registry / @reproapp/node-sdk / 0.0.39

@reproapp/node-sdk@0.0.39

Repro Nest SDK

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 26 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 1.08 MB of source, external domains: repro.local

Source & flagged code

20 flagged

test/privacy-runtime-policy.test.jsView file

Lines 27-112javascript

27 sid: 'drop-webhook-secret',

28 when: {

29 scope: 'FIELD',

30 selector: 'field:webhookSecret',

31 target: 'db.query.metadata.webhookSecret|trace.returnValue.metadata.webhookSecret|response.body.data.metadata.webhookSecret',

32 },

33 apply: { action: 'DROP' },

34 meta: { priority: 1 },

35 },

36 ]);

38 const rawPayload = {

39 safeOrderId: 'ORD-123',

40 caseId: 'CASE-53FE88B2',

41 paymentInstrument: {

42 cardLast4: '4242',

43 cvv: '123',

44 fullPan: '4242 4242 4242 4242',

45 },

46 metadata: {

47 webhookSecret: 'whsec_abcdefghijklmnopqrstuvwxyz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L47

48 providerConnection: 'postgres://drill:secret@payments.internal:5432/security',

49 providerToken: 'ghp_abcdefghijklmnopqrstuvwxyz1234567890',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/privacy-runtime-policy.test.jsView on unpkg · L49

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L49

50 supportEmail: 'support@example.com',

51 },

52 headersSnapshot: {

53 'x-api-key': 'rk_live_debugoverride1234567890',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L53

54 cookie: 'sid=SessionSecret123; refresh=RefreshOverrideSecret456',

55 },

56 };

58 const input = {

59 command: 'set',

60 args: ['datalab:drills:by-case:CASE-53FE88B2', JSON.stringify(rawPayload)],

61 };

63 const transformed = await applyRuntimePrivacyPolicyAsync(policy, 'db.query', input, {

64 appId: 'APP_test',

65 appSecret: 'secret',

66 db: { type: 'redis', collection: 'redis', op: 'set' },

67 });

68 const parsed = JSON.parse(transformed.args[1]);

70 assert.strictEqual(transformed.args[0], 'datalab:drills:by-case:CASE-53FE88B2');

71 assert.strictEqual(parsed.safeOrderId, 'ORD-123');

72 assert.strictEqual(parsed.caseId, 'CASE-53FE88B2');

73 assert.strictEqual(parsed.paymentInstrument.cardLast4, '[dropped]');

74 assert.strictEqual(parsed.paymentInstrument.cvv, '[dropped]');

75 assert.strictEqual(parsed.paymentInstrument.fullPan, '[dropped]');

76 assert.strictEqual(parsed.metadata.webhookSecret, '[dropped]');

77 assert.strictEqual(parsed.metadata.providerConnection, '[dropped]');

78 assert.strictEqual(parsed.metadata.providerToken, '[dropped]');

79 assert.match(parsed.metadata.supportEmail, /^email_tok_[a-f0-9]{12}$/);

80 assert.strictEqual(parsed.headersSnapshot['x-api-key'], '[dropped]');

81 assert.strictEqual(parsed.headersSnapshot.cookie, '[dropped]');

82}

84async function testLongSerializedJsonStringsAreTransformedBeforeTruncation() {

85 const rawPayload = {

86 id: '69ed2d5c585264544573ea4f',

87 safeOrderId: 'ORD-123',

88 padding: 'x'.repeat(3000),

89 nested: {

90 cardLast4: '4242',

91 cvv: '123',

92 apiKey: 'rk_live_debugoverride1234567890',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L92

93 customerEmail: 'john@example.com',

94 },

95 };

96 const input = { args: ['cache:key:69ed2d5c585264544573ea4f', JSON.stringify(rawPayload)] };

98 const transformed = await applyRuntimePrivacyPolicyAsync(null, 'db.query', input, {

99 appId: 'APP_test',

100 appSecret: 'secret',

101 db: { type: 'redis', collection: 'redis', op: 'set' },

102 });

103 const parsed = JSON.parse(transformed.args[1]);

104

105 assert.strictEqual(parsed.id, '69ed2d5c585264544573ea4f');

106 assert.strictEqual(parsed.safeOrderId, 'ORD-123');

107 assert.strictEqual(parsed.nested.cardLast4, '[dropped]');

108 assert.strictEqual(parsed.nested.cvv, '[dropped]');

109 assert.strictEqual(parsed.nested.apiKey, '[dropped]');

110 assert.match(parsed.nested.customerEmail, /^email_tok_[a-f0-9]{12}$/);

111}

112

Lines 170-210javascript

170 ]);

171 const serializedProviderPayload = JSON.stringify({

172 providerPayload: {

173 provider: 'signallab-risk-router-v2',

174 status: 'blocked',

175 reasonCode: 'secret_rotation_required',

176 system: {

177 component: 'gateway-router',

178

Lines 371-411javascript

371 { kind: 'literal', text: '{"safeSignalId":"' },

372 { kind: 'slot', label: 'safeSignalId', action: 'KEEP_EXACT' },

373 { kind: 'literal', text: '","email":"' },

374 { kind: 'slot', label:

400patternName = github_pat severity = critical line = 400 matchedText = token: '...90',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L400

429patternName = stripe_live_secret severity = critical line = 429 matchedText = assert(!...ge);

Critical

Secret Pattern

Stripe live secret key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L429

430patternName = github_pat severity = critical line = 430 matchedText = assert(!...ge);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L430

657patternName = github_pat severity = critical line = 657 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L657

670patternName = github_pat severity = critical line = 670 matchedText = assert(!...te);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L670

683patternName = github_pat severity = critical line = 683 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L683

722patternName = github_pat severity = critical line = 722 matchedText = message:...23',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L722

728patternName = github_pat severity = critical line = 728 matchedText = /^Provid...3$/,

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L728

1055patternName = github_pat severity = critical line = 1055 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1055

1067patternName = github_pat severity = critical line = 1067 matchedText = 'Manual ...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1067

474patternName = stripe_webhook_secret severity = high line = 474 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L474

1208patternName = stripe_webhook_secret severity = high line = 1208 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1208

tracer/runtime.jsView file

Lines 1-21javascript

1// runtime.js

2const { AsyncLocalStorage } = require('node:async_hooks');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tracer/runtime.jsView on unpkg · L1

4const als = new AsyncLocalStorage(); // { traceId, depth }

5const listeners

Source & flagged code

20 flagged · loading source

test/privacy-runtime-policy.test.jsView file

49patternName = github_pat severity = critical line = 49 matchedText = provider...90',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/privacy-runtime-policy.test.jsView on unpkg · L49

49patternName = github_pat severity = critical line = 49 matchedText = provider...90',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L49

53patternName = stripe_live_restricted severity = critical line = 53 matchedText = 'x-api-k...90',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L53

92patternName = stripe_live_restricted severity = critical line = 92 matchedText = apiKey: ...90',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L92

391patternName = stripe_live_secret severity = critical line = 391 matchedText = message:...f.',

Critical

Secret Pattern

Stripe live secret key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L391

400patternName = github_pat severity = critical line = 400 matchedText = token: '...90',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L400

429patternName = stripe_live_secret severity = critical line = 429 matchedText = assert(!...ge);

Critical

Secret Pattern

Stripe live secret key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L429

430patternName = github_pat severity = critical line = 430 matchedText = assert(!...ge);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L430

657patternName = github_pat severity = critical line = 657 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L657

670patternName = github_pat severity = critical line = 670 matchedText = assert(!...te);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L670

683patternName = github_pat severity = critical line = 683 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L683

722patternName = github_pat severity = critical line = 722 matchedText = message:...23',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L722

728patternName = github_pat severity = critical line = 728 matchedText = /^Provid...3$/,

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L728

1055patternName = github_pat severity = critical line = 1055 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1055

1067patternName = github_pat severity = critical line = 1067 matchedText = 'Manual ...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1067

47patternName = stripe_webhook_secret severity = high line = 47 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L47

190patternName = stripe_webhook_secret severity = high line = 190 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L190

474patternName = stripe_webhook_secret severity = high line = 474 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L474

1208patternName = stripe_webhook_secret severity = high line = 1208 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1208

tracer/runtime.jsView file

1// runtime.js L2: const { AsyncLocalStorage } = require('node:async_hooks'); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tracer/runtime.jsView on unpkg · L1

Findings

15 Critical4 High3 Medium4 Low

CriticalCritical Secrettest/privacy-runtime-policy.test.js

CriticalSecret Patterntest/privacy-runtime-policy.test.js

HighSecret Patterntest/privacy-runtime-policy.test.js

MediumDynamic Requiretracer/runtime.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings