registry / @rmdes/indiekit-endpoint-activitypub / 3.13.19

@rmdes/indiekit-endpoint-activitypub@3.13.19

ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 116 file(s), 782 KB of source, external domains: api.fedidb.org, example.com, getindiekit.com, github.com, ostatus.org, tags.pub, w3id.org, www.w3.org

Source & flagged code

3 flagged

lib/federation-setup.jsView file

Lines 1039-1079javascript

1039 const lines = pem

1040 .replace("-----BEGIN PUBLIC KEY-----", "")

1041 .replace("-----END PUBLIC KEY-----", "")

1042 .replace(/\s/g, "");

1043 const der = Uint8Array.from(atob(lines), (c) => c.charCodeAt(0));

1044 return crypto.subtle.importKey(

1045 "spki",

1046 der,

1047 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

1048 true,

1049 ["verify"],

1050 );

1051}

1052

1053/**

1054 * Import a PKCS#8 PEM private key using Web Crypto API.

1055 * Fedify's importPem only handles PKCS#1, but Node.js crypto generates PKCS#8.

1056 */

1057async function importPkcs8Pem(pem) {

1058 const lines = pem

1059 .replace("-----BEGIN PRIVATE KEY-----", "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/federation-setup.jsView on unpkg · L1059

Critical

Secret Pattern

RSA private key in lib/federation-setup.js

lib/federation-setup.jsView on unpkg · L1059

1060 .replace("-----END PRIVATE KEY-----", "")

1061 .replace(/\s/g, "");

1062 const der = Uint8Array.from(atob(lines), (c) => c.charCodeAt(0));

1063 return crypto.subtle.importKey(

1064 "pkcs8",

1065 der,

1066 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

1067 true,

1068 ["sign"],

1069 );

1070}

1071

1072/**

1073 * Format an attachment value for ActivityPub PropertyValue.

1074 * If the value looks like a URL, wrap it in an HTML anchor tag with rel="me"

1075 * so Mastodon can verify profile link ownership. Plain text values pass through.

1076 */

1077function formatAttachmentValue(value) {

1078 if (!value) return "";

1079 const trimmed = value.trim();

lib/jf2-to-as2.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rmdes/indiekit-endpoint-activitypub@3.13.14 matchedIdentity = npm:[redacted]:3.13.14 similarity = 0.904 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/jf2-to-as2.jsView on unpkg

Source & flagged code

3 flagged · loading source

lib/federation-setup.jsView file

1059patternName = private_key_rsa severity = critical line = 1059 matchedText = .replace... "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/federation-setup.jsView on unpkg · L1059

1059patternName = private_key_rsa severity = critical line = 1059 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in lib/federation-setup.js

lib/federation-setup.jsView on unpkg · L1059

lib/jf2-to-as2.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/jf2-to-as2.jsView on unpkg

Findings

2 Critical1 High1 Medium3 Low

CriticalCritical Secretlib/federation-setup.js

CriticalSecret Patternlib/federation-setup.js

HighPrevious Version Dangerous Deltalib/jf2-to-as2.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/federation-setup.jsView file

Lines 1039-1079javascript

1039 const lines = pem

1040 .replace("-----BEGIN PUBLIC KEY-----", "")

1041 .replace("-----END PUBLIC KEY-----", "")

1042 .replace(/\s/g, "");

1043 const der = Uint8Array.from(atob(lines), (c) => c.charCodeAt(0));

1044 return crypto.subtle.importKey(

1045 "spki",

1046 der,

1047 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

1048 true,

1049 ["verify"],

1050 );

1051}

1052

1053/**

1054 * Import a PKCS#8 PEM private key using Web Crypto API.

1055 * Fedify's importPem only handles PKCS#1, but Node.js crypto generates PKCS#8.

1056 */

1057async function importPkcs8Pem(pem) {

1058 const lines = pem

1059 .replace("-----BEGIN PRIVATE KEY-----", "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/federation-setup.jsView on unpkg · L1059

Critical

Secret Pattern

RSA private key in lib/federation-setup.js

lib/federation-setup.jsView on unpkg · L1059

1060 .replace("-----END PRIVATE KEY-----", "")

1061 .replace(/\s/g, "");

1062 const der = Uint8Array.from(atob(lines), (c) => c.charCodeAt(0));

1063 return crypto.subtle.importKey(

1064 "pkcs8",

1065 der,

1066 { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },

1067 true,

1068 ["sign"],

1069 );

1070}

1071

1072/**

1073 * Format an attachment value for ActivityPub PropertyValue.

1074 * If the value looks like a URL, wrap it in an HTML anchor tag with rel="me"

1075 * so Mastodon can verify profile link ownership. Plain text values pass through.

1076 */

1077function formatAttachmentValue(value) {

1078 if (!value) return "";

1079 const trimmed = value.trim();

lib/jf2-to-as2.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/jf2-to-as2.jsView on unpkg