registry / @openparachute/vault / 0.6.4

@openparachute/vault@0.6.4

Agent-native knowledge graph. Notes, tags, links over MCP.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 174 file(s), 3.94 MB of source, external domains: 10.0.0.5, 127.0.0.1, a.example, api.github.com, attacker.example, b.example, bun.sh, example.com, example.test, github.com, gitlab.com, glif.example, hub-302.example, hub.example, hub.example.com, hub.example.ts.net, hub.taildf9ce2.ts.net, issuer.invalid, json-schema.org, nonexistent.parachute.test, old.example, other.example, parachute.computer, parachute.taildf9ce2.ts.net, react.dev, scribe.cloud.example.com, scribe.example, scribe.test, second.example, third.example, vault.example.com, vault.parachute.computer, vault.test, www.apple.com, www.w3.org, x.example, your-hub.example

Source & flagged code

2 flagged

src/routing.test.tsView file

Lines 12-52typescript

12 *

13 * No unscoped `/mcp`, `/api/*`, `/oauth/*` routes exist — every per-vault

14 * resource must name the vault it targets.

15 *

16 * Uses PARACHUTE_HOME override so each test's vaults live in a tmp dir and

17 * never touch ~/.parachute.

18 */

20import { describe, test, expect, beforeAll, beforeEach, afterEach, afterAll } from "bun:test";

21import { rmSync, existsSync, mkdirSync, writeFileSync } from "fs";

22import { join } from "path";

23import { tmpdir } from "os";

24import { generateKeyPair, exportJWK, SignJWT } from "jose";

26const testDir = join(

27 tmpdir(),

28 `vault-routing-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,

29);

30process.env.PARACHUTE_HOME = testDir;

32// Dynamic import after env override so modules pick up the tmp dir.

33const { route, filterVaultListForBinding } = await import("./routing.ts");

34const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/routing.test.tsView on unpkg · L32

35 readGlobalConfig,

36 writeGlobalConfig,

37 writeVaultConfig,

38 resolveDefaultVault,

39 listVaults,

40} = await import("./config.ts");

41// clearVaultStoreCache was added in #111 for exactly this kind of test

42// that wipes its PARACHUTE_HOME between runs — it closes stores silently

43// even when the DB files are already gone.

44const { clearVaultStoreCache, getVaultStore } = await import("./vault-store.ts");

45const { vaultDbPath } = await import("./config.ts");

46const { resetJwksCache, resetRevocationCache } = await import("./hub-jwt.ts");

47const { invalidateUsageCache } = await import("./usage.ts");

49// ---------------------------------------------------------------------------

50// Hub-JWT mint fixture (vault#282 Stage 2 — vault is a pure hub

51// resource-server, so the only mintable user credential is a hub JWT). A fake

52// hub serves JWKS + an empty revocation list; `mintJwt` signs tokens with the

src/cli.tsView file

Lines 4-44typescript

4 * Parachute Vault CLI.

5 *

6 * Usage:

7 * parachute-vault init — set up everything, one command

8 * parachute-vault create <name> — create a new vault

9 * parachute

Source & flagged code

2 flagged · loading source

src/routing.test.tsView file

32// Dynamic import after env override so modules pick up the tmp dir. L33: const { route, filterVaultListForBinding } = await import("./routing.ts"); L34: const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/routing.test.tsView on unpkg · L32

src/cli.tsView file

24// (`bun src/cli.ts …`) and the published package (`bunx @openparachute/vault`) L25: // because package.json ships at the root next to src/. L26: import pkg from "../package.json" with { type: "json" }; ... L170: // are expected to produce *only* their documented output — and because scripts L171: // piping `parachute-vault --version` shouldn't get migration chatter on stderr. L172: const SKIP_MIGRATION = new Set(["help", "--help", "-h", "version", "--version", "-v"]); ... L288: // Guard against a non-numeric PARACHUTE_HUB_PORT producing L289: // `http://127.0.0.1:NaN` — mirror detectHubPresence's Number.isFinite guard. L290: const envPort = process.env.PARACHUTE_HUB_PORT L291: ? Number(process.env.PARACHUTE_HUB_PORT) ... L353: L354: const isMac = process.platform === "darwin";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.tsView on unpkg · L24

Findings

6 Medium5 Low

MediumDynamic Requiresrc/routing.test.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli.ts

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

src/routing.test.tsView file

Lines 12-52typescript

12 *

13 * No unscoped `/mcp`, `/api/*`, `/oauth/*` routes exist — every per-vault

14 * resource must name the vault it targets.

15 *

16 * Uses PARACHUTE_HOME override so each test's vaults live in a tmp dir and

17 * never touch ~/.parachute.

18 */

20import { describe, test, expect, beforeAll, beforeEach, afterEach, afterAll } from "bun:test";

21import { rmSync, existsSync, mkdirSync, writeFileSync } from "fs";

22import { join } from "path";

23import { tmpdir } from "os";

24import { generateKeyPair, exportJWK, SignJWT } from "jose";

26const testDir = join(

27 tmpdir(),

28 `vault-routing-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,

29);

30process.env.PARACHUTE_HOME = testDir;

32// Dynamic import after env override so modules pick up the tmp dir.

33const { route, filterVaultListForBinding } = await import("./routing.ts");

34const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/routing.test.tsView on unpkg · L32

35 readGlobalConfig,

36 writeGlobalConfig,

37 writeVaultConfig,

38 resolveDefaultVault,

39 listVaults,

40} = await import("./config.ts");

41// clearVaultStoreCache was added in #111 for exactly this kind of test

42// that wipes its PARACHUTE_HOME between runs — it closes stores silently

43// even when the DB files are already gone.

44const { clearVaultStoreCache, getVaultStore } = await import("./vault-store.ts");

45const { vaultDbPath } = await import("./config.ts");

46const { resetJwksCache, resetRevocationCache } = await import("./hub-jwt.ts");

47const { invalidateUsageCache } = await import("./usage.ts");

49// ---------------------------------------------------------------------------

50// Hub-JWT mint fixture (vault#282 Stage 2 — vault is a pure hub

51// resource-server, so the only mintable user credential is a hub JWT). A fake

52// hub serves JWKS + an empty revocation list; `mintJwt` signs tokens with the

src/cli.tsView file

Lines 4-44typescript

4 * Parachute Vault CLI.

5 *

6 * Usage:

7 * parachute-vault init — set up everything, one command

8 * parachute-vault create <name> — create a new vault

9 * parachute