registry / @opengovsg/mockpass / 4.6.8

@opengovsg/mockpass@4.6.8

A mock SingPass/CorpPass server for dev purposes

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 437 KB of source, external domains: itunes.apple.com, singpassmobile.sg

Source & flagged code

6 flagged

static/certs/key.pemView file

Lines 1-21text

1-----BEGIN PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

static/certs/key.pemView on unpkg · L1

Critical

Secret Pattern

RSA private key in static/certs/key.pem

static/certs/key.pemView on unpkg · L1

2MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7di8TGHWqMkGm

3SMAsp8K4HrsqqPMJz8TBSsE6R2gRg0u6vzQDZjdHi/arUBbx/x7dsyI8stKW/FLR

4rRjJqJPb7j8Q2PDL51RrWj1d2JYuYdZYxaLuN7UgrjOwPGgi32dI7FpmaG7hpl4/

54aGsyJUudXTEoOX/ifZBlsPUaR2Qbhm7KocmyYZwa1ctTVTqvqnpkOsJOQFeNf3o

6QOhsd9dUV+L9EntU4PZo/angbsjXTi00FiYH36aQevgC45P0+GY6qrhr0WjUTpUu

7eWjgVb/ZkrXSBRTR/nBpyc2KWURHQ0Y3AVahOPYBIX0uJHr/f1vixq1EsDLxHExy

8W9ryIrrJAgMBAAECggEAY8jsE+kQMRFhWqcdDGgcQS+yh2m5PP7Ih+9H3cLGxZOz

9CuvePvT49e+t1NDj9drMTkydK9wwNsiHOS8/o5BFbGtsTIZ93rv7ds1pHvw8LOJN

10W6GQMeebVZME1onBENcEPo/5KsvqQdjyEGUFT1jR+BHznvrakuSYHZ+oC/gMEaVw

11dUsM1849EbLDJ5lOPDDqYwsJwIGEryxRLFP+4HhGR9wnrTVee5CCsH0ep8OqypvY

12xgg9Ytyt1WripwzhXsVzJxahTbO4XImOgv6Uvo3EYfBXm1gbfugGbSiyYHBBx0Pa

137DtYrpRzjeS33m6Y4SJjKERjCbHXChwUrFcMGS5ogQKBgQDeChbIHYRu4HTQYoV9

14pJ70LcHCiE0zaJzuMHes4OFkNAuFXASDGp1HJXd0tol+oeuYO/q1gENvyfBAqDH/

15AVAtWaFvQUNzv/Zs++mbrSSwxuZJCaJAbh9GKzCyCbapxBtdzhgCLLY9GeWRiG1c

16puYUUvJmkcWQE9sSn2tnE8mv2QKBgQDYIjWgagTLPlT3J65t5BEs9fwjAq8bdIIV

17E9o0blIwlKF3FzeUo4Egjc/vfIYOL43AOttuVbVoruvvT13a3+VpCXjxqSYnveuw

18FB0xQC1F0c3ay4Oprjh2qk2GfOy0gikaRgmTUP3nVK1LC57GWJMker/UQ2kWCJCs

19RyMzpgd8cQKBgQCE5q8KKrjJEOp6jG3wbWeDKhwuzxy+Z6B+5V3MiXH/YzN+KDy/

20KF/5ZNCieFvGAy8cGNKQbuxubgWy/bmnM+cErgB1si+oib77LrF+L92lPfg6wVxv

21ijqH6nQkLLI73RiwRhqSuqZ93hFN0cX7zh4rDhbvE9OX0HqxI+DKesqeyQKBgEln

public/mockpass/resources/plugins/bootstrap-3.4.1/fonts/glyphicons-halflings-regular.woff2View file

•path = [redacted]-3.4.1/fonts/glyphicons-halflings-regular.woff2 kind = high_entropy_blob sizeBytes = 18028 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/mockpass/resources/plugins/bootstrap-3.4.1/fonts/glyphicons-halflings-regular.woff2View on unpkg

README.mdView file

Lines 28-68markdown

30In the `/fapi/utils.js file`, you can configure your client JWKS endpoint in the `fapiClientConfiguration`. By default, it is set to `null` and Mockpass will read the default keys that are stored in the `fapi-rp-private.json` and `fapi-rp-public.json` files. If configured, Mockpass will attempt to fetch the JWKS from the specified endpoint.

31Your JWKS endpoint will need to be publicly accessible, and it needs to contain a valid JWKS with a `sig` key and an `enc` key.

33Limitations:

34- `client_id` and `redirect_uri`

public/mockpass/resources/js/login-common.jsView file

Lines 1-31javascript

1/**

2 * Global JS variables related to Login Tab

3 */

4var qrCodeTab = "#qrcodeloginli";

5var loginTab = "#loginli";

7/**

8 * Global JS variables related to password login

9 */

10var

static/certs/spcp-key.pemView file

Lines 1-21text

1-----BEGIN PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in static/certs/spcp-key.pem

static/certs/spcp-key.pemView on unpkg · L1

2MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCvh+VUs79GwMWa

3Co524x5swEaItx3b7NfpV2R2udaXj80x6HJxJHtpK4yqQOOL92qyhjdDVUdZRihY

4YusCNn8k/8B3a/AjUPdIksbjFkq0ZrAzWDcOQb1jZ59yGTWvv5aswSfzUM0nWJv7

5jraDXI2WWDF4MJFoiayCKGPO1YVFw+7928sW7udUMvSdOw3xKqV2HbJ0yU2eZeLE

6vrcVRoRgexjKWb/rSzAaVreJuE5/MJuaOQ3ji+uS0GRkeGwjQbXlAXm+fQ1vPsN8

7enYi7FlfBOc2CPPVBKlXX6TEeiwkVNrYPVNLUqL0WAwiPRq/ROorYyQ+rmmdObRe

89n87ofDjAgMBAAECggEAXXwrD6mLvcr9csUciwT7N0BQUI/2PyMs+wGoZ/Mh7yaP

9Sn1aNhgQAjtHd4WHqwvir6H73MiWb12GL0y/jTYpETOE9hVul+CPUv+ZHWjJ8Lqg

Source & flagged code

6 flagged · loading source

static/certs/key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

static/certs/key.pemView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in static/certs/key.pem

static/certs/key.pemView on unpkg · L1

public/mockpass/resources/plugins/bootstrap-3.4.1/fonts/glyphicons-halflings-regular.woff2View file

•path = [redacted]-3.4.1/fonts/glyphicons-halflings-regular.woff2 kind = high_entropy_blob sizeBytes = 18028 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/mockpass/resources/plugins/bootstrap-3.4.1/fonts/glyphicons-halflings-regular.woff2View on unpkg

README.mdView file

48patternName = private_key_rsa severity = critical line = 48 matchedText = | epheme... |

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L48

public/mockpass/resources/js/login-common.jsView file

11patternName = generic_password severity = medium line = 11 matchedText = var pass...rd";

Medium

Secret Pattern

Hardcoded password in public/mockpass/resources/js/login-common.js

public/mockpass/resources/js/login-common.jsView on unpkg · L11

static/certs/spcp-key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in static/certs/spcp-key.pem

static/certs/spcp-key.pemView on unpkg · L1

Findings

4 Critical1 High4 Medium5 Low

CriticalCritical Secretstatic/certs/key.pem

CriticalSecret PatternREADME.md

CriticalSecret Patternstatic/certs/key.pem

CriticalSecret Patternstatic/certs/spcp-key.pem

HighShips High Entropy Blobpublic/mockpass/resources/plugins/bootstrap-3.4.1/fonts/glyphicons-halflings-regular.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternpublic/mockpass/resources/js/login-common.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings