registry / @rawdash/connector-firebase-crashlytics / 0.29.1

@rawdash/connector-firebase-crashlytics@0.29.1

Rawdash connector for Firebase Crashlytics - syncs daily crash counts, crash-free user rate, and top issues from the Crashlytics -> BigQuery export

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime sync obtains a Google OAuth token and queries BigQuery for Crashlytics export data only when the Rawdash connector is configured and invoked.

Static reason

One or more suspicious static signals were detected.

Trigger

User configures and runs the Rawdash connector sync

Impact

Reads configured Firebase Crashlytics BigQuery export data into Rawdash storage

Mechanism

OAuth token exchange and BigQuery read queries

Rationale

The scanner's secret finding is explained by schema and request construction for user-provided Google credentials, not embedded secrets or exfiltration. Source inspection shows package-aligned Google OAuth/BigQuery access with no lifecycle execution, persistence, shell execution, filesystem mutation, or suspicious endpoints.

Evidence

package.jsondist/index.jsREADME.mddist/index.js.mapdist/index.d.ts

Network endpoints2

oauth2.googleapis.com/tokenbigquery.googleapis.com/bigquery/v2

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks or bin entrypoints.
dist/index.js only exports a Rawdash connector class and helper functions; no import-time side effects found.
Credential fields are user-supplied Google service account or refresh-token material used to request OAuth tokens from Google.
Network access is limited to Google OAuth and BigQuery APIs aligned with Firebase Crashlytics BigQuery export.
No child_process, eval/Function, dynamic require/import, filesystem writes, persistence, or AI-agent control-surface writes found.
README.md documents the same Google BigQuery/Crashlytics connector behavior.

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 29.6 KB of source, external domains: bigquery.googleapis.com, firebase.google.com, oauth2.googleapis.com, rawdash.dev, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 10-50javascript

10});

11var tokenResponseSchema = z.object({

12 access_token: z.string().min(1),

13 expires_in: z.number().int().positive().optional()

14});

15function base64urlFromBytes(bytes) {

16 let binary = "";

17 for (let i = 0; i < bytes.length; i++) {

18 binary += String.fromCharCode(bytes[i]);

19 }

20 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

21}

22function base64urlFromString(str) {

23 return base64urlFromBytes(new TextEncoder().encode(str));

24}

25async function signRS256JWT(payload, privateKeyPem) {

26 const header = { alg: "RS256", typ: "JWT" };

27 const headerB64 = base64urlFromString(JSON.stringify(header));

28 const payloadB64 = base64urlFromString(JSON.stringify(payload));

29 const signingInput = `${headerB64}.${payloadB64}`;

30 const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

31 const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));

32 const key = await globalThis.crypto.subtle.importKey(

33 "pkcs8",

34 der,

35 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

36 false,

37 ["sign"]

38 );

39 const signature = await globalThis.crypto.subtle.sign(

40 "RSASSA-PKCS1-v1_5",

41 key,

42 new TextEncoder().encode(signingInput)

43 );

44 return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;

45}

46function parseServiceAccountJson(value) {

47 if (typeof value === "object" && value !== null) {

48 return serviceAccountKeySchema.parse(value);

49 }

50 if (typeof value !== "string") {

Source & flagged code

2 flagged · loading source

dist/index.jsView file

30patternName = private_key_rsa severity = critical line = 30 matchedText = const pe..."");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

30patternName = private_key_rsa severity = critical line = 30 matchedText = const pe..."");

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

Findings

2 Critical3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 10-50javascript

10});

11var tokenResponseSchema = z.object({

12 access_token: z.string().min(1),

13 expires_in: z.number().int().positive().optional()

14});

15function base64urlFromBytes(bytes) {

16 let binary = "";

17 for (let i = 0; i < bytes.length; i++) {

18 binary += String.fromCharCode(bytes[i]);

19 }

20 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

21}

22function base64urlFromString(str) {

23 return base64urlFromBytes(new TextEncoder().encode(str));

24}

25async function signRS256JWT(payload, privateKeyPem) {

26 const header = { alg: "RS256", typ: "JWT" };

27 const headerB64 = base64urlFromString(JSON.stringify(header));

28 const payloadB64 = base64urlFromString(JSON.stringify(payload));

29 const signingInput = `${headerB64}.${payloadB64}`;

30 const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L30

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L30

31 const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));

32 const key = await globalThis.crypto.subtle.importKey(

33 "pkcs8",

34 der,

35 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

36 false,

37 ["sign"]

38 );

39 const signature = await globalThis.crypto.subtle.sign(

40 "RSASSA-PKCS1-v1_5",

41 key,

42 new TextEncoder().encode(signingInput)

43 );

44 return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;

45}

46function parseServiceAccountJson(value) {

47 if (typeof value === "object" && value !== null) {

48 return serviceAccountKeySchema.parse(value);

49 }

50 if (typeof value !== "string") {