registry / @nira-opencrvs/toolkit / 1.9.13-rc.f510916

@nira-opencrvs/toolkit@1.9.13-rc.f510916

OpenCRVS toolkit for building country configurations

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 593 KB of source, external domains: minio.opencrvs.com, opencrvs.org

Source & flagged code

3 flagged

dist/events/index.jsView file

Lines 9176-9216javascript

9176 createdBySignature: overrides.createdBySignature ?? generateRandomSignature(rng),

9177 updatedAt: overrides.updatedAt ?? (0, import_date_fns4.addDays)(new Date(createdAt), 1).toISOString(),

9178 assignedTo: overrides.assignedTo ?? null,

9179 updatedBy: overrides.updatedBy ?? generateUuid(rng),

9180 updatedByUserRole: overrides.updatedByUserRole ?? "FIELD_AGENT",

9181 flags: overrides.flags ?? [],

9182 potentialDuplicates: [],

9183 legalStatuses: overrides.legalStatuses ?? {},

9184 declaration: overrides.declaration ?? generateRandomApplicant(rng),

9185 trackingId: overrides.trackingId ?? generateTrackingId(rng)

9186 };

9187};

9188var generateTranslationConfig2 = (message) => ({

9189 defaultMessage: message,

9190 description: "Description for ${message}",

9191 id: message.trim().replace(/\s+/g, "_").toLowerCase()

9192});

9193var BearerTokenByUserType = {

9194 fieldAgent: "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQuY3JlYXRlW2V2ZW50PWJpcnRofGRlYXRofHRlbm5pcy1jbHViLW1lbWJlcnNoaXBdIiwicmVjb3JkLmRlY2xhcmVbZXZlbnQ9YmlydGh8ZGVhdGh8dGVubmlzLWNsdWItbWVtYmVyc2hpcF0iLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWluY29tcGxldGUiLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWZvci1yZXZpZXciLCJzZWFyY2guYmlydGgiLCJzZWFyY2guZGVhdGgiLCJzZWFyY2gubWFycmlhZ2UiLCJkZW1vIl0sInVzZXJUeXBlIjoidXNlciIsImlhdCI6MTc0ODUyNjQ4OCwiZXhwIjoxNzQ5MTMxMjg4LCJhdWQiOlsib3BlbmNydnM6YXV0aC11c2VyIiwib3BlbmNydnM6dXNlci1tZ250LXVzZXIiLCJvcGVuY3J2czpoZWFydGgtdXNlciIsIm9wZW5jcnZzOmdhdGV3YXktdXNl ...

9195 registrationAgent: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQucmVhZCIsInJlY29yZC5kZWNsYXJlLWJpcnRoIiwicmVjb3JkLmRlY2xhcmUtZGVhdGgiLCJyZWNvcmQuZGVjbGFyZS1tYXJyaWFnZSIsInJlY29yZC5kZWNsYXJhdGlvbi1lZGl0IiwicmVjb3JkLmRlY2xhcmF0aW9uLXN1Ym1pdC1mb3ItYXBwcm92YWwiLCJyZWNvcmQuZGVjbGFyYXRpb24tc3VibWl0LWZvci11cGRhdGVzIiwicmVjb3JkLmRlY2xhcmF0aW9uLWFyY2hpdmUiLCJyZWNvcmQuZGVjbGFyYXRpb24tcmVpbnN0YXRlIiwicmVjb3JkLnJlZ2lzdHJhdGlvbi1yZXF1ZXN0LWNvcnJlY3Rpb24iLCJyZWNvcmQuZGVjbGFyYXRpb24tcHJpbnQtc3VwcG9ydGluZy1kb2N1bWVudHMiLCJyZWNvcmQuZXhwb3J0LXJlY29yZHMiLCJyZWNvcmQucmVnaXN0cmF0aW9uLXByaW50Jmlzc ...

9196 localRegistrar: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWNvcmQucmVhZCIsInJlY29yZC5jcmVhdGVbZXZlbnQ9djIuYmlydGh8djIuZGVhdGh8dGVubmlzLWNsdWItbWVtYmVyc2hpcF0iLCJyZWNvcmQuZGVjbGFyZVtldmVudD12Mi5iaXJ0aHx2Mi5kZWF0aHx0ZW5uaXMtY2x1Yi1tZW1iZXJzaGlwXSIsInJlY29yZC5kZWNsYXJhdGlvbi1lZGl0IiwicmVjb3JkLmRlY2xhcmF0aW9uLXN1Ym1pdC1mb3ItdXBkYXRlcyIsInJlY29yZC5yZXZpZXctZHVwbGljYXRlcyIsInJlY29yZC5kZWNsYXJhdGlvbi1hcmNoaXZlIiwicmVjb3JkLmRlY2xhcmF0aW9uLXJlaW5zdGF0ZSIsInJlY29yZC5yZWdpc3RlciIsInJlY29yZC5yZWdpc3RyYXRpb24tY29ycmVjdCIsInJlY29yZC5kZWNsYXJhdGlvbi1wcmludC1zdXBwb3J0aW5nLWRvY3VtZW50cyIsInJlY29y ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9196

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9196

9197};

9198var generateWorkqueues = (slug = "all-events") => defineWorkqueues([

9199 {

9200 slug,

9201 name: {

9202 id: "workqueues.inProgress.title",

9203 defaultMessage: slug.charAt(0).toUpperCase() + slug.slice(1).split("-").join(" "),

9204 description: "Title of in progress workqueue"

9205 },

9206 query: {

9207 type: "and",

9208 clauses: [{ eventType: tennisClubMembershipEvent.id }]

9209 },

9210 actions: [

9211 {

9212 type: "DEFAULT",

9213 conditionals: []

9214 }

9215 ],

9216 icon: "Draft"

Long lines were clipped for display.

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/events/index.jsView file

9196patternName = supabase_service_key severity = critical line = 9196 matchedText = localReg...NJo"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9196

9196patternName = supabase_service_key severity = critical line = 9196 matchedText = localReg...NJo"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9196

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretdist/events/index.js

CriticalSecret Patterndist/events/index.js

MediumNetwork

MediumShips Build Helperbuild.sh

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/events/index.jsView file

Lines 9176-9216javascript

9176 createdBySignature: overrides.createdBySignature ?? generateRandomSignature(rng),

9177 updatedAt: overrides.updatedAt ?? (0, import_date_fns4.addDays)(new Date(createdAt), 1).toISOString(),

9178 assignedTo: overrides.assignedTo ?? null,

9179 updatedBy: overrides.updatedBy ?? generateUuid(rng),

9180 updatedByUserRole: overrides.updatedByUserRole ?? "FIELD_AGENT",

9181 flags: overrides.flags ?? [],

9182 potentialDuplicates: [],

9183 legalStatuses: overrides.legalStatuses ?? {},

9184 declaration: overrides.declaration ?? generateRandomApplicant(rng),

9185 trackingId: overrides.trackingId ?? generateTrackingId(rng)

9186 };

9187};

9188var generateTranslationConfig2 = (message) => ({

9189 defaultMessage: message,

9190 description: "Description for ${message}",

9191 id: message.trim().replace(/\s+/g, "_").toLowerCase()

9192});

9193var BearerTokenByUserType = {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/events/index.jsView on unpkg · L9196

Critical

Secret Pattern

Supabase service role key (JWT) in dist/events/index.js

dist/events/index.jsView on unpkg · L9196

9197};

9198var generateWorkqueues = (slug = "all-events") => defineWorkqueues([

9199 {

9200 slug,

9201 name: {

9202 id: "workqueues.inProgress.title",

9203 defaultMessage: slug.charAt(0).toUpperCase() + slug.slice(1).split("-").join(" "),

9204 description: "Title of in progress workqueue"

9205 },

9206 query: {

9207 type: "and",

9208 clauses: [{ eventType: tennisClubMembershipEvent.id }]

9209 },

9210 actions: [

9211 {

9212 type: "DEFAULT",

9213 conditionals: []

9214 }

9215 ],

9216 icon: "Draft"

Long lines were clipped for display.

build.shView file

•path = build.sh kind = build_helper sizeBytes = 2490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

build.shView on unpkg