registry / @patchstack/connect / 0.3.10

@patchstack/connect@0.3.10

Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 239 KB of source, external domains: api.patchstack.com, cdn.patchstack.com, patchstack.com

Source & flagged code

2 flagged

dist/protect.cjsView file

Lines 10-50javascript

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/protect/runtime.js

21var runtime_exports = {};

22__export(runtime_exports, {

23 GUARD_PATH: () => GUARD_PATH,

24 createProtection: () => createProtection,

25 createServerFnGuard: () => createServerFnGuard,

26 createSupabaseGuard: () => createSupabaseGuard

27});

28module.exports = __toCommonJS(runtime_exports);

30// src/protect/engine/client.js

31var DEFAULT_BASE_URL = "https://api.patchstack.com";

32var DEFAULT_CACHE_TTL = 3e5;

33var PatchstackRuleClient = class {

34 #token;

35 #baseUrl;

36 #cacheTtl;

37 #cache = null;

38 #cacheTime = null;

39 constructor({ token, baseUrl, cacheTtl } = {}) {

40 this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;

41 this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

42 this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;

43 if (!this.#token) {

44 throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");

45 }

46 }

47 async getRules() {

48 const now = Date.now();

49 if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {

50 return this.#cache;

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.3.6 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.3.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/protect.cjsView file

30// src/protect/engine/client.js L31: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L32: var DEFAULT_CACHE_TTL = 3e5; ... L39: constructor({ token, baseUrl, cacheTtl } = {}) { L40: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L41: this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL; ... L61: }, L62: body: JSON.stringify({}), L63: signal: AbortSignal.timeout(3e4) ... L73: } L74: const data = await response.json(); L75: const result = {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

dist/index.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

Findings

2 High3 Medium5 Low

HighCloud Metadata Accessdist/protect.cjs

HighPrevious Version Dangerous Deltadist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/protect.cjsView file

Lines 10-50javascript

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/protect/runtime.js

21var runtime_exports = {};

22__export(runtime_exports, {

23 GUARD_PATH: () => GUARD_PATH,

24 createProtection: () => createProtection,

25 createServerFnGuard: () => createServerFnGuard,

26 createSupabaseGuard: () => createSupabaseGuard

27});

28module.exports = __toCommonJS(runtime_exports);

30// src/protect/engine/client.js

31var DEFAULT_BASE_URL = "https://api.patchstack.com";

32var DEFAULT_CACHE_TTL = 3e5;

33var PatchstackRuleClient = class {

34 #token;

35 #baseUrl;

36 #cacheTtl;

37 #cache = null;

38 #cacheTime = null;

39 constructor({ token, baseUrl, cacheTtl } = {}) {

40 this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;

41 this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.cjsView on unpkg · L30

42 this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;

43 if (!this.#token) {

44 throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");

45 }

46 }

47 async getRules() {

48 const now = Date.now();

49 if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {

50 return this.#cache;

dist/index.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg