registry / @patchstack/connect / 0.3.14

@patchstack/connect@0.3.14

Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 248 KB of source, external domains: api.patchstack.com, cdn.patchstack.com

Source & flagged code

1 flagged

dist/protect.cjsView file

Lines 10-50javascript

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/protect/runtime.js

21var runtime_exports = {};

22__export(runtime_exports, {

23 GUARD_PATH: () => GUARD_PATH,

24 createProtection: () => createProtection,

25 createServerFnGuard: () => createServerFnGuard,

26 createSupabaseGuard: () => createSupabaseGuard

27});

28module.exports = __toCommonJS(runtime_exports);

30// src/protect/engine/client.js

31var DEFAULT_BASE_URL = "https://api.patchstack.com";

32var DEFAULT_CACHE_TTL = 3e5;

33var PatchstackRuleClient = class {

34 #token;

35 #baseUrl;

36 #cacheTtl;

37 #cache = null;

38 #cacheTime = null;

39 constructor({ token, baseUrl, cacheTtl } = {}) {

40 this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;

41 this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

42 this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;

43 if (!this.#token) {

44 throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");

45 }

46 }

47 async getRules() {

48 const now = Date.now();

49 if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {

50 return this.#cache;

Source & flagged code

1 flagged · loading source

dist/protect.cjsView file

30// src/protect/engine/client.js L31: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L32: var DEFAULT_CACHE_TTL = 3e5; ... L39: constructor({ token, baseUrl, cacheTtl } = {}) { L40: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L41: this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL; ... L61: }, L62: body: JSON.stringify({}), L63: signal: AbortSignal.timeout(3e4) ... L73: } L74: const data = await response.json(); L75: const result = {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/protect.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/protect.cjsView file

Lines 10-50javascript

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/protect/runtime.js

21var runtime_exports = {};

22__export(runtime_exports, {

23 GUARD_PATH: () => GUARD_PATH,

24 createProtection: () => createProtection,

25 createServerFnGuard: () => createServerFnGuard,

26 createSupabaseGuard: () => createSupabaseGuard

27});

28module.exports = __toCommonJS(runtime_exports);

30// src/protect/engine/client.js

31var DEFAULT_BASE_URL = "https://api.patchstack.com";

32var DEFAULT_CACHE_TTL = 3e5;

33var PatchstackRuleClient = class {

34 #token;

35 #baseUrl;

36 #cacheTtl;

37 #cache = null;

38 #cacheTime = null;

39 constructor({ token, baseUrl, cacheTtl } = {}) {

40 this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;

41 this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

42 this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;

43 if (!this.#token) {

44 throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");

45 }

46 }

47 async getRules() {

48 const now = Date.now();

49 if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {

50 return this.#cache;