registry / @keycardai/oauth / 0.20.0

@keycardai/oauth@0.20.0

[Preview] OAuth 2.0 primitives for Keycard: JWKS keyring, JWT signing/verification, server-tier token verifier, AccessContext, ClientSecret credentials, and impersonation via RFC 8693 token exchange

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 257 KB of source, external domains: metadata.google.internal

Source & flagged code

1 flagged

dist/esm/server/workloadIdentity.jsView file

Lines 1-21javascript

1var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {

2 if (kind === "m") throw new TypeError("Private method is not writable");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/server/workloadIdentity.jsView on unpkg · L1

3 if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");

4 if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");

5 return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;

6};

7var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {

8 if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");

9 if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");

10 return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);

11};

12var _FileTokenSource_tokenFilePath, _GCPMetadataTokenSource_audience, _GCPMetadataTokenSource_metadataUrl, _GCPMetadataTokenSource_timeoutMs, _FlyTokenSource_audience, _FlyTokenSource_socketPath, _WorkloadIdentity_instances, _WorkloadIdentity_source, _WorkloadIdentity_clientId, _WorkloadIdentity_fetchIdentityToken;

13import * as fs from "node:fs";

14/**

15 * Source identifiers carried on WorkloadIdentityConfigurationError and

16 * WorkloadIdentityRuntimeError, for branching on which token source failed.

17 */

18export const WORKLOAD_IDENTITY_SOURCE_FILE = "file";

19export const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";

20export const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";

21export const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";

Source & flagged code

1 flagged · loading source

dist/esm/server/workloadIdentity.jsView file

1var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) { L2: if (kind === "m") throw new TypeError("Private method is not writable"); ... L70: : discoveryEnvVars; L71: const found = envNames.find((name) => process.env[name]); L72: if (!found || !process.env[found]) { ... L121: _FileTokenSource_tokenFilePath = new WeakMap(); L122: const DEFAULT_GCP_METADATA_URL = "http://metadata.google.internal"; L123: const DEFAULT_GCP_TIMEOUT_MS = 5000; ... L153: }); L154: body = await response.text(); L155: } ... L231: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/server/workloadIdentity.jsView on unpkg · L1

Findings

1 High3 Medium4 Low

HighCloud Metadata Accessdist/esm/server/workloadIdentity.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/esm/server/workloadIdentity.jsView file

Lines 1-21javascript

1var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {

2 if (kind === "m") throw new TypeError("Private method is not writable");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/server/workloadIdentity.jsView on unpkg · L1

3 if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");

4 if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");

5 return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;

6};

7var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {

8 if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");

9 if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");

10 return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);

11};

13import * as fs from "node:fs";

14/**

15 * Source identifiers carried on WorkloadIdentityConfigurationError and

16 * WorkloadIdentityRuntimeError, for branching on which token source failed.

17 */

18export const WORKLOAD_IDENTITY_SOURCE_FILE = "file";

19export const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";

20export const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";

21export const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";