registry / @salesforce/b2c-tooling-sdk / 1.20.1

@salesforce/b2c-tooling-sdk@1.20.1

Core tooling library for Salesforce B2C Commerce CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 225 file(s), 1.25 MB of source, external domains: api.github.com, cloud.mobify.com, code.visualstudio.com, cursor.com, dc.services.visualstudio.com, developer.salesforce.com, docs.anthropic.com, docs.windsurf.com, github.com, opencode.ai, raw.githubusercontent.com, salesforcecommercecloud.github.io, www.demandware.com

Source & flagged code

19 flagged

dist/esm/clients/cdn-zones.generated.d.tsView file

Lines 1042-1115typescript

1042 * "mtlsCertificateId": "465a48f6-3d98-4c15-9312-211984ee8629",

1043 * "expiresOn": "2022-01-12T04:15:57Z",

1044 * "issuer": "DigiCert",

1045 * "signature"

Source & flagged code

19 flagged · loading source

dist/esm/clients/cdn-zones.generated.d.tsView file

1062patternName = private_key_rsa severity = critical line = 1062 matchedText = * ...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

1062patternName = private_key_rsa severity = critical line = 1062 matchedText = * ...--",

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1062

1095patternName = private_key_rsa severity = critical line = 1095 matchedText = * @examp...----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L1095

2265patternName = private_key_rsa severity = critical line = 2265 matchedText = * ...--",

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2265

2315patternName = private_key_rsa severity = critical line = 2315 matchedText = * @examp...----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2315

dist/esm/plugins/loader.jsView file

24* L25: * esbuild transforms `import()` to `require()` in CJS output, which cannot L26: * load ESM plugins. Using `new Function` preserves the native dynamic import.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/plugins/loader.jsView on unpkg · L24

27*/ L28: const dynamicImport = new Function('specifier', 'return import(specifier)'); L29: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/plugins/loader.jsView on unpkg · L27

dist/esm/logging/index.jsView file

70patternName = generic_password severity = medium line = 70 matchedText = * // Out...]' }

Medium

Secret Pattern

Hardcoded password in dist/esm/logging/index.js

dist/esm/logging/index.jsView on unpkg · L70

dist/esm/logging/index.d.tsView file

65patternName = generic_password severity = medium line = 65 matchedText = * // Out...]' }

Medium

Secret Pattern

Hardcoded password in dist/esm/logging/index.d.ts

dist/esm/logging/index.d.tsView on unpkg · L65

specs/cdn-zones-v1.yamlView file

5012patternName = private_key_rsa severity = critical line = 5012 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5012

5070patternName = private_key_rsa severity = critical line = 5070 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5070

6363patternName = private_key_rsa severity = critical line = 6363 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6363

6433patternName = private_key_rsa severity = critical line = 6433 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6433

8171patternName = private_key_rsa severity = critical line = 8171 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8171

8548patternName = private_key_rsa severity = critical line = 8548 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8548

8644patternName = private_key_rsa severity = critical line = 8644 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8644

specs/am-apiclients-api-v1.yamlView file

86patternName = generic_password severity = medium line = 86 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L86

252patternName = generic_password severity = medium line = 252 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in specs/am-apiclients-api-v1.yaml

specs/am-apiclients-api-v1.yamlView on unpkg · L252

README.mdView file

268patternName = generic_password severity = medium line = 268 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L268

Findings

12 Critical8 Medium5 Low

CriticalCritical Secretdist/esm/clients/cdn-zones.generated.d.ts

CriticalSecret Patterndist/esm/clients/cdn-zones.generated.d.ts

CriticalSecret Patternspecs/cdn-zones-v1.yaml

MediumDynamic Requiredist/esm/plugins/loader.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/esm/logging/index.js

MediumSecret Patterndist/esm/logging/index.d.ts

MediumSecret Patternspecs/am-apiclients-api-v1.yaml

MediumSecret PatternREADME.md

LowScripts Present

LowEvaldist/esm/plugins/loader.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 2245-2285typescript

2245 * "customHostnameVerificationTXTName": "_acme-challenge.custom.example.com",

2246 * "customHostnameVerificationTXTValue": "custom_abc123def456",

2247 * "customHostnameId": "f90712123fb02287348dd34c0a282bb9",

2248 * "customHostname": "custom.example.com",

2249 * "customHostnameStatus": "ACTIVE",

2250 * "dcvDelegationRecords": []

2251 * }

2252 * ]

2253 * }

2254 */

2255 CertificatesEnvelope: {

2256 data: components["schemas"]["Certificate"][];

2257 };

2258 /**

2259 * @description Certificate request information

2260 * @example {

2261 * "hostname": "example.com",

2262 * "bundleMethod": "ubiquitous",

2263 * "certificateType": "custom",

2264 * "certificate": "-----BEGIN CERTIFICATE-----\nMIIDtTCCAp2gAwIBAgIJAMHAwfXZ5PWMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV\nBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX\naWRnaXRzIFB0eSBMdGQwHhcNMTYwODI0MTY0MzAxWhcNMTYxMTIyMTY0MzAxWjBF\nMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50\nZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmGdtcGbg/1\nCGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKnabIRuGvB\nKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpidtnKX/a+5\n0GjB79CJH4E ...

2265 * "privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG\ndtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn\nabIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid\ntnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py\nFxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE\newooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb\nHBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/\naxiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb\n+ufRBKz ...

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2265

2266 * "certificateAuthority": "lets_encrypt",

2267 * "certificateValidation": "http",

2268 * "wildcardHostname": false

2269 * }

2270 */

2271 CertificateRequest: {

2272 /**

2273 * @description Hostname that certificate needs to be applied to.

2274 * @example example.com

2275 */

2276 hostname: string;

2277 /**

2278 * @description Bundle method of the custom certificate chain for verification.

2279 * @example ubiquitous

2280 */

2281 bundleMethod?: string;

2282 /**

2283 * @description Indicates certificate is custom or automatic certificate renewal by eCDN. Optional field, if nothing specified the default value is custom. Valid values are custom or automatic.

2284 * @example custom

2285 */

Long lines were clipped for display.

Lines 2295-2335typescript

2295 * CgKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmGdtcGbg/1

2296 * CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKnabIRuGvB

2297 * KwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpidtnKX/a+5

2298 * 0GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+pyFxIXjbEI

2299 * dZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pEewooaeO2

2300 * izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABo4GnMIGkMB0GA1UdDgQWBBT/LbE4

2301 * 9rWf288N6sJA5BRb6FJIGDB1BgNVHSMEbjBsgBT/LbE49rWf288N6sJA5BRb6FJI

2302 * GKFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV

2303 * BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAMHAwfXZ5/PWMAwGA1UdEwQF

2304 * MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHHFwl0tH0quUYZYO0dZYt4R7SJ0pCm2

2305 * 2satiyzHl4OnXcHDpekAo7/a09c6Lz6AU83cKy/+x3/djYHXWba7HpEu0dR3ugQP

2306 * Mlr4zrhd9xKZ0KZKiYmtJH+ak4OM4L3FbT0owUZPyjLSlhMtJVcoRp5CJsjAMBUG

2307 * SvD8RX+T01wzox/Qb+lnnNnOlaWpqu8eoOenybxKp1a9ULzIVvN/LAcc+14vioFq

2308 * 2swRWtmocBAs8QR9n4uvbpiYvS8eYueDCWMM4fvFfBhaDZ3N9IbtySh3SpFdQDhw

2309 * YbjM2rxXiyLGxB4Bol7QTv4zHif7Zt89FReT/NBy4rzaskDJY5L6xmY=

2310 * -----END CERTIFICATE-----

2311 */

2312 certificate?: string;

2313 /**

2314 * @description Private key associated with the custom certificate. Required if the `certificateType` value is custom.

2315 * @example -----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in dist/esm/clients/cdn-zones.generated.d.ts

dist/esm/clients/cdn-zones.generated.d.tsView on unpkg · L2315

2316 * MIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG

2317 * dtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn

2318 * abIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid

2319 * tnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py

2320 * FxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE

2321 * ewooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb

2322 * HBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/

2323 * axiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb

2324 * +ufRBKztPTQ/rYWaYQcgC0RWI20HTFBMxlTAyNxYNWzX7RKFkGVVyB9RsAtmcc8g

2325 * +j4OdosbfNoJPS0HeIfNpAznDfHKdxDk2Yc1tV6RHBrC1ynyLE9+TaflIAdo2MVv

2326 * KLMLq51GqYKtgJFIlBRPQqKoyXdz3fGvXrTkf/WY9QNq0J1Vk5ERePZ54mN8iZB7

2327 * 9lwy/AkCgYEA6FXzosxswaJ2wQLeoYc7ceaweX/SwTvxHgXzRyJIIT0eJWgx13Wo

2328 * /WA3Iziimsjf6qE+SI/8laxPp2A86VMaIt3Z3mJN/CqSVGw8LK2AQst+OwdPyDMu

2329 * iacE8lj/IFGC8mwNUAb9CzGU3JpU4PxxGFjS/eMtGeRXCWkK4NE+G08CgYEA1Kp9

2330 * N2JrVlqUz+gAX+LPmE9OEMAS9WQSQsfCHGogIFDGGcNf7+uwBM7GAaSJIP01zcoe

2331 * VAgWdzXCv3FLhsaZoJ6RyLOLay5phbu1iaTr4UNYm5WtYTzMzqh8l1+MFFDl9xDB

2332 * vULuCIIrglM5MeS/qnSg1uMoH2oVPj9TVst/ir8CgYEAxrI7Ws9Zc4Bt70N1As+U

2333 * lySjaEVZCMkqvHJ6TCuVZFfQoE0r0whdLdRLU2PsLFP+q7qaeZQqgBaNSKeVcDYR

2334 * 9B+nY/jOmQoPewPVsp/vQTCnE/R81spu0mp0YI6cIheT1Z9zAy322svcc43JaWB7

2335 * mEbeqyLOP4Z4qSOcmghZBSECgYACvR9Xs0DGn+wCsW4vze/2ei77MD4OQvepPIFX

dist/esm/plugins/loader.jsView file

Lines 4-47javascript

4export function createHookContext(options = {}) {

5 const { logger } = options;

6 return {

7 debug(...args) {

8 logger?.debug(args.map(String).join(' '));

9 },

10 log(...args) {

11 logger?.info(args.map(String).join(' '));

12 },

13 warn(...args) {

14 logger?.warn(args.map(String).join(' '));

15 },

16 error(...args) {

17 logger?.error(args.map(String).join(' '));

18 },

19 config: options.config ?? {},

20 };

21}

22/**

23 * Dynamic import that survives esbuild CJS bundling.

24 *

25 * esbuild transforms `import()` to `require()` in CJS output, which cannot

26 * load ESM plugins. Using `new Function` preserves the native dynamic import.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/plugins/loader.jsView on unpkg · L24

27 */

28const dynamicImport = new Function('specifier', 'return import(specifier)');

29/**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/plugins/loader.jsView on unpkg · L27

30 * Dynamically imports a hook file and invokes its default export.

31 *

32 * @param hookFilePath - Absolute path to the hook JS file

33 * @param context - Hook context (`this` inside the hook)

34 * @param hookOptions - Options passed as the first argument to the hook function

35 * @param logger - Optional logger for warnings on failure

36 * @returns The hook function's return value, or `undefined` on error

37 */

38export async function invokeHook(hookFilePath, context, hookOptions, logger) {

39 try {

40 // On Windows, Node's dynamic import() rejects raw filesystem paths (backslashes,

41 // drive letters) and requires a file:// URL. pathToFileURL handles both POSIX

42 // and Windows correctly, so normalize before importing.

43 const { pathToFileURL } = await import('node:url');

44 const importSpecifier = pathToFileURL(hookFilePath).href;

45 const mod = await dynamicImport(importSpecifier);

46 const hookFn = (mod.default ?? mod);

47 if (typeof hookFn !== 'function') {

specs/cdn-zones-v1.yamlView file

5012patternName = private_key_rsa severity = critical line = 5012 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5012

5070patternName = private_key_rsa severity = critical line = 5070 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L5070

6363patternName = private_key_rsa severity = critical line = 6363 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6363

6433patternName = private_key_rsa severity = critical line = 6433 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L6433

8171patternName = private_key_rsa severity = critical line = 8171 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8171

8548patternName = private_key_rsa severity = critical line = 8548 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8548

8644patternName = private_key_rsa severity = critical line = 8644 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in specs/cdn-zones-v1.yaml

specs/cdn-zones-v1.yamlView on unpkg · L8644