registry / @learncard/network-brain-service / 3.16.10

@learncard/network-brain-service@3.16.10

This service exposes the LearnCard Network API and local Neo4j-backed skills flows.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 285 file(s), 1.97 MB of source, external domains: cdn.filestackcontent.com, cdn.jsdelivr.net, ctx.learncard.com, docs.learncard.com, dogs.are.great, fonts.googleapis.com, fonts.gstatic.com, my.smartresume.com, mystage.smartresume.com, network.learncard.com, opensalt.net, placehold.co, purl.imsglobal.org, registries.learncard.com, staging.opensalt.net, trpc.io, us.i.posthog.com, w3id.org, www.example.com, www.learncard.com, www.w3.org

Oversized source lightweight scan

dist/index.js91.4 MB file, sampled 256 KB

ChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsUrlStringsdogs.are.greattrpc.iowww.example.com

Source & flagged code

5 flagged

src/seed/seedSkillFrameworks.tsView file

Lines 34-80typescript

34 adminProfileIds?: string[];

35 force?: boolean;

36 log?: SeedLogger;

37};

39type Neo4jConnectionCandidate = {

40 label: string;

41 url: string;

42 username?: string;

43 password?: string;

44 hint: string;

45};

47const DEFAULT_OWNER_PROFILE_ID = 'network-seed';

48const DEFAULT_OWNER_DISPLAY_NAME = 'Network Seed';

49const DEFAULT_OWNER_SHORT_BIO = 'System profile for seeded skill frameworks';

50const SEEDED_SKILL_FRAMEWORK_IDS = DEFAULT_SKILL_FRAMEWORKS.map(({ id }) => id);

51const LOCAL_NEO4J_FALLBACK = {

52 url: 'bolt://localhost:7687',

53 username: 'neo4j',

54 password: 'this-is-the-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/seed/seedSkillFrameworks.tsView on unpkg · L54

55};

57const DOCKER_NETWORK_NEO4J_FALLBACK = {

58 url: 'bolt://neo4j:7687',

59 username: 'neo4j',

60 password: 'this-is-the-password',

Medium

Secret Pattern

Hardcoded password in src/seed/seedSkillFrameworks.ts

src/seed/seedSkillFrameworks.tsView on unpkg · L60

61};

63const STAGING_NEO4J_ENV_PATHS = [

64 resolve(process.cwd(), '../../../packages/learn-card-network/brain-client/.env'),

65 resolve(process.cwd(), '../../../packages/learn-card-network/cloud-client/.env'),

66 resolve(process.cwd(), '../../../services/learn-card-network/brain-service/.env.staging'),

67];

68const BRAIN_SERVICE_STAGING_ENV_PATH = resolve(

69 process.cwd(),

70 '../../../services/learn-card-network/brain-service/.env.staging'

71);

72const BRAIN_SERVICE_STAGING_ENV_DISPLAY_PATH =

73 'services/learn-card-network/brain-service/.env.staging';

75let hasWarnedMissingBrainServiceStagingEnv = false;

77export const getStagingNeo4jSourceDescription = (): string =>

78 existsSync(BRAIN_SERVICE_STAGING_ENV_PATH)

79 ? BRAIN_SERVICE_STAGING_ENV_DISPLAY_PATH

80 : 'your shell environment or package .env files';

tsc-alias-replacer.cjsView file

Lines 1-23javascript

1// UPSTREAM: tsc-alias does not replace paths which start with @.

2// https://github.com/justkey007/tsc-alias/issues/212

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tsc-alias-replacer.cjsView on unpkg · L3

6const tsconfig = require(

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 95803553 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

src/seed/seedSkillFrameworks.tsView file

54patternName = generic_password severity = medium line = 54 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/seed/seedSkillFrameworks.tsView on unpkg · L54

60patternName = generic_password severity = medium line = 60 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/seed/seedSkillFrameworks.ts

src/seed/seedSkillFrameworks.tsView on unpkg · L60

tsc-alias-replacer.cjsView file

3L4: const path = require('path'); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tsc-alias-replacer.cjsView on unpkg · L3

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 95803553 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Findings

1 High7 Medium5 Low

HighOversized Source Filedist/index.js

MediumSecret Patternsrc/seed/seedSkillFrameworks.ts

MediumDynamic Requiretsc-alias-replacer.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/didkit_wasm_bg.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/seed/seedSkillFrameworks.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

src/seed/seedSkillFrameworks.tsView file

Lines 34-80typescript

34 adminProfileIds?: string[];

35 force?: boolean;

36 log?: SeedLogger;

37};

39type Neo4jConnectionCandidate = {

40 label: string;

41 url: string;

42 username?: string;

43 password?: string;

44 hint: string;

45};

47const DEFAULT_OWNER_PROFILE_ID = 'network-seed';

48const DEFAULT_OWNER_DISPLAY_NAME = 'Network Seed';

49const DEFAULT_OWNER_SHORT_BIO = 'System profile for seeded skill frameworks';

50const SEEDED_SKILL_FRAMEWORK_IDS = DEFAULT_SKILL_FRAMEWORKS.map(({ id }) => id);

51const LOCAL_NEO4J_FALLBACK = {

52 url: 'bolt://localhost:7687',

53 username: 'neo4j',

54 password: 'this-is-the-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/seed/seedSkillFrameworks.tsView on unpkg · L54

55};

57const DOCKER_NETWORK_NEO4J_FALLBACK = {

58 url: 'bolt://neo4j:7687',

59 username: 'neo4j',

60 password: 'this-is-the-password',

Medium

Secret Pattern

Hardcoded password in src/seed/seedSkillFrameworks.ts

src/seed/seedSkillFrameworks.tsView on unpkg · L60

61};

63const STAGING_NEO4J_ENV_PATHS = [

64 resolve(process.cwd(), '../../../packages/learn-card-network/brain-client/.env'),

65 resolve(process.cwd(), '../../../packages/learn-card-network/cloud-client/.env'),

66 resolve(process.cwd(), '../../../services/learn-card-network/brain-service/.env.staging'),

67];

68const BRAIN_SERVICE_STAGING_ENV_PATH = resolve(

69 process.cwd(),

70 '../../../services/learn-card-network/brain-service/.env.staging'

71);

72const BRAIN_SERVICE_STAGING_ENV_DISPLAY_PATH =

73 'services/learn-card-network/brain-service/.env.staging';

75let hasWarnedMissingBrainServiceStagingEnv = false;

77export const getStagingNeo4jSourceDescription = (): string =>

78 existsSync(BRAIN_SERVICE_STAGING_ENV_PATH)

79 ? BRAIN_SERVICE_STAGING_ENV_DISPLAY_PATH

80 : 'your shell environment or package .env files';

tsc-alias-replacer.cjsView file

Lines 1-23javascript

1// UPSTREAM: tsc-alias does not replace paths which start with @.

2// https://github.com/justkey007/tsc-alias/issues/212

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tsc-alias-replacer.cjsView on unpkg · L3

6const tsconfig = require(

dist/didkit_wasm_bg.wasmView file

•path = dist/didkit_wasm_bg.wasm kind = wasm_module sizeBytes = 9282765 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/didkit_wasm_bg.wasmView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 95803553 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg