registry / @saptools/gitport / 0.1.12

@saptools/gitport@0.1.12

Port GitLab merge requests from repo A to repo B with sequential cherry-picks, Draft MRs, and incoming conflict capture.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 70.1 KB of source, external domains: gitlab.example.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21// src/git.ts

22import { execFile } from "child_process";

23import process2 from "process";

25// src/mask.ts

26var REDACTED = "[REDACTED]";

27function maskSensitiveText(text, secrets) {

28 return secrets.filter((secret) => secret.length > 0).reduce((current, secret) => current.split(secret).join(REDACTED), text);

29}

30function maskGitRemotes(text) {

31 return text.replace(/(https?:\/\/[^:\s]+:)([^@\s]+)(@)/g, `$1${REDACTED}$3`);

32}

33function maskAll(text, secrets) {

34 return maskGitRemotes(maskSensitiveText(text, secrets));

35}

37// src/git.ts

38var MAX_BUFFER = 32 * 1024 * 1024;

39var GITPORT_GIT_CREDENTIAL_TOKEN_ENV = "GITPORT_GIT_CREDENTIAL_TOKEN";

40var GIT_TOPOLOGICAL_ORDER_FLAG = "--topo-order";

41var GIT_CREDENTIAL_HELPER_CONFIG = `!f() { if test "$1" = get; then printf '%s\\n' username=oauth2 password="$${GITPORT_GIT_CREDENTIAL_TOKEN_ENV}"; fi; }; f`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L41

42var GitCommandError = class extends GitportError {

43 stdout;

44 stderr;

45 constructor(message, stdout, stderr, options) {

46 super(GITPORT_ERROR_CODE.GitFailed, message, options);

47 this.name = "GitCommandError";

48 this.stdout = stdout;

49 this.stderr = stderr;

50 }

51};

52function toText(value) {

53 if (Buffer.isBuffer(value)) {

54 return value.toString("utf8");

55 }

56 return value ?? "";

57}

58function buildGitEnv(options) {

59 return {

60 ...process2.env,

61 ...options.env,

dist/cli.jsView file

Lines 27-67javascript

27// src/git.ts

28import { execFile } from "child_process";

29import process2 from "process";

31// src/mask.ts

32var REDACTED = "[REDACTED]";

33function maskSensitiveText(text,

Source & flagged code

2 flagged · loading source

dist/index.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = var GIT_... f`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L41

dist/cli.jsView file

47patternName = generic_password severity = medium line = 47 matchedText = var GIT_... f`;

Medium

Secret Pattern

Hardcoded password in dist/cli.js

dist/cli.jsView on unpkg · L47

Findings

3 Medium4 Low

MediumSecret Patterndist/index.js

MediumEnvironment Vars

MediumSecret Patterndist/cli.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21// src/git.ts

22import { execFile } from "child_process";

23import process2 from "process";

25// src/mask.ts

26var REDACTED = "[REDACTED]";

27function maskSensitiveText(text, secrets) {

28 return secrets.filter((secret) => secret.length > 0).reduce((current, secret) => current.split(secret).join(REDACTED), text);

29}

30function maskGitRemotes(text) {

31 return text.replace(/(https?:\/\/[^:\s]+:)([^@\s]+)(@)/g, `$1${REDACTED}$3`);

32}

33function maskAll(text, secrets) {

34 return maskGitRemotes(maskSensitiveText(text, secrets));

35}

37// src/git.ts

38var MAX_BUFFER = 32 * 1024 * 1024;

39var GITPORT_GIT_CREDENTIAL_TOKEN_ENV = "GITPORT_GIT_CREDENTIAL_TOKEN";

40var GIT_TOPOLOGICAL_ORDER_FLAG = "--topo-order";

41var GIT_CREDENTIAL_HELPER_CONFIG = `!f() { if test "$1" = get; then printf '%s\\n' username=oauth2 password="$${GITPORT_GIT_CREDENTIAL_TOKEN_ENV}"; fi; }; f`;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L41

42var GitCommandError = class extends GitportError {

43 stdout;

44 stderr;

45 constructor(message, stdout, stderr, options) {

46 super(GITPORT_ERROR_CODE.GitFailed, message, options);

47 this.name = "GitCommandError";

48 this.stdout = stdout;

49 this.stderr = stderr;

50 }

51};

52function toText(value) {

53 if (Buffer.isBuffer(value)) {

54 return value.toString("utf8");

55 }

56 return value ?? "";

57}

58function buildGitEnv(options) {

59 return {

60 ...process2.env,

61 ...options.env,

dist/cli.jsView file

Lines 27-67javascript

27// src/git.ts

28import { execFile } from "child_process";

29import process2 from "process";

31// src/mask.ts

32var REDACTED = "[REDACTED]";

33function maskSensitiveText(text,