registry / @rockcarver/frodo-lib / 4.0.0

@rockcarver/frodo-lib@4.0.0

A library to manage ForgeRock Identity Cloud tenants, ForgeOps deployments, and classic deployments.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 796 KB of source, external domains: feross.org, github.com, ilee.co.uk, raw.githubusercontent.com, www.apache.org, www.w3.org

Oversized source lightweight scan

dist/index.js7.56 MB file, sampled 256 KB

HighEntropyStrings

dist/index.mjs7.53 MB file, sampled 256 KB

HighEntropyStringsUrlStringsfeross.orggithub.comilee.co.ukraw.githubusercontent.comwww.apache.org

Source & flagged code

11 flagged

types/lib/FrodoLib.d.tsView file

Lines 249-289typescript

249 * state.setUsername('admin');

250 * state.setPassword('p@ssw0rd!');

251 *

252 * // now the library can login

253 * frodo.login.getTokens();

254 *

255 * // and perform operations

256 * frodo.authn.journey.exportJourney('Login');

257 * ```

258 *

259 * If your application needs to connect to multiple ForgeRock Identity Platform instances

260 * simultaneously, then you will want to create additional frodo instances using any of

261 * the available factory methods accessible from the default instance:

262 *

263 * {@link frodo.createInstance}

264 * ```javascript

265 * // use factory method to create a new Frodo instance

266 * const instance1 = frodo.createInstance({

267 * host: 'https://instance1/am',

268 * username: 'admin',

269 * password: 'p@ssw0rd!',

Medium

Secret Pattern

Hardcoded password in types/lib/FrodoLib.d.ts

types/lib/FrodoLib.d.tsView on unpkg · L269

270 * });

271 *

272 * // now the instance can login

273 * instance1.login.getTokens();

274 *

275 * // and perform operations

276 * instance1.authn.journey.exportJourney('Login');

277 * ```

278 *

279 * {@link frodo.createInstanceWithAdminAccount}

280 * ```javascript

281 * // use factory method to create a new Frodo instance ready to login with an admin user account

282 * const instance2 = frodo.createInstanceWithAdminAccount(

283 * 'https://instance2/am',

284 * 'admin',

285 * 'p@ssw0rd!'

286 * );

287 *

288 * // now the instance can login

289 * instance2.login.getTokens();

Lines 296-336typescript

296 * ```javascript

297 * // use factory method to create a new Frodo instance ready to login with a service account

298 * const instance3 = frodo.createInstanceWithServiceAccount(

299 * 'https://instance3/am',

300 * 'serviceAccount',

301 * '{"k":"jwk"}'

302 * );

303 *

304 * // now the instance can login

305 * instance3.login.getTokens();

306 *

307 * // and perform operations

308 * instance3.authn.journey.exportJourney('Login');

build.zipView file

•path = build.zip kind = high_entropy_blob sizeBytes = 10927672 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build.zipView on unpkg

•path = build.zip kind = compressed_blob sizeBytes = 10927672 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build.zipView on unpkg

•path = build.zip kind = nested_archive_needs_inspection sizeBytes = 10927672 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

build.zipView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 7923020 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

dist/index.d.mtsView file

Lines 8895-8935typescript

8895 * state.setUsername('admin');

8896 * state.setPassword('p@ssw0rd!');

8897 *

8898 * // now the library can login

8899 * frodo.login.getTokens();

8900 *

8901

dist/index.d.tsView file

Lines 8895-8935typescript

8895 * state.setUsername('admin');

8896 * state.setPassword('p@ssw0rd!');

8897 *

8898 * // now the library can login

8899 * frodo.login.getTokens();

8900 *

8901

Source & flagged code

11 flagged · loading source

types/lib/FrodoLib.d.tsView file

316patternName = private_key_rsa severity = critical line = 316 matchedText = * '---.....',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

types/lib/FrodoLib.d.tsView on unpkg · L316

316patternName = private_key_rsa severity = critical line = 316 matchedText = * '---.....',

Critical

Secret Pattern

RSA private key in types/lib/FrodoLib.d.ts

types/lib/FrodoLib.d.tsView on unpkg · L316

269patternName = generic_password severity = medium line = 269 matchedText = * pas...d!',

Medium

Secret Pattern

Hardcoded password in types/lib/FrodoLib.d.ts

types/lib/FrodoLib.d.tsView on unpkg · L269

build.zipView file

•path = build.zip kind = high_entropy_blob sizeBytes = 10927672 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build.zipView on unpkg

•path = build.zip kind = compressed_blob sizeBytes = 10927672 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build.zipView on unpkg

•path = build.zip kind = nested_archive_needs_inspection sizeBytes = 10927672 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

build.zipView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 7923020 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

dist/index.d.mtsView file

8962patternName = private_key_rsa severity = critical line = 8962 matchedText = * '---.....',

Critical

Secret Pattern

RSA private key in dist/index.d.mts

dist/index.d.mtsView on unpkg · L8962

8915patternName = generic_password severity = medium line = 8915 matchedText = * pas...d!',

Medium

Secret Pattern

Hardcoded password in dist/index.d.mts

dist/index.d.mtsView on unpkg · L8915

dist/index.d.tsView file

8962patternName = private_key_rsa severity = critical line = 8962 matchedText = * '---.....',

Critical

Secret Pattern

RSA private key in dist/index.d.ts

dist/index.d.tsView on unpkg · L8962

8915patternName = generic_password severity = medium line = 8915 matchedText = * pas...d!',

Medium

Secret Pattern

Hardcoded password in dist/index.d.ts

dist/index.d.tsView on unpkg · L8915

Findings

4 Critical2 High5 Medium5 Low

CriticalCritical Secrettypes/lib/FrodoLib.d.ts

CriticalSecret Patterntypes/lib/FrodoLib.d.ts

CriticalSecret Patterndist/index.d.mts

CriticalSecret Patterndist/index.d.ts

HighShips High Entropy Blobbuild.zip

HighOversized Source Filedist/index.js

MediumShips Compressed Blobbuild.zip

MediumStructural Risk Force Deep Review

MediumSecret Patterntypes/lib/FrodoLib.d.ts

MediumSecret Patterndist/index.d.mts

MediumSecret Patterndist/index.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionbuild.zip

Source & flagged code

11 flagged

types/lib/FrodoLib.d.tsView file

Lines 249-289typescript

249 * state.setUsername('admin');

250 * state.setPassword('p@ssw0rd!');

251 *

252 * // now the library can login

253 * frodo.login.getTokens();

254 *

255 * // and perform operations

256 * frodo.authn.journey.exportJourney('Login');

257 * ```

258 *

259 * If your application needs to connect to multiple ForgeRock Identity Platform instances

260 * simultaneously, then you will want to create additional frodo instances using any of

261 * the available factory methods accessible from the default instance:

262 *

263 * {@link frodo.createInstance}

264 * ```javascript

265 * // use factory method to create a new Frodo instance

266 * const instance1 = frodo.createInstance({

267 * host: 'https://instance1/am',

268 * username: 'admin',

269 * password: 'p@ssw0rd!',

Medium

Secret Pattern

Hardcoded password in types/lib/FrodoLib.d.ts

types/lib/FrodoLib.d.tsView on unpkg · L269

270 * });

271 *

272 * // now the instance can login

273 * instance1.login.getTokens();

274 *

275 * // and perform operations

276 * instance1.authn.journey.exportJourney('Login');

277 * ```

278 *

279 * {@link frodo.createInstanceWithAdminAccount}

280 * ```javascript

281 * // use factory method to create a new Frodo instance ready to login with an admin user account

282 * const instance2 = frodo.createInstanceWithAdminAccount(

283 * 'https://instance2/am',

284 * 'admin',

285 * 'p@ssw0rd!'

286 * );

287 *

288 * // now the instance can login

289 * instance2.login.getTokens();

Lines 296-336typescript

296 * ```javascript

297 * // use factory method to create a new Frodo instance ready to login with a service account

298 * const instance3 = frodo.createInstanceWithServiceAccount(

299 * 'https://instance3/am',

300 * 'serviceAccount',

301 * '{"k":"jwk"}'

302 * );

303 *

304 * // now the instance can login

305 * instance3.login.getTokens();

306 *

307 * // and perform operations

308 * instance3.authn.journey.exportJourney('Login');

build.zipView file

•path = build.zip kind = high_entropy_blob sizeBytes = 10927672 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build.zipView on unpkg

•path = build.zip kind = compressed_blob sizeBytes = 10927672 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build.zipView on unpkg

•path = build.zip kind = nested_archive_needs_inspection sizeBytes = 10927672 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

build.zipView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 7923020 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

dist/index.d.mtsView file

Lines 8895-8935typescript

8895 * state.setUsername('admin');

8896 * state.setPassword('p@ssw0rd!');

8897 *

8898 * // now the library can login

8899 * frodo.login.getTokens();

8900 *

8901

dist/index.d.tsView file

Lines 8895-8935typescript

8895 * state.setUsername('admin');

8896 * state.setPassword('p@ssw0rd!');

8897 *

8898 * // now the library can login

8899 * frodo.login.getTokens();

8900 *

8901