Loading npm security reports…

@lyxa.ai/types@1.4.298: Suspicious npm security report (Warn) | LPM Firewall

registry / @lyxa.ai/types / 1.4.298

@lyxa.ai/types@1.4.298

Lyxa type definitions and validation schemas for both frontend and backend

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 339 file(s), 1.15 MB of source, external domains: api-v2-development.lyxa.ai, maps.googleapis.com, routes.googleapis.com, storage.googleapis.com, translation.googleapis.com

Source & flagged code

7 flagged

libraries/configuration/index.jsView file

Lines 5-76javascript

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.ConfigurationService = void 0;

13const typedi_1 = require("typedi");

14const EnvironmentConfigurationType_1 = require("./types/EnvironmentConfigurationType");

15const redis_environments_1 = require("../../utilities/environment/redis-environments");

16let ConfigurationService = class ConfigurationService {

17 _defaultOptions = {

18 redisURL: redis_environments_1.RedisUrlMap[EnvironmentConfigurationType_1.EnvironmentConfigurationType.DEV],

19 tenet: 'default',

20 instanceType: 'unknown',

21 firebaseAdmin: {

22 super: {

23 firebaseAdminServiceAccount: {

24 projectId: 'for-poc-325210',

25 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC5aI2nsMHkJbZf\nem9ycpd57RjRDsBt9Nb/uMjsFcBRuAKcKgh4lgNO6ZmcRwK10IRygCmbY5XxmtVA\nq9CT5tYlVN4SDzN1y4lL8/CL5owW2RZOURKcM0lsNOB9uGwkv1t3bfbBNc2hh9JX\n72t7URAtrtPAkUxtgEPm6WL03uNu8KCZ0G9uoA/oM7o8OIGkjC575D9V6QjYC9fn\nPjBRQ3K42fUWFmf31jtUBSHB0xE5qJI+MOi+OcXAJLxKQBbW+vqr2KfMwVYpNclp\nk0Ptfe8xZxVfKEJAAkacQ36Hp14wFK/q+2mmhOQlbruksOZCpaIkh5IdvGkkG8ZH\n566FgFHDAgMBAAECggEAJkuuqprLSZTyiOEQoOqDWBc9X3z1CSEfwV0I/x51BUwF\nGf1il4mgsE12wX03VZd2q/HF5kcZAvjQoFV8tPfidn6DieZi4itCthHyNutNNzDq\ntw1u0x2Sxk ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

libraries/configuration/index.jsView on unpkg · L25

Critical

Secret Pattern

26 clientEmail: 'lyxa-core@for-poc-325210.iam.gserviceaccount.com',

27 },

28 },

29 user: {

30 firebaseAdminServiceAccount: {

31 projectId: 'for-poc-325210',

32 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC9yUnAC2pQ+dhe\ndJVMS7RQeQdQO7JhT0BXz0MbpCXlEdc3j/GQAY9UfKxQLg1VZh+4An8aUZevOy/v\nUaHsvqSWcWg7UHTOjk861brpjdjhM4S4ahwU2NyVI/o0Bpc5ob4nhHebny9FGqEP\nauwUXiVw7UjA/yGeTN6delZwCxejHxI6zDjFQveo8Ljkfu49CMyyf1XhN9q0So4Q\n2pZ3Xmdz0fZGykSGT9TVBDnPE8Zc3VCQ1XQ7aEKr0e9L+YYidw+iurSNwQSo72uk\nf/G2wCtlAaoDh0lKObEbi1b925BOthP2XpmQ7Kv+iWVFouCY54Md56FxtjKOyYll\n0nS6MkAJAgMBAAECggEAEeee83UoPjQ6BVxAlxJ31BU8+0TshOlwB7C8MywC7rfm\nit2Dw8sf4W/DJmvX0nAYazjiEqKyuaOO98gm64HHX5GarKjgIjoTD7kJAZ6CIOnm\nOis5k75rXg ...

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L32

33 clientEmail: 'firebase-adminsdk-onusy@for-poc-325210.iam.gserviceaccount.com',

34 },

35 firebaseAdminAppName: 'lyxa-user',

36 },

37 rider: {

38 firebaseAdminServiceAccount: {

39 projectId: 'lyxa-rider-88939',

40 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC08zRqUjHFO7Ir\n4UNHIjxVp7oJkK3rrV1UGfHeHsijm6CSWjViVqsFKUZliYXTjg9S8rIMmC3OAMrh\n5FTdNfDell8YHPbVRWZ0OFBNWglvKMgMKMoyQuBKtvEAdZwgVMreOf+51QlZnPxy\nTBNh4Du2ahb8TtAjwxXt7CgMjNIfoMjQFJTrBTAmsxhtOEpYvPU2iX+OtAkHgrs1\nNeWpBGpN4GSwOfA8MdgvorLYbeRDnkY4cH/ReNymTW9nbX1vgsx2AE1NR5PTNxv0\nIuVZQWxMMGPnT5bjzAlCR4z/Nbe89V2zl5kFtBxDBCDqxp+qZxCinJj1QqwC5qzZ\nYLbNVKVPAgMBAAECggEAEHEGwrW24v/NF9KZ3S/zASoX1oBTD+vf4+E69QlMBshV\nxeaKHOYuF5khVd7cjj/wDC6ULLPJJFjga7e7rvaUl80G//cQcIl5STcdXiHqYzN2\nldrroGHWOm ...

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L40

41 clientEmail: 'firebase-adminsdk-qwhrd@lyxa-rider-88939.iam.gserviceaccount.com',

42 },

43 firebaseAdminAppName: 'lyxa-rider',

44 },

45 shop: {

46 firebaseAdminServiceAccount: {

47 projectId: 'lyxa-shop',

48 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDTWaf/QGSjk7po\nri+6Nzo/tep1UtgMSY4KscT3iCbepiAsw7C8NCQqz3wYEAFRwywbaCwUcUs5KUC7\n/e9TvpSQQksu10P9uP+c7wnAy+l0ay/15vWUV0usmDhMMvfjtDwS2RYTMEAdNUiZ\nOuMC3/DDCBHt0SC5WCNzz11jj/n5bdVOS02qHd8V/lbd46iVEYfFswkI5NBgV7CY\nnR2CoVcakPIeu9kEKdjXsJvf8+zCYtXPaFvcubQcnybOcg6usU+AHD1iwCRd6BrK\n2PpM3gy/eASLJtzg/JoU0CgqJICmfR8LvGk6iHTp7VMfPuCfggwYtO3W1kSHuW4I\nswbXYOJbAgMBAAECggEAMHKZ5xIsv66KiZp8SFSGnrolv7U430AxNlRf0Vo9hsZQ\nE9Lb/Zh6PfIIAUAR/VsfDj1H9XuvAbBqLW3dYbYLOjJoJ5mi9VNmDORiuPZFUrGL\ncfP6kYGdUD ...

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L48

49 clientEmail: 'firebase-adminsdk-w4v98@lyxa-shop.iam.gserviceaccount.com',

50 },

51 firebaseAdminAppName: 'lyxa-shop',

52 },

53 cpanel: {

54 firebaseAdminServiceAccount: {

55 projectId: 'lyxa-cpanel',

56 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDJpYsdNZcdGY/L\nN+E3nzxsEWL157vzb7RL/yIzn1shGeyzwNtv3Ew26c8yLxGBJx/1IFe/qwomWNOt\nK8oLgExlwYYzHA9sP+pKBYmxoL2Jqy8A0Ug0T0Cm8Bc78xy7810WCr07rbzFsDup\nmtaVNMQh0A3CFEW/2+ZjiTN8628T7ziZDvjj+rTR01Kchqv1Lh5uCFiyKryc0lpF\nL2LI8TKTZ0gikrqxqmKukv/o0aiiBVZxpghZbZ6oevc3XFGCWs6taVsnATecel57\nvqcV6uZKGbDRU4OKrqTMlCJH6aAt6G1xN2DaCFSzqf5On+O7LkmlNiK/unjgewAt\nINldmEAdAgMBAAECggEAG92JDmXH9qkAInyb3mReZK64ZrP52KewmintL4YPgVEE\nUUjO6jPewl3oGI7Bk//0nhq0lZOMyQTQZ6db+d/mbs9h/LEdfn+MoGMIhqfoWVxz\nF+FT4YqsLA ...

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L56

57 clientEmail: 'firebase-adminsdk-fbsvc@lyxa-cpanel.iam.gserviceaccount.com',

58 },

59 firebaseAdminAppName: 'lyxa-cpanel',

60 },

61 },

62 environment: EnvironmentConfigurationType_1.EnvironmentConfigurationType.DEV,

63 };

64 _options;

65 constructor(options) {

66 this._options = {

67 ...this._defaultOptions,

68 ...options,

69 redisURL: options?.redisURL ? options?.redisURL : redis_environments_1.RedisUrlMap[options?.environment]

70 };

71 }

72 get redisURL() {

73 return redis_environments_1.RedisUrlMap[this._options.environment];

74 }

75 get options() {

76 return this._options;

Long lines were clipped for display.

libraries/secrets/index.jsView file

Lines 11-51javascript

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.SecretManagerService = void 0;

13const secret_manager_1 = require("@google-cloud/secret-manager"

Source & flagged code

7 flagged · loading source

libraries/configuration/index.jsView file

25patternName = private_key_rsa severity = critical line = 25 matchedText = privateK...\n',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

libraries/configuration/index.jsView on unpkg · L25

25patternName = private_key_rsa severity = critical line = 25 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L25

32patternName = private_key_rsa severity = critical line = 32 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L32

40patternName = private_key_rsa severity = critical line = 40 matchedText = privateK...\n',

Findings

7 Critical2 Medium4 Low

CriticalCritical Secretlibraries/configuration/index.js

CriticalSecret Patternlibraries/configuration/index.js

CriticalSecret Patternlibraries/secrets/index.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

libraries/configuration/index.jsView file

Lines 5-76javascript

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __metadata = (this && this.__metadata) || function (k, v) {

9 if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.ConfigurationService = void 0;

13const typedi_1 = require("typedi");

14const EnvironmentConfigurationType_1 = require("./types/EnvironmentConfigurationType");

15const redis_environments_1 = require("../../utilities/environment/redis-environments");

16let ConfigurationService = class ConfigurationService {

17 _defaultOptions = {

18 redisURL: redis_environments_1.RedisUrlMap[EnvironmentConfigurationType_1.EnvironmentConfigurationType.DEV],

19 tenet: 'default',

20 instanceType: 'unknown',

21 firebaseAdmin: {

22 super: {

23 firebaseAdminServiceAccount: {

24 projectId: 'for-poc-325210',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

libraries/configuration/index.jsView on unpkg · L25

Critical

Secret Pattern

26 clientEmail: 'lyxa-core@for-poc-325210.iam.gserviceaccount.com',

27 },

28 },

29 user: {

30 firebaseAdminServiceAccount: {

31 projectId: 'for-poc-325210',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L32

33 clientEmail: 'firebase-adminsdk-onusy@for-poc-325210.iam.gserviceaccount.com',

34 },

35 firebaseAdminAppName: 'lyxa-user',

36 },

37 rider: {

38 firebaseAdminServiceAccount: {

39 projectId: 'lyxa-rider-88939',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L40

41 clientEmail: 'firebase-adminsdk-qwhrd@lyxa-rider-88939.iam.gserviceaccount.com',

42 },

43 firebaseAdminAppName: 'lyxa-rider',

44 },

45 shop: {

46 firebaseAdminServiceAccount: {

47 projectId: 'lyxa-shop',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L48

49 clientEmail: 'firebase-adminsdk-w4v98@lyxa-shop.iam.gserviceaccount.com',

50 },

51 firebaseAdminAppName: 'lyxa-shop',

52 },

53 cpanel: {

54 firebaseAdminServiceAccount: {

55 projectId: 'lyxa-cpanel',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L56

57 clientEmail: 'firebase-adminsdk-fbsvc@lyxa-cpanel.iam.gserviceaccount.com',

58 },

59 firebaseAdminAppName: 'lyxa-cpanel',

60 },

61 },

62 environment: EnvironmentConfigurationType_1.EnvironmentConfigurationType.DEV,

63 };

64 _options;

65 constructor(options) {

66 this._options = {

67 ...this._defaultOptions,

68 ...options,

69 redisURL: options?.redisURL ? options?.redisURL : redis_environments_1.RedisUrlMap[options?.environment]

70 };

71 }

72 get redisURL() {

73 return redis_environments_1.RedisUrlMap[this._options.environment];

74 }

75 get options() {

76 return this._options;

Long lines were clipped for display.

libraries/secrets/index.jsView file

Lines 11-51javascript

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.SecretManagerService = void 0;

13const secret_manager_1 = require("@google-cloud/secret-manager"