registry / @nira-opencrvs/toolkit / 1.9.13-rc.d0cab3c

@nira-opencrvs/toolkit@1.9.13-rc.d0cab3c

OpenCRVS toolkit for building country configurations

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 592 KB of source, external domains: minio.opencrvs.com, opencrvs.org

Source & flagged code

3 flagged

dist/events/index.jsView file

Lines 9169-9209javascript

9169 createdBySignature: overrides.createdBySignature ?? generateRandomSignature(rng),

9170 updatedAt: overrides.updatedAt ?? (0, import_date_fns4.addDays)(new Date(createdAt), 1).toISOString(),

9171 assignedTo: overrides.assignedTo ?? null,

9172 updatedBy: overrides.updatedBy ?? generateUuid(rng),

9173 updatedByUserRole: overrides.updatedByUserRole ?? "FIELD_AGENT",

9174 flags: overrides.flags ?? [],

9175 potentialDuplicates: [],

9176 legalStatuses: overrides.legalStatuses ?? {},

9177 declaration: overrides.declaration ?? generateRandomApplicant(rng),

9178 trackingId: overrides.trackingId ?? generateTrackingId(rng)

9179 };

9180};

9181var generateTranslationConfig2 = (message) => ({

9182 defaultMessage: message,

9183 description: "Description for ${message}",

9184 id: message.trim().replace(/\s+/g, "_").toLowerCase()

9185});

9186var BearerTokenByUserType = {

9187 fieldAgent: "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQuY3JlYXRlW2V2ZW50PWJpcnRofGRlYXRofHRlbm5pcy1jbHViLW1lbWJlcnNoaXBdIiwicmVjb3JkLmRlY2xhcmVbZXZlbnQ9YmlydGh8ZGVhdGh8dGVubmlzLWNsdWItbWVtYmVyc2hpcF0iLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWluY29tcGxldGUiLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWZvci1yZXZpZXciLCJzZWFyY2guYmlydGgiLCJzZWFyY2guZGVhdGgiLCJzZWFyY2gubWFycmlhZ2UiLCJkZW1vIl0sInVzZXJUeXBlIjoidXNlciIsImlhdCI6MTc0ODUyNjQ4OCwiZXhwIjoxNzQ5MTMxMjg4LCJhdWQiOlsib3BlbmNydnM6YXV0aC11c2VyIiwib3BlbmNydnM6dXNlci1tZ250LXVzZXIiLCJvcGVuY3J2czpoZWFydGgtdXNlciIsIm9wZW5jcnZzOmdhdGV3YXktdXNl ...

9188 registrationAgent: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQucmVhZCIsInJlY29yZC5kZWNsYXJlLWJpcnRoIiwicmVjb3JkLmRlY2xhcmUtZGVhdGgiLCJyZWNvcmQuZGVjbGFyZS1tYXJyaWFnZSIsInJlY29yZC5kZWNsYXJhdGlvbi1lZGl0IiwicmVjb3JkLmRlY2xhcmF0aW9uLXN1Ym1pdC1mb3ItYXBwcm92YWwiLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWZvci11cGRhdGVzIiwicmVjb3JkLmRlY2xhcmF0aW9uLWFyY2hpdmUiLCJyZWNvcmQuZGVjbGFyYXRpb24tcmVpbnN0YXRlIiwicmVjb3JkLnJlZ2lzdHJhdGlvbi1yZXF1ZXN0LWNvcnJlY3Rpb24iLCJyZWNvcmQuZGVjbGFyYXRpb24tcHJpbnQtc3VwcG9ydGluZy1kb2N1bWVudHMiLCJyZWNvcmQuZXhwb3J0LXJlY29yZHMiLCJyZWNvcmQucmVnaXN0cmF0aW9uLXByaW50Jmlzc ...

9189 localRegistrar: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQucmVhZCIsInJlY29yZC5jcmVhdGVbZXZlbnQ9djIuYmlydGh8djIuZGVhdGh8dGVubmlzLWNsdWItbWVtYmVyc2hpcF0iLCJyZWNvcmQuZGVjbGFyZVtldmVudD12Mi5iaXJ0aHx2Mi5kZWF0aHx0ZW5uaXMtY2x1Yi1tZW1iZXJzaGlwXSIsInJlY29yZC5kZWNsYXJhdGlvbi1lZGl0IiwicmVjb3JkLmRlY2xhcmF0aW9uLXN1Ym1pdC1mb3ItdXBkYXRlcyIsInJlY29yZC5yZXZpZXctZHVwbGljYXRlcyIsInJlY29yZC5kZWNsYXJhdGlvbi1hcmNoaXZlIiwicmVjb3JkLmRlY2xhcmF0aW9uLXJlaW5zdGF0ZSIsInJlY29yZC5yZWdpc3RlciIsInJlY29yZC5yZWdpc3RyYXRpb24tY29ycmVjdCIsInJlY29yZC5kZWNsYXJhdGlvbi1wcmludC1zdXBwb3J0aW5nLWRvY3VtZW50cyIsInJlY29y ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9189

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9189

9190};

9191var generateWorkqueues = (slug = "all-events") => defineWorkqueues([

9192 {

9193 slug,

9194 name: {

9195 id: "workqueues.inProgress.title",

9196 defaultMessage: slug.charAt(0).toUpperCase() + slug.slice(1).split("-").join(" "),

9197 description: "Title of in progress workqueue"

9198 },

9199 query: {

9200 type: "and",

9201 clauses: [{ eventType: tennisClubMembershipEvent.id }]

9202 },

9203 actions: [

9204 {

9205 type: "DEFAULT",

9206 conditionals: []

9207 }

9208 ],

9209 icon: "Draft"

Long lines were clipped for display.

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/events/index.jsView file

9189patternName = supabase_service_key severity = critical line = 9189 matchedText = localReg...NJo"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9189

9189patternName = supabase_service_key severity = critical line = 9189 matchedText = localReg...NJo"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9189

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretdist/events/index.js

CriticalSecret Patterndist/events/index.js

MediumNetwork

MediumShips Build Helperbuild.sh

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/events/index.jsView file

Lines 9169-9209javascript

9169 createdBySignature: overrides.createdBySignature ?? generateRandomSignature(rng),

9170 updatedAt: overrides.updatedAt ?? (0, import_date_fns4.addDays)(new Date(createdAt), 1).toISOString(),

9171 assignedTo: overrides.assignedTo ?? null,

9172 updatedBy: overrides.updatedBy ?? generateUuid(rng),

9173 updatedByUserRole: overrides.updatedByUserRole ?? "FIELD_AGENT",

9174 flags: overrides.flags ?? [],

9175 potentialDuplicates: [],

9176 legalStatuses: overrides.legalStatuses ?? {},

9177 declaration: overrides.declaration ?? generateRandomApplicant(rng),

9178 trackingId: overrides.trackingId ?? generateTrackingId(rng)

9179 };

9180};

9181var generateTranslationConfig2 = (message) => ({

9182 defaultMessage: message,

9183 description: "Description for ${message}",

9184 id: message.trim().replace(/\s+/g, "_").toLowerCase()

9185});

9186var BearerTokenByUserType = {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9189

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9189

9190};

9191var generateWorkqueues = (slug = "all-events") => defineWorkqueues([

9192 {

9193 slug,

9194 name: {

9195 id: "workqueues.inProgress.title",

9196 defaultMessage: slug.charAt(0).toUpperCase() + slug.slice(1).split("-").join(" "),

9197 description: "Title of in progress workqueue"

9198 },

9199 query: {

9200 type: "and",

9201 clauses: [{ eventType: tennisClubMembershipEvent.id }]

9202 },

9203 actions: [

9204 {

9205 type: "DEFAULT",

9206 conditionals: []

9207 }

9208 ],

9209 icon: "Draft"

Long lines were clipped for display.

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg