService.writeSessionCookies(normalReply, registered.session);

375

376 await assert.rejects(

377 () =>

378 authService.resetPassword(

379 {

380 cookies: normalReply.cookies

381 },

382 {

383 password: "bypassed password value"

384 }

385 ),

386 /Authentication required/

387 );

388

389 const resetRequest = await authService.requestPasswordReset({

390 email: "grace@example.com"