registry / @salesforce/b2c-tooling-sdk / 1.20.1

@salesforce/b2c-tooling-sdk@1.20.1

Core tooling library for Salesforce B2C Commerce CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 225 file(s), 1.25 MB of source, external domains: api.github.com, cloud.mobify.com, code.visualstudio.com, cursor.com, dc.services.visualstudio.com, developer.salesforce.com, docs.anthropic.com, docs.windsurf.com, github.com, opencode.ai, raw.githubusercontent.com, salesforcecommercecloud.github.io, www.demandware.com

Source & flagged code

19 flagged

dist/esm/clients/cdn-zones.generated.d.tsView file

Lines 1042-1115typescript

1042 * "mtlsCertificateId": "465a48f6-3d98-4c15-9312-211984ee8629",

1043 * "expiresOn": "2022-01-12T04:15:57Z",

1044 * "issuer": "DigiCert",

1045 * "signature": "SHA256WithRSA",

1046 * "uploadedOn": "2020-01-12T04:15:57Z",

1047 * "ca": true,

1048 * "serialNumber": "432217133297895665180570788458463042229861757760",

1049 * "mtlsCertificateName": "mtls_cert_name",

1050 * "mtlsAssociatedCodeUploadHostname": "mtls.cert.salesforce.com"

1051 * }

1052 * ]

1053 * }

1054 */

1055 MtlsCertificatesResponseEnvelope: {

1056 data: components["schemas"]["MtlsCertificateResponse"][];

1057 };

1058 /**

1059 * @description mTLS certificate request information.

1060 * @example {

1061 * "certificate": "-----BEGIN CERTIFICATE-----\nMIIDtTCCAp2gAwIBAgIJAMHAwfXZ5PWMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV\nBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX\naWRnaXRzIFB0eSBMdGQwHhcNMTYwODI0MTY0MzAxWhcNMTYxMTIyMTY0MzAxWjBF\nMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50\nZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmGdtcGbg/1\nCGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKnabIRuGvB\nKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpidtnKX/a+5\n0GjB79CJH4E ...

1062 * "privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG\ndtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn\nabIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid\ntnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py\nFxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE\newooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb\nHBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/\naxiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb\n+ufRBKz ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

1063 * "name": "mtls_cert_name"

1064 * }

1065 */

1066 MtlsCertificateRequest: {

1067 /**

1068 * @description Public key for the CA certificate in mTLS.

1069 * @example -----BEGIN CERTIFICATE-----

1070 * MIIDtTCCAp2gAwIBAgIJAMHAwfXZ5PWMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV

1071 * BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX

1072 * aWRnaXRzIFB0eSBMdGQwHhcNMTYwODI0MTY0MzAxWhcNMTYxMTIyMTY0MzAxWjBF

1073 * MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50

1074 * ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

1075 * CgKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmGdtcGbg/1

1076 * CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKnabIRuGvB

1077 * KwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpidtnKX/a+5

1078 * 0GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+pyFxIXjbEI

1079 * dZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pEewooaeO2

1080 * izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABo4GnMIGkMB0GA1UdDgQWBBT/LbE4

1081 * 9rWf288N6sJA5BRb6FJIGDB1BgNVHSMEbjBsgBT/LbE49rWf288N6sJA5BRb6FJI

1082 * GKFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV

1083 * BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAMHAwfXZ5/PWMAwGA1UdEwQF

1084 * MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHHFwl0tH0quUYZYO0dZYt4R7SJ0pCm2

1085 * 2satiyzHl4OnXcHDpekAo7/a09c6Lz6AU83cKy/+x3/djYHXWba7HpEu0dR3ugQP

1086 * Mlr4zrhd9xKZ0KZKiYmtJH+ak4OM4L3FbT0owUZPyjLSlhMtJVcoRp5CJsjAMBUG

1087 * SvD8RX+T01wzox/Qb+lnnNnOlaWpqu8eoOenybxKp1a9ULzIVvN/LAcc+14vioFq

1088 * 2swRWtmocBAs8QR9n4uvbpiYvS8eYueDCWMM4fvFfBhaDZ3N9IbtySh3SpFdQDhw

1089 * YbjM2rxXiyLGxB4Bol7QTv4zHif7Zt89FReT/NBy4rzaskDJY5L6xmY=

1090 * -----END CERTIFICATE-----

1091 */

1092 certificate: string;

1093 /**

1094 * @description Private key of the CA certificate in mTLS.

1095 * @example -----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1095

1096 * MIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG

1097 * dtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn

1098 * abIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid

1099 * tnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py

1100 * FxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE

1101 * ewooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb

1102 * HBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/

1103 * axiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb

1104 * +ufRBKztPTQ/rYWaYQcgC0RWI20HTFBMxlTAyNxYNWzX7RKFkGVVyB9RsAtmcc8g

1105 * +j4OdosbfNoJPS0HeIfNpAznDfHKdxDk2Yc1tV6RHBrC1ynyLE9+TaflIAdo2MVv

1106 * KLMLq51GqYKtgJFIlBRPQqKoyXdz3fGvXrTkf/WY9QNq0J1Vk5ERePZ54mN8iZB7

1107 * 9lwy/AkCgYEA6FXzosxswaJ2wQLeoYc7ceaweX/SwTvxHgXzRyJIIT0eJWgx13Wo

1108 * /WA3Iziimsjf6qE+SI/8laxPp2A86VMaIt3Z3mJN/CqSVGw8LK2AQst+OwdPyDMu

1109 * iacE8lj/IFGC8mwNUAb9CzGU3JpU4PxxGFjS/eMtGeRXCWkK4NE+G08CgYEA1Kp9

1110 * N2JrVlqUz+gAX+LPmE9OEMAS9WQSQsfCHGogIFDGGcNf7+uwBM7GAaSJIP01zcoe

1111 * VAgWdzXCv3FLhsaZoJ6RyLOLay5phbu1iaTr4UNYm5WtYTzMzqh8l1+MFFDl9xDB

1112 * vULuCIIrglM5MeS/qnSg1uMoH2oVPj9TVst/ir8CgYEAxrI7Ws9Zc4Bt70N1As+U

1113 * lySjaEVZCMkqvHJ6TCuVZFfQoE0r0whdLdRLU2PsLFP+q7qaeZQqgBaNSKeVcDYR

1114 * 9B+nY/jOmQoPewPVsp/vQTCnE/R81spu0mp0YI6cIheT1Z9zAy322svcc43JaWB7

1115 * mEbeqyLOP4Z4qSOcmghZBSECgYACvR9Xs0DGn+wCsW4vze/2ei77MD4OQvepPIFX

Long lines were clipped for display.

Lines 2245-2285typescript

2245 * "customHostnameVerificationTXTName": "_acme-challenge.custom.example.com",

2246 * "customHostnameVerificationTXTValue": "custom_abc123def456",

2247 * "customHostnameId": "f90712123fb02287348dd34c0a282bb9",

2248 * "customHostname": "custom.example.com",

2249 * "customHostnameStatus":

Lines 2295-2335typescript

2295 * CgKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmGdtcGbg/1

2296 * CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKnabIRuGvB

2297 * KwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpidtnKX/a+5

2298 * 0GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+pyFxIXjbEI

2299 * dZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pEewooaeO2

dist/esm/plugins/loader.jsView file

Lines 4-47javascript

4export function createHookContext(options = {}) {

5 const { logger } = options;

6 return {

7 debug(...args) {

8 logger?.debug(args.map(String).join

dist/esm/logging/index.jsView file

Lines 50-90javascript

50 * ## Context and Child Loggers

51 *

52 * Add structured context to log entries:

53 *

54 * ```typescript

55 * // Inline context

56 * logger.info({ operation: 'deploy', file: 'app.zip' }, 'Starting deployment');

57 *

58 * // Child logger with bound context

dist/esm/logging/index.d.tsView file

65patternName = generic_password severity = medium line = 65 matchedText = * // Out...]' }

Medium

Secret Pattern

Hardcoded password in dist/esm/logging/index.d.ts

dist/esm/logging/index.d.tsView on unpkg · L65

specs/cdn-zones-v1.yamlView file

5012patternName = private_key_rsa severity = critical line = 5012 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5012

5070patternName = private_key_rsa severity = critical line = 5070 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5070

6363patternName = private_key_rsa severity = critical line = 6363 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6363

6433patternName = private_key_rsa severity = critical line = 6433 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6433

specs/am-apiclients-api-v1.yamlView file

86patternName = generic_password severity = medium line = 86 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L86

252patternName = generic_password severity = medium line = 252 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L252

README.mdView file

268patternName = generic_password severity = medium line = 268 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L268

Source & flagged code

19 flagged · loading source

dist/esm/clients/cdn-zones.generated.d.tsView file

1062patternName = private_key_rsa severity = critical line = 1062 matchedText = * ...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

1062patternName = private_key_rsa severity = critical line = 1062 matchedText = * ...--",

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

1095patternName = private_key_rsa severity = critical line = 1095 matchedText = * @examp...----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1095

2265patternName = private_key_rsa severity = critical line = 2265 matchedText = * ...--",

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2265

2315patternName = private_key_rsa severity = critical line = 2315 matchedText = * @examp...----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2315

dist/esm/plugins/loader.jsView file

24* L25: * esbuild transforms `import()` to `require()` in CJS output, which cannot L26: * load ESM plugins. Using `new Function` preserves the native dynamic import.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/plugins/loader.jsView on unpkg · L24

27*/ L28: const dynamicImport = new Function('specifier', 'return import(specifier)'); L29: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/plugins/loader.jsView on unpkg · L27

dist/esm/logging/index.jsView file

70patternName = generic_password severity = medium line = 70 matchedText = * // Out...]' }

Medium

Secret Pattern

Hardcoded password in dist/esm/logging/index.js

dist/esm/logging/index.jsView on unpkg · L70

dist/esm/logging/index.d.tsView file

65patternName = generic_password severity = medium line = 65 matchedText = * // Out...]' }

Medium

Secret Pattern

Hardcoded password in dist/esm/logging/index.d.ts

dist/esm/logging/index.d.tsView on unpkg · L65

specs/cdn-zones-v1.yamlView file

5012patternName = private_key_rsa severity = critical line = 5012 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5012

5070patternName = private_key_rsa severity = critical line = 5070 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5070

6363patternName = private_key_rsa severity = critical line = 6363 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6363

6433patternName = private_key_rsa severity = critical line = 6433 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6433

8171patternName = private_key_rsa severity = critical line = 8171 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8171

8548patternName = private_key_rsa severity = critical line = 8548 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8548

8644patternName = private_key_rsa severity = critical line = 8644 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8644

specs/am-apiclients-api-v1.yamlView file

86patternName = generic_password severity = medium line = 86 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L86

252patternName = generic_password severity = medium line = 252 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L252

README.mdView file

268patternName = generic_password severity = medium line = 268 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L268

Findings

12 Critical8 Medium5 Low

CriticalCritical Secretdist/esm/clients/cdn-zones.generated.d.ts

CriticalSecret Patterndist/esm/clients/cdn-zones.generated.d.ts

CriticalSecret Patternspecs/cdn-zones-v1.yaml

MediumDynamic Requiredist/esm/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/esm/logging/index.js

MediumSecret Patterndist/esm/logging/index.d.ts

MediumSecret Patternspecs/am-apiclients-api-v1.yaml

MediumSecret PatternREADME.md

LowScripts Present

LowEvaldist/esm/plugins/loader.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings