registry / @rawdash/connector-firebase-crashlytics / 0.29.0

@rawdash/connector-firebase-crashlytics@0.29.0

Rawdash connector for Firebase Crashlytics - syncs daily crash counts, crash-free user rate, and top issues from the Crashlytics -> BigQuery export

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is an explicit connector sync that exchanges configured Google credentials for an OAuth token, queries BigQuery Crashlytics exports, and stores metrics/entities via Rawdash storage.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports/configures connector and invokes Rawdash sync

Impact

Reads configured Firebase Crashlytics BigQuery export data into Rawdash storage

Mechanism

Google OAuth token exchange plus BigQuery read queries

Rationale

The scanner secret hit is from schema/docs/code handling user-provided Google service account credentials, not an embedded credential or exfiltration path. The package has no lifecycle execution or persistence and its runtime network access is consistent with the declared Firebase Crashlytics BigQuery connector purpose.

Evidence

package.jsondist/index.jsdist/index.d.tsREADME.md

Network endpoints3

oauth2.googleapis.com/tokenbigquery.googleapis.com/bigquery/v2www.googleapis.com/auth/bigquery.readonly

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.js handles user-supplied Google service account/private key material to mint OAuth tokens.
dist/index.js performs runtime network calls to Google OAuth and BigQuery APIs.

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts or bin entrypoint.
dist/index.js exports a Rawdash Firebase Crashlytics connector; no import-time execution beyond definitions.
Network endpoints are package-aligned: OAuth token exchange and BigQuery Crashlytics export queries.
No child_process, eval/Function, dynamic require/import, filesystem writes, persistence, or AI-agent control-surface writes found.
README.md documents the same serviceAccountJson secret and BigQuery Crashlytics workflow.

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 29.6 KB of source, external domains: bigquery.googleapis.com, firebase.google.com, oauth2.googleapis.com, rawdash.dev, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 10-50javascript

10});

11var tokenResponseSchema = z.object({

12 access_token: z.string().min(1),

13 expires_in: z.number().int().positive().optional()

14});

15function base64urlFromBytes(bytes) {

16 let binary = "";

17 for (let i = 0; i < bytes.length; i++) {

18 binary += String.fromCharCode(bytes[i]);

19 }

20 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

21}

22function base64urlFromString(str) {

23 return base64urlFromBytes(new TextEncoder().encode(str));

24}

25async function signRS256JWT(payload, privateKeyPem) {

26 const header = { alg: "RS256", typ: "JWT" };

27 const headerB64 = base64urlFromString(JSON.stringify(header));

28 const payloadB64 = base64urlFromString(JSON.stringify(payload));

29 const signingInput = `${headerB64}.${payloadB64}`;

30 const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

31 const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));

32 const key = await globalThis.crypto.subtle.importKey(

33 "pkcs8",

34 der,

35 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

36 false,

37 ["sign"]

38 );

39 const signature = await globalThis.crypto.subtle.sign(

40 "RSASSA-PKCS1-v1_5",

41 key,

42 new TextEncoder().encode(signingInput)

43 );

44 return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;

45}

46function parseServiceAccountJson(value) {

47 if (typeof value === "object" && value !== null) {

48 return serviceAccountKeySchema.parse(value);

49 }

50 if (typeof value !== "string") {

Source & flagged code

2 flagged · loading source

dist/index.jsView file

30patternName = private_key_rsa severity = critical line = 30 matchedText = const pe..."");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

30patternName = private_key_rsa severity = critical line = 30 matchedText = const pe..."");

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

Findings

2 Critical3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 10-50javascript

10});

11var tokenResponseSchema = z.object({

12 access_token: z.string().min(1),

13 expires_in: z.number().int().positive().optional()

14});

15function base64urlFromBytes(bytes) {

16 let binary = "";

17 for (let i = 0; i < bytes.length; i++) {

18 binary += String.fromCharCode(bytes[i]);

19 }

20 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

21}

22function base64urlFromString(str) {

23 return base64urlFromBytes(new TextEncoder().encode(str));

24}

25async function signRS256JWT(payload, privateKeyPem) {

26 const header = { alg: "RS256", typ: "JWT" };

27 const headerB64 = base64urlFromString(JSON.stringify(header));

28 const payloadB64 = base64urlFromString(JSON.stringify(payload));

29 const signingInput = `${headerB64}.${payloadB64}`;

30 const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

31 const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));

32 const key = await globalThis.crypto.subtle.importKey(

33 "pkcs8",

34 der,

35 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

36 false,

37 ["sign"]

38 );

39 const signature = await globalThis.crypto.subtle.sign(

40 "RSASSA-PKCS1-v1_5",

41 key,

42 new TextEncoder().encode(signingInput)

43 );

44 return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;

45}

46function parseServiceAccountJson(value) {

47 if (typeof value === "object" && value !== null) {

48 return serviceAccountKeySchema.parse(value);

49 }

50 if (typeof value !== "string") {