registry / @lyxa.ai/types / 1.4.306-alpha-4

@lyxa.ai/types@1.4.306-alpha-4

Lyxa type definitions and validation schemas for both frontend and backend

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 315 file(s), 1.11 MB of source, external domains: api-v2-development.lyxa.ai, maps.googleapis.com, routes.googleapis.com, storage.googleapis.com, translation.googleapis.com

Source & flagged code

7 flagged

libraries/configuration/index.jsView file

Lines 5-76javascript

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r

Source & flagged code

7 flagged · loading source

libraries/configuration/index.jsView file

25patternName = private_key_rsa severity = critical line = 25 matchedText = privateK...\n',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

libraries/configuration/index.jsView on unpkg · L25

25patternName = private_key_rsa severity = critical line = 25 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L25

32patternName = private_key_rsa severity = critical line = 32 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L32

40patternName = private_key_rsa severity = critical line = 40 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L40

48patternName = private_key_rsa severity = critical line = 48 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L48

56patternName = private_key_rsa severity = critical line = 56 matchedText = privateK...\n',

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L56

libraries/secrets/index.jsView file

31patternName = private_key_rsa severity = critical line = 31 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in libraries/secrets/index.js

libraries/secrets/index.jsView on unpkg · L31

Findings

7 Critical2 Medium4 Low

CriticalCritical Secretlibraries/configuration/index.js

CriticalSecret Patternlibraries/configuration/index.js

CriticalSecret Patternlibraries/secrets/index.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

25 privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC5aI2nsMHkJbZf\nem9ycpd57RjRDsBt9Nb/uMjsFcBRuAKcKgh4lgNO6ZmcRwK10IRygCmbY5XxmtVA\nq9CT5tYlVN4SDzN1y4lL8/CL5owW2RZOURKcM0lsNOB9uGwkv1t3bfbBNc2hh9JX\n72t7URAtrtPAkUxtgEPm6WL03uNu8KCZ0G9uoA/oM7o8OIGkjC575D9V6QjYC9fn\nPjBRQ3K42fUWFmf31jtUBSHB0xE5qJI+MOi+OcXAJLxKQBbW+vqr2KfMwVYpNclp\nk0Ptfe8xZxVfKEJAAkacQ36Hp14wFK/q+2mmhOQlbruksOZCpaIkh5IdvGkkG8ZH\n566FgFHDAgMBAAECggEAJkuuqprLSZTyiOEQoOqDWBc9X3z1CSEfwV0I/x51BUwF\nGf1il4mgsE12wX03VZd2q/HF5kcZAvjQoFV8tPfidn6DieZi4itCthHyNutNNzDq\ntw1u0x2Sxk ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

libraries/configuration/index.jsView on unpkg · L25

Critical

Secret Pattern

RSA private key in libraries/configuration/index.js

libraries/configuration/index.jsView on unpkg · L25

libraries/secrets/index.jsView file

Lines 11-51javascript

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.SecretManagerService = void 0;

13const secret_manager_1 = require("@google-cloud/secret-manager");

14const typedi_1 = require("typedi");

15const redis_1 = require("../redis");

16const configuration_1 = require("../configuration");

17let SecretManagerService = class SecretManagerService {

18 _configurationService;

19 _redisManager;

20 _client;

21 constructor(configurationService, redisManager) {

22 this._configurationService = configurationService;

23 this._redisManager = redisManager;

24 this._client = new secret_manager_1.SecretManagerServiceClient({

25 credentials: {

26 client_id: '107840895824406590900',

27 private_key_id: 'ece1ebdfde57414700f23f1f4014f5e83d4f7644',

28 type: 'service_account',

29 universe_domain: 'googleapis.com',

30 projectId: 'for-poc-325210',

31 private_key: '-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDPTk9M5nCDYJhC\nLuyP+gqBXIHPrXegygco5tB50Y7Q9s/f4hm+xp/usYy5UCYyFVNjZ2mdjWQcr3Ta\nT3GZV9OiHej8ejveY0iyFBi0IlfGNm9blYlOIyQT4i6MoevNul7u4EQL8bid/sp/\nJ/XPNC+Jnk8Ke2G9FdfDYs+1O6Nf37HuPUmMwLAzcyl+k1v9UzInrgNPj+nactY7\nEPCVSM6XcZI3UL86n574iQBvUXsMpUt3csYVOxPap1Vd1TBEo1k85jZepMvaXHoK\nJUwQT7p1F1D0weVKJ1BjwQgmADZWfUKdwRyS8zFPbUGeptlA2XlxyVMasGzCCMi4\n6jzJGC81AgMBAAECggEAXoaLnDn7Fbym0I7K6T+PKLtAqaykPpnAOAM/DjzijR/t\nW12idZ3l8RXeX+VO9UlKE6pkuyVsf7P1aVIOL2ifpG1U/kLSJ65HyINnXEPImCXc\nEvuVdx6I5dQde ...

Critical

Secret Pattern

RSA private key in libraries/secrets/index.js

libraries/secrets/index.jsView on unpkg · L31

32 client_email: 'lyxa-core@for-poc-325210.iam.gserviceaccount.com',

33 },

34 });

35 }

36 async getKey(key) {

37 const environmentTransformedKey = this._configurationService?.options?.environment + '_' + key;

38 try {

39 const data = await this._redisManager.getCachedObjectByGroup(this?._configurationService?.options?.environment + '_KEYS', key);

40 if (data != undefined) {

41 return data;

42 }

43 const [accessResponse] = await this._client.accessSecretVersion({

44 name: 'projects/899369746265/secrets/' + environmentTransformedKey + '/versions/latest',

45 });

46 const val = accessResponse.payload.data.toString();

47 await this.setKey(key, val);

48 return val;

49 }

50 catch (e) {

51 console.error(e);

Long lines were clipped for display.