@querygraph/verdun@0.5.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@querygraph/verdun@0.5.0: Suspicious npm security report (Warn) | LPM Firewall

scripts/smoke-email-auth-postgres.mjsView file

48patternName = generic_password severity = medium line = 48 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L48

87patternName = generic_password severity = medium line = 87 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L87

95patternName = generic_password severity = medium line = 95 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L95

137patternName = generic_password severity = medium line = 137 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L137

143patternName = generic_password severity = medium line = 143 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L143

175patternName = generic_password severity = medium line = 175 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L175

211patternName = generic_password severity = medium line = 211 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L211

214patternName = generic_password severity = medium line = 214 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L214

246patternName = generic_password severity = medium line = 246 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L246

262patternName = generic_password severity = medium line = 262 matchedText = purpose:....4',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L262

scripts/smoke-account-store.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process'

3import { mkdir, mkdtemp, readFile } from 'node:fs/promises'

High

Child Process

Package source references child process execution.

scripts/smoke-account-store.mjsView on unpkg · L1

4import { join } from 'node:path'

5import { pathToFileURL } from 'node:url'

6

7const artifactRoot = new URL('../.codex-artifacts/', import.meta.url)

8await mkdir(artifactRoot, { recursive: true })

9const outDir = await mkdtemp(new URL('account-store-smoke-', artifactRoot))

10const compile = spawnSync('node_modules/.bin/tsc', [

11 '--ignoreConfig',

12 '--outDir',

13 outDir,

14 '--module',

15 'NodeNext',

16 '--moduleResolution',

17 'NodeNext',

18 '--target',

19 'ES2022',

20 '--types',

21 'node',

23 'src/accounts/account-types.ts',

24 'src/accounts/http.ts',

25 'src/accounts/store.ts',

26], {

27 cwd: new URL('..', import.meta.url),

28 stdio: 'inherit',

29})

30if (compile.error) throw compile.error

31if (compile.status !== 0) throw new Error(`Verdun account store smoke TypeScript compile exited with ${compile.status}`)

32

33const {

34 createVerdunAccountSession,

35 currentVerdunAccount,

36 deleteExpiredVerdunAccountSessions,

37 hashVerdunSessionToken,

38 recordVerdunAccountUsage,

39 revokeVerdunAccountSession,

40 updateVerdunAccountStatus,

41 upsertVerdunGoogleAccount,

42 verdunAdminEmailsFromEnv,

43 verdunAccountUsage,

44} = await import(pathToFileURL(join(outDir, 'store.js')).href)

45const {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-account-store.mjsView on unpkg · L43

46 clearVerdunSessionCookie,

47 verdunAccountCookieName,

48 verdunCookieValue,

49 verdunDefaultSessionMaxAgeSeconds,

50 verdunSessionCookie,

51} = await import(pathToFileURL(join(outDir, 'http.js')).href)

52const {

53 isVerdunAccountStatus,

54 isVerdunAccountTier,

55 verdunAccountStatuses,

56 verdunAccountTiers,

57 verdunPublicAccount,

58} = await import(pathToFileURL(join(outDir, 'account-types.js')).href)

59

60const sql = fakeSql()

61const accountStoreSource = await readFile(new URL('../src/accounts/store.ts', import.meta.url), 'utf8')

62if (!accountStoreSource.includes('and exists (select 1 from inserted_subject)\n )\n returning used')) {

63 throw new Error('distinct-subject usage SQL must close the update predicate before returning used')

scripts/deploy-workbench-database.mjsView file

Lines 141-181javascript

141 ? 'generic workbench database load applied and deployed database gate passed'

142 : 'generic workbench database deployment preflight passed (dry run only; add --apply to load external Postgres)')

143}

144

145function optionValue(args, name) {

146 const index = args.indexOf(name)

147 if (index < 0) return undefined

148 const value = args[index + 1]

149 if (!value || value.startsWith('--')) throw new Error(`${name} requires a value`)

150 return value

151}

152

153function repeatArg(name, values) {

154 return values.flatMap((value) => [name, value])

155}

156

157function assertFile(path, label) {

158 if (!existsSync(path)) throw new Error(`${label} not found: ${path}`)

159}

160

161function assertVercelDatabaseEnv() {

162 const result = spawnSync('npx', ['vercel', 'env', 'ls', 'production'], {

163 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/deploy-workbench-database.mjsView on unpkg · L161

164 })

165 if (result.error) throw result.error

166 if (result.status !== 0) {

167 throw new Error(`could not inspect Vercel production env vars; run \`npx vercel env ls production\` from the linked project\n${result.stderr}`)

168 }

169 const output = `${result.stdout}\n${result.stderr}`

170 const configuredName = ['POSTGRES_URL', 'DATABASE_URL', 'NEON_DATABASE_URL'].find((name) => output.includes(name))

171 if (!configuredName) {

172 throw new Error('Vercel production is missing POSTGRES_URL, DATABASE_URL, or NEON_DATABASE_URL. Add one with `npx vercel env add POSTGRES_URL production`, redeploy, then rerun this command.')

173 }

174 console.log(`verified Vercel production database env var: ${configuredName}`)

175}

176

177function run(command, commandArgs) {

178 const result = spawnSync(command, commandArgs, { stdio: 'inherit' })

179 if (result.error) throw result.error

180 if (result.status !== 0) {

181 throw new Error(`${command} ${commandArgs.join(' ')} exited with ${result.status}`)

scripts/smoke-email-auth-postgres.mjsView file

Lines 28-115javascript

28await admin.connect()

29try {

30 await admin.query(`create database ${databaseName}`)

31 client = new Client({ database: databaseName, host: '/tmp' })

32 await client.connect()

33 const sql = { query: async (text, params = []) => (await client.query(text, params)).rows }

34

35 await client.query(await readFile(new URL('../db/migrations/0004_accounts.sql', import.meta.url), 'utf8'))

36 const identityMigration = await readFile(new URL('../db/migrations/0005_multi_identity_auth.sql', import.meta.url), 'utf8')

37 await client.query(identityMigration)

38

39 const google = await upsertVerdunGoogleAccount(sql, {

40 sub: 'google-person',

41 email: 'person@example.test',

42 name: 'Person',

43 pictureUrl: null,

44 }, [])

45 const registration = await requestVerdunEmailChallenge(sql, {

46 purpose: 'verify_email',

47 email: google.email,

48 password: 'initial-password-value',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L48

49 authPepper: pepper,

50 ipAddress: '192.0.2.1',

51 })

52 assert(registration, 'Google account should be eligible to link an email/password identity')

53 const storedChallenge = (await client.query(

54 'select token_hash, code_hash, pending_password_hash from verdun_auth_challenge where id = $1',

55 [registration.id],

56 )).rows[0]

57 assert(storedChallenge.token_hash === hashVerdunEmailLinkToken(registration.token), 'stored token hash mismatch')

58 assert(storedChallenge.code_hash === hashVerdunEmailCode(registration.id, registration.code, pepper), 'stored code hash mismatch')

59 assert(!JSON.stringify(storedChallenge).includes(registration.token), 'database leaked raw link token')

60 assert(!JSON.stringify(storedChallenge).includes(registration.code), 'database leaked raw six-digit code')

61

62 const linked = await completeVerdunEmailChallenge(sql, {

63 challengeId: registration.id,

64 purpose: 'verify_email',

65 proof: { kind: 'code', code: registration.code },

66 authPepper: pepper,

67 ipAddress: '192.0.2.1',

68 })

69 assert(linked.account.id === google.id, 'Google to email linking changed the account id')

70 const linkedIdentities = (await client.query(

71 'select provider, password_hash is not null as has_password from verdun_account_identity where account_id = $1 order by provider',

72 [google.id],

73 )).rows

74 assert(linkedIdentities.length === 2, `expected two linked identities, got ${JSON.stringify(linkedIdentities)}`)

75 assert(linkedIdentities.some((row) => row.provider === 'google' && !row.has_password), 'Google identity missing')

76 assert(linkedIdentities.some((row) => row.provider === 'email' && row.has_password), 'email/password identity missing')

77 await expectError(() => completeVerdunEmailChallenge(sql, {

78 challengeId: registration.id,

79 purpose: 'verify_email',

80 proof: { kind: 'link', token: registration.token },

81 authPepper: pepper,

82 ipAddress: '192.0.2.1',

83 }), 'email_challenge_invalid')

84

85 const passwordLogin = await authenticateVerdunEmailPassword(sql, {

86 email: google.email,

87 password: 'initial-password-value',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L87

88 authPepper: pepper,

89 ipAddress: '192.0.2.1',

90 })

91 assert(passwordLogin.account.id === google.id, 'password login resolved a different account')

92 const duplicateRegistration = await requestVerdunEmailChallenge(sql, {

93 purpose: 'verify_email',

94 email: google.email,

95 password: 'should-not-overwrite-password',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L95

96 authPepper: pepper,

97 ipAddress: '192.0.2.1',

98 })

99 assert(duplicateRegistration === null, 'existing email/password signup should be suppressed')

100 await client.query("delete from verdun_auth_rate_bucket where scope = 'email_challenge:email'")

101

102 const reset = await requestVerdunEmailChallenge(sql, {

103 purpose: 'password_reset',

104 email: google.email,

105 authPepper: pepper,

106 ipAddress: '192.0.2.1',

107 })

108 assert(reset, 'password reset challenge was suppressed for an existing active account')

109 await expectError(() => completeVerdunEmailChallenge(sql, {

110 challengeId: reset.id,

111 purpose: 'password_reset',

112 proof: { kind: 'code', code: reset.code === '999999' ? '888888' : '999999' },

113 newPassword: 'replacement-password-value',

114 authPepper: pepper,

115 ipAddress: '192.0.2.1',

137patternName = generic_password severity = medium line = 137 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L137

143patternName = generic_password severity = medium line = 143 matchedText = password...ue',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L143

175patternName = generic_password severity = medium line = 175 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L175

211patternName = generic_password severity = medium line = 211 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L211

214patternName = generic_password severity = medium line = 214 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L214

246patternName = generic_password severity = medium line = 246 matchedText = purpose:....3',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L246

262patternName = generic_password severity = medium line = 262 matchedText = purpose:....4',

Medium

Secret Pattern

Hardcoded password in scripts/smoke-email-auth-postgres.mjs

scripts/smoke-email-auth-postgres.mjsView on unpkg · L262