registry / @jsm-mit/sultana-core-motoko-package / 0.0.5

@jsm-mit/sultana-core-motoko-package@0.0.5

A TypeScript library for interacting with the Sultana Core Motoko actor on the Internet Computer (IC) platform.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 156 KB of source, external domains: icp0.io

Source & flagged code

5 flagged

README.mdView file

Lines 14-66markdown

14dfx identity new worker1

15dfx identity new customer1

16```

18### 2. Export PEM values

20Export the PEM for each identity and copy the output:

22```bash

23dfx identity export superadmin

24dfx identity export owner1

25dfx identity export worker1

26dfx identity export customer1

27```

29### 3. Configure .env

31Paste each PEM value into the corresponding variable in your `.env` file:

33```env

34IDENTITY_PEM="-----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

README.mdView on unpkg · L34

Critical

Secret Pattern

EC private key in README.md

README.mdView on unpkg · L34

35...superadmin PEM here...

36-----END EC PRIVATE KEY-----"

38OWNER1_PEM="-----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in README.md

README.mdView on unpkg · L38

39...owner1 PEM here...

40-----END EC PRIVATE KEY-----"

42WORKER1_PEM="-----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in README.md

README.mdView on unpkg · L42

43...worker1 PEM here...

44-----END EC PRIVATE KEY-----"

46CUSTOMER1_PEM="-----BEGIN EC PRIVATE KEY-----

Critical

Secret Pattern

EC private key in README.md

README.mdView on unpkg · L46

47...customer1 PEM here...

48-----END EC PRIVATE KEY-----"

49```

51> Make sure to keep newlines inside the PEM value — wrap the value in double quotes and preserve the line breaks exactly as exported.

53## Tests

55Tests live in `sandbox/tests/` and are integration tests that run against a dedicated test canister on **mainnet** — no local replica is used. They cover only the `sultana-core-motoko` canister; the CLI persona game, load simulation and multi-canister (assets-rust) tests live in [sultana-command-line-playground](https://github.com/JSM-Sultana/sultana-command-line-playground).

57### Prerequisites

59Complete the [Setup](#setup) section first. Then copy `.env.example` to `.env` and fill in `CANISTER_ID` and all PEM values.

61### Available test scripts

63Each script redeploys the test canister before running.

65| Script | Description |

66|---|---|

Source & flagged code

5 flagged · loading source

README.mdView file

34patternName = private_key_ec severity = critical line = 34 matchedText = IDENTITY...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code