registry / @mgodata/mgo / 0.2.0

@mgodata/mgo@0.2.0

DT 1.5 by MGO Data in your terminal: real AI-visibility audits and JSON-LD schema suggestions from a live crawl, plus bring-your-own-key answer-engine scans. Honest command surface: gated commands say so.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 183 KB of source, external domains: api.anthropic.com, api.openai.com, api.perplexity.ai, audit.mgodata.com, billing.mgodata.com, connect.mgodata.com, jeaxlihszmezfpqzbmia.supabase.co, mgodata.com

Source & flagged code

3 flagged

src/mgoauth.jsView file

Lines 31-71javascript

31const path = require('path');

32const { configDir, ensureDir } = require('./config.js');

33const { jwtClaims } = require('./session.js');

35const EXPIRY_SKEW_S = 60; // refresh this many seconds before real expiry

37// MGO platform endpoints. Overridable via env ONLY for local proof/tests; in a

38// shipped CLI these are the live production hosts.

39function connectBase() {

40 return String(process.env.MGO_CONNECT_BASE || 'https://connect.mgodata.com').replace(/\/+$/, '');

41}

42// MGO's own Supabase project (public values: the anon key is public by design,

43// it is the same key baked into the Workers' wrangler.toml and used only to

44// call GoTrue). Overridable for tests.

45function platformSupabaseUrl() {

46 return String(process.env.MGO_PLATFORM_SUPABASE_URL || 'https://jeaxlihszmezfpqzbmia.supabase.co').replace(/\/+$/, '');

47}

48function platformAnonKey() {

49 return (

50 process.env.MGO_PLATFORM_SUPABASE_ANON_KEY ||

51 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImplYXhsaWhzem1lemZwcXpibWlhIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODM3MTUzMjgsImV4cCI6MjA5OTI5MTMyOH0.-b-zzUHELv9F2pMB7GsVN5xqNjS0FPWsfXVnoihxmxE'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/mgoauth.jsView on unpkg · L51

Critical

Secret Pattern

Supabase service role key (JWT) in src/mgoauth.js

src/mgoauth.jsView on unpkg · L51

52 );

53}

55function baseUrl(url) {

56 return String(url || '').replace(/\/+$/, '');

57}

59// ---------------------------------------------------------------- auth.json

61function authPath() {

62 return path.join(configDir(), 'auth.json');

63}

65function readAuth() {

66 const p = authPath();

67 if (!fs.existsSync(p)) return null;

68 try {

69 const s = JSON.parse(fs.readFileSync(p, 'utf8'));

70 if (!s || typeof s !== 'object' || !s.access_token) return null;

71 return s;

•matchType = previous_version_dangerous_delta matchedPackage = @mgodata/mgo@0.1.1 matchedIdentity = npm:QG1nb2RhdGEvbWdv:0.1.1 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mgoauth.jsView on unpkg

Source & flagged code

3 flagged · loading source

src/mgoauth.jsView file

51patternName = supabase_service_key severity = critical line = 51 matchedText = 'eyJhbGc...mxE'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/mgoauth.jsView on unpkg · L51

51patternName = supabase_service_key severity = critical line = 51 matchedText = 'eyJhbGc...mxE'

Critical

Secret Pattern

Supabase service role key (JWT) in src/mgoauth.js

src/mgoauth.jsView on unpkg · L51

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mgoauth.jsView on unpkg

Findings

2 Critical1 High2 Medium5 Low

CriticalCritical Secretsrc/mgoauth.js

CriticalSecret Patternsrc/mgoauth.js

HighPrevious Version Dangerous Deltasrc/mgoauth.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

src/mgoauth.jsView file

Lines 31-71javascript

31const path = require('path');

32const { configDir, ensureDir } = require('./config.js');

33const { jwtClaims } = require('./session.js');

35const EXPIRY_SKEW_S = 60; // refresh this many seconds before real expiry

37// MGO platform endpoints. Overridable via env ONLY for local proof/tests; in a

38// shipped CLI these are the live production hosts.

39function connectBase() {

40 return String(process.env.MGO_CONNECT_BASE || 'https://connect.mgodata.com').replace(/\/+$/, '');

41}

42// MGO's own Supabase project (public values: the anon key is public by design,

43// it is the same key baked into the Workers' wrangler.toml and used only to

44// call GoTrue). Overridable for tests.

45function platformSupabaseUrl() {

46 return String(process.env.MGO_PLATFORM_SUPABASE_URL || 'https://jeaxlihszmezfpqzbmia.supabase.co').replace(/\/+$/, '');

47}

48function platformAnonKey() {

49 return (

50 process.env.MGO_PLATFORM_SUPABASE_ANON_KEY ||

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/mgoauth.jsView on unpkg · L51

Critical

Secret Pattern

Supabase service role key (JWT) in src/mgoauth.js

src/mgoauth.jsView on unpkg · L51

52 );

53}

55function baseUrl(url) {

56 return String(url || '').replace(/\/+$/, '');

57}

59// ---------------------------------------------------------------- auth.json

61function authPath() {

62 return path.join(configDir(), 'auth.json');

63}

65function readAuth() {

66 const p = authPath();

67 if (!fs.existsSync(p)) return null;

68 try {

69 const s = JSON.parse(fs.readFileSync(p, 'utf8'));

70 if (!s || typeof s !== 'object' || !s.access_token) return null;

71 return s;

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mgoauth.jsView on unpkg