registry / @pylonsync/webhooks / 0.3.308

@pylonsync/webhooks@0.3.308

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 7 file(s), 23.7 KB of source

Source & flagged code

2 flagged

src/signature.test.tsView file

Lines 1-25typescript

1import { describe, expect, test } from "bun:test";

3import { signWebhook, verifyWebhook } from "./signature";

5const SECRET = "whsec_dGVzdC1zZWNyZXQtdmFsdWU="; // base64('test-secret-value')

High

High Secret

Package contains a high-severity secret pattern.

src/signature.test.tsView on unpkg · L5

High

Secret Pattern

Stripe webhook signing secret in src/signature.test.ts

src/signature.test.tsView on unpkg · L5

6const ID = "evt_test_123";

7const BODY = '{"id":"evt_test_123","type":"x.y","data":{}}';

9describe("webhook signature", () => {

10 test("sign + verify round-trip succeeds", async () => {

11 const ts = 1_700_000_000;

12 const sig = await signWebhook({

13 id: ID,

14 timestamp: ts,

15 body: BODY,

16 secrets: [SECRET],

17 });

18 const result = await verifyWebhook(

19 SECRET,

20 { id: sig.id, timestamp: String(sig.timestamp), signature: sig.signature },

21 BODY,

22 { nowSecs: ts },

23 );

24 expect(result).toBe(true);

25 });

Source & flagged code

2 flagged · loading source

src/signature.test.tsView file

5patternName = stripe_webhook_secret severity = high line = 5 matchedText = const SE...ue')

High

High Secret

Package contains a high-severity secret pattern.

src/signature.test.tsView on unpkg · L5

5patternName = stripe_webhook_secret severity = high line = 5 matchedText = const SE...ue')

High

Secret Pattern

Stripe webhook signing secret in src/signature.test.ts

src/signature.test.tsView on unpkg · L5

Findings

2 High1 Medium2 Low

HighHigh Secretsrc/signature.test.ts

HighSecret Patternsrc/signature.test.ts

MediumNetwork

LowScripts Present

LowNo License

Source & flagged code

2 flagged

src/signature.test.tsView file

Lines 1-25typescript

1import { describe, expect, test } from "bun:test";

3import { signWebhook, verifyWebhook } from "./signature";

5const SECRET = "whsec_dGVzdC1zZWNyZXQtdmFsdWU="; // base64('test-secret-value')

High

High Secret

Package contains a high-severity secret pattern.

src/signature.test.tsView on unpkg · L5

High

Secret Pattern

Stripe webhook signing secret in src/signature.test.ts

src/signature.test.tsView on unpkg · L5

6const ID = "evt_test_123";

7const BODY = '{"id":"evt_test_123","type":"x.y","data":{}}';

9describe("webhook signature", () => {

10 test("sign + verify round-trip succeeds", async () => {

11 const ts = 1_700_000_000;

12 const sig = await signWebhook({

13 id: ID,

14 timestamp: ts,

15 body: BODY,

16 secrets: [SECRET],

17 });

18 const result = await verifyWebhook(

19 SECRET,

20 { id: sig.id, timestamp: String(sig.timestamp), signature: sig.signature },

21 BODY,

22 { nowSecs: ts },

23 );

24 expect(result).toBe(true);

25 });