registry / @oh-my-pi/pi-ai / 16.3.0

@oh-my-pi/pi-ai@16.3.0

Unified LLM API with automatic model discovery and provider configuration

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 257 file(s), 2.78 MB of source, external domains: 127.0.0.1, accounts.google.com, aiplatform.googleapis.com, api.anthropic.com, api.cerebras.ai, api.code.umans.ai, api.deepseek.com, api.devin.ai, api.fireworks.ai, api.github.com, api.inference.wandb.ai, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.moonshot.ai, api.openai.com, api.sakana.ai, api.synthetic.new, api.together.xyz, api.venice.ai, api.xiaomimimo.com, api.z.ai, api2.cursor.sh, app.devin.ai, app.fireworks.ai, app.tavily.com, app.umans.ai, auth.kimi.com, auth.openai.com, auth.x.ai, bigmodel.cn, chat.qwen.ai, claude.ai, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, console.bce.baidu.com, console.sakana.ai, cursor.com, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.console.aliyun.com, dev.synthetic.new, developers.cloudflare.com, docs.litellm.ai, docs.vllm.ai, generativelanguage.googleapis.com

Source & flagged code

2 flagged

src/providers/google-auth.tsView file

Lines 3-43typescript

3 *

4 * Replaces `google-auth-library` with a direct WebCrypto + REST implementation.

5 * Sources, in priority order:

6 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)

7 * or `type: "authorized_user"` (refresh-token exchange).

8 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).

9 * 3. GCE / Cloud Run metadata server (`metadata.google.internal`).

10 *

11 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry

12 * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.

13 */

15import { Buffer } from "node:buffer";

16import * as fs from "node:fs";

17import * as os from "node:os";

18import * as path from "node:path";

19import { $envpos, isEnoent, logger } from "@oh-my-pi/pi-utils";

20import * as AIError from "../error";

21import type { FetchImpl } from "../types";

22import { raceWithSignal } from "../utils/abort";

24const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";

25const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";

26const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";

27const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";

29interface CachedToken {

30 token: string;

31 expiresAtMs: number;

32}

34interface ServiceAccountCredentials {

35 type: "service_account";

36 client_email: string;

37 private_key: string;

38 private_key_id?: string;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L23

39}

41interface AuthorizedUserCredentials {

42 type: "authorized_user";

43 client_id: string;

src/providers/__tests__/google-auth.test.tsView file

Lines 5-45typescript

5import * as path from "node:path";

6import type { FetchImpl } from "../../types";

7import { __resetVertexTokenCache, getVertexAccessToken } from "../google-auth";

9const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"

Source & flagged code

2 flagged · loading source

src/providers/google-auth.tsView file

23L24: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L25: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L26: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L36: client_email: string; L37: private_key: string; L38: private_key_id?: string; ... L70: function userAdcPath(): string { L71: return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"); L72: } ... L75: try { L76: return (await Bun.file(filePath).json()) as T;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L23

src/providers/__tests__/google-auth.test.tsView file

25patternName = private_key_rsa severity = critical line = 25 matchedText = return `...\n`;

Critical

Secret Pattern

RSA private key in src/providers/__tests__/google-auth.test.ts

src/providers/__tests__/google-auth.test.tsView on unpkg · L25

Findings

1 Critical1 High3 Medium4 Low

CriticalSecret Patternsrc/providers/__tests__/google-auth.test.ts

HighCloud Metadata Accesssrc/providers/google-auth.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/providers/google-auth.tsView file

Lines 3-43typescript

3 *

4 * Replaces `google-auth-library` with a direct WebCrypto + REST implementation.

5 * Sources, in priority order:

6 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)

7 * or `type: "authorized_user"` (refresh-token exchange).

8 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).

9 * 3. GCE / Cloud Run metadata server (`metadata.google.internal`).

10 *

11 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry

12 * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.

13 */

15import { Buffer } from "node:buffer";

16import * as fs from "node:fs";

17import * as os from "node:os";

18import * as path from "node:path";

19import { $envpos, isEnoent, logger } from "@oh-my-pi/pi-utils";

20import * as AIError from "../error";

21import type { FetchImpl } from "../types";

22import { raceWithSignal } from "../utils/abort";

24const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";

25const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";

26const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";

27const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";

29interface CachedToken {

30 token: string;

31 expiresAtMs: number;

32}

34interface ServiceAccountCredentials {

35 type: "service_account";

36 client_email: string;

37 private_key: string;

38 private_key_id?: string;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L23

39}

41interface AuthorizedUserCredentials {

42 type: "authorized_user";

43 client_id: string;

src/providers/__tests__/google-auth.test.tsView file

Lines 5-45typescript

5import * as path from "node:path";

6import type { FetchImpl } from "../../types";

7import { __resetVertexTokenCache, getVertexAccessToken } from "../google-auth";

9const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"