registry / @realm-id/sdk / 0.16.0

@realm-id/sdk@0.16.0

Partner SDK for Realm ID — login, refresh, MFA, verify, and management

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 113 KB of source, external domains: api.realmid.dev, auth.realmid.dev, metadata.google.internal

Source & flagged code

1 flagged

dist/credential.jsView file

Lines 1-25javascript

1/**

2 * Bootstrap credential sources — ADR-057.

3 *

4 * The SDK exchanges a bootstrap credential once at `POST /auth/login` for a

5 * platform session. A static API key is one source; a workload's ambient OIDC

6 * token (GCP metadata server, GitHub Actions) is another. `fetch()` is called

7 * only on initial login + refresh-death — never per request — so a workload

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/credential.jsView on unpkg · L5

8 * source may mint a fresh short-lived token there.

9 */

10import { RealmError } from "./errors.js";

11export const GRANT_PLATFORM_API_KEY = "platform_api_key";

12export const GRANT_TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";

13export const SUBJECT_TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";

14/**

15 * The global audience the zero-config SDK requests for a workload OIDC token

16 * (ADR-057 §7). Must match the issuer's REALMID_FEDERATION_AUDIENCE. The

17 * tenant boundary is the binding's match_claims, not this aud.

18 */

19export const DEFAULT_FEDERATION_AUDIENCE = "https://api.realmid.dev";

20/** Static API-key source — today's behavior. `RealmConfig.apiKey` is sugar. */

21export function staticApiKey(key) {

22 return {

23 async fetch() {

24 if (!key) {

25 throw new RealmError({

Source & flagged code

1 flagged · loading source

dist/credential.jsView file

5* platform session. A static API key is one source; a workload's ambient OIDC L6: * token (GCP metadata server, GitHub Actions) is another. `fetch()` is called L7: * only on initial login + refresh-death — never per request — so a workload ... L33: } L34: const GCP_METADATA_ID_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/identity"; L35: /** GCP workload identity (Cloud Run / GKE / GCE) via the metadata server. */ ... L55: } L56: const text = (await resp.text()).trim(); L57: if (!resp.ok || !text) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/credential.jsView on unpkg · L5

Findings

1 High2 Medium5 Low

HighCloud Metadata Accessdist/credential.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/credential.jsView file

Lines 1-25javascript

1/**

2 * Bootstrap credential sources — ADR-057.

3 *

4 * The SDK exchanges a bootstrap credential once at `POST /auth/login` for a

5 * platform session. A static API key is one source; a workload's ambient OIDC

6 * token (GCP metadata server, GitHub Actions) is another. `fetch()` is called

7 * only on initial login + refresh-death — never per request — so a workload

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/credential.jsView on unpkg · L5

8 * source may mint a fresh short-lived token there.

9 */

10import { RealmError } from "./errors.js";

11export const GRANT_PLATFORM_API_KEY = "platform_api_key";

12export const GRANT_TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";

13export const SUBJECT_TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";

14/**

15 * The global audience the zero-config SDK requests for a workload OIDC token

16 * (ADR-057 §7). Must match the issuer's REALMID_FEDERATION_AUDIENCE. The

17 * tenant boundary is the binding's match_claims, not this aud.

18 */

19export const DEFAULT_FEDERATION_AUDIENCE = "https://api.realmid.dev";

20/** Static API-key source — today's behavior. `RealmConfig.apiKey` is sugar. */

21export function staticApiKey(key) {

22 return {

23 async fetch() {

24 if (!key) {

25 throw new RealmError({