registry / @reproapp/node-sdk / 0.0.39

@reproapp/node-sdk@0.0.39

Repro Nest SDK

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 26 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 1.08 MB of source, external domains: repro.local

Source & flagged code

20 flagged

test/privacy-runtime-policy.test.jsView file

Lines 27-112javascript

27 sid: 'drop-webhook-secret',

28 when: {

29 scope: 'FIELD',

30 selector: 'field:webhookSecret',

31 target: 'db.query.metadata.webhookSecret|trace.returnValue.metadata.webhookSecret|response.body.data.metadata.webhookSecret',

Source & flagged code

20 flagged · loading source

test/privacy-runtime-policy.test.jsView file

49patternName = github_pat severity = critical line = 49 matchedText = provider...90',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/privacy-runtime-policy.test.jsView on unpkg · L49

49patternName = github_pat severity = critical line = 49 matchedText = provider...90',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L49

53patternName = stripe_live_restricted severity = critical line = 53 matchedText = 'x-api-k...90',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L53

92patternName = stripe_live_restricted severity = critical line = 92 matchedText = apiKey: ...90',

Critical

Secret Pattern

Stripe live restricted key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L92

391patternName = stripe_live_secret severity = critical line = 391 matchedText = message:...f.',

Critical

Secret Pattern

Stripe live secret key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L391

400patternName = github_pat severity = critical line = 400 matchedText = token: '...90',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L400

429patternName = stripe_live_secret severity = critical line = 429 matchedText = assert(!...ge);

Critical

Secret Pattern

Stripe live secret key in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L429

430patternName = github_pat severity = critical line = 430 matchedText = assert(!...ge);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L430

657patternName = github_pat severity = critical line = 657 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L657

670patternName = github_pat severity = critical line = 670 matchedText = assert(!...te);

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L670

683patternName = github_pat severity = critical line = 683 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L683

722patternName = github_pat severity = critical line = 722 matchedText = message:...23',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L722

728patternName = github_pat severity = critical line = 728 matchedText = /^Provid...3$/,

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L728

1055patternName = github_pat severity = critical line = 1055 matchedText = statusNo...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1055

1067patternName = github_pat severity = critical line = 1067 matchedText = 'Manual ...w.',

Critical

Secret Pattern

GitHub personal access token in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1067

47patternName = stripe_webhook_secret severity = high line = 47 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L47

190patternName = stripe_webhook_secret severity = high line = 190 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L190

474patternName = stripe_webhook_secret severity = high line = 474 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L474

1208patternName = stripe_webhook_secret severity = high line = 1208 matchedText = webhookS...yz',

High

Secret Pattern

Stripe webhook signing secret in test/privacy-runtime-policy.test.js

test/privacy-runtime-policy.test.jsView on unpkg · L1208

tracer/runtime.jsView file

1// runtime.js L2: const { AsyncLocalStorage } = require('node:async_hooks'); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tracer/runtime.jsView on unpkg · L1

Findings

15 Critical4 High3 Medium4 Low

CriticalCritical Secrettest/privacy-runtime-policy.test.js

CriticalSecret Patterntest/privacy-runtime-policy.test.js

HighSecret Patterntest/privacy-runtime-policy.test.js

MediumDynamic Requiretracer/runtime.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings