registry / @permission-slip/cli / 0.1.30

@permission-slip/cli@0.1.30

Agent-facing CLI for Permission Slip — register, verify, and interact with Permission Slip servers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 70.1 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 137-177javascript

137 const raw = fs2.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

138 const parts = raw.split(/\s+/);

139 if (parts.length < 2) {

140 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

141 }

142 return `${parts[0]} ${parts[1]}`;

143}

144function loadPrivateKey() {

145 if (!fs2.existsSync(PRIVATE_KEY_FILE)) {

146 throw new Error(

147 `Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`

148 );

149 }

150 const raw = fs2.readFileSync(PRIVATE_KEY_FILE, "utf-8");

151 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

152 return loadOpenSSHPrivateKey(raw);

153 }

154 return crypto.createPrivateKey({ key: raw, format: "pem" });

155}

156function loadOpenSSHPrivateKey(pem) {

157 const b64 = pem.replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "").replace(/-----END OPENSSH PRIVATE KEY-----/, "").replace(/\s+/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L157

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L157

158 const buf = Buffer.from(b64, "base64");

159 const magic = "openssh-key-v1\0";

160 if (buf.slice(0, magic.length).toString("binary") !== magic) {

161 throw new Error("Not a valid OpenSSH private key (bad magic)");

162 }

163 let off = magic.length;

164 const readString = () => {

165 const len = buf.readUInt32BE(off);

166 off += 4;

167 const out = buf.slice(off, off + len);

168 off += len;

169 return out;

170 };

171 const cipher = readString().toString();

172 if (cipher !== "none") {

173 throw new Error(

174 `Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`

175 );

176 }

177 readString();

Source & flagged code

2 flagged · loading source

dist/index.jsView file

157patternName = private_key_openssh severity = critical line = 157 matchedText = const b6..."");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L157

157patternName = private_key_openssh severity = critical line = 157 matchedText = const b6..."");

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L157

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 137-177javascript

137 const raw = fs2.readFileSync(PUBLIC_KEY_FILE, "utf-8").trim();

138 const parts = raw.split(/\s+/);

139 if (parts.length < 2) {

140 throw new Error(`Invalid public key format in ${PUBLIC_KEY_FILE}`);

141 }

142 return `${parts[0]} ${parts[1]}`;

143}

144function loadPrivateKey() {

145 if (!fs2.existsSync(PRIVATE_KEY_FILE)) {

146 throw new Error(

147 `Private key not found at ${PRIVATE_KEY_FILE}. Run 'permission-slip register' to generate one.`

148 );

149 }

150 const raw = fs2.readFileSync(PRIVATE_KEY_FILE, "utf-8");

151 if (raw.includes("BEGIN OPENSSH PRIVATE KEY")) {

152 return loadOpenSSHPrivateKey(raw);

153 }

154 return crypto.createPrivateKey({ key: raw, format: "pem" });

155}

156function loadOpenSSHPrivateKey(pem) {

157 const b64 = pem.replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "").replace(/-----END OPENSSH PRIVATE KEY-----/, "").replace(/\s+/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L157

Critical

Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L157

158 const buf = Buffer.from(b64, "base64");

159 const magic = "openssh-key-v1\0";

160 if (buf.slice(0, magic.length).toString("binary") !== magic) {

161 throw new Error("Not a valid OpenSSH private key (bad magic)");

162 }

163 let off = magic.length;

164 const readString = () => {

165 const len = buf.readUInt32BE(off);

166 off += 4;

167 const out = buf.slice(off, off + len);

168 off += len;

169 return out;

170 };

171 const cipher = readString().toString();

172 if (cipher !== "none") {

173 throw new Error(

174 `Encrypted OpenSSH keys are not supported (cipher: ${cipher}). Decrypt the key with 'ssh-keygen -p -P <pw> -N "" -f <key>' first.`

175 );

176 }

177 readString();