registry / @sayknow-cli/ai / 0.3.6

@sayknow-cli/ai@0.3.6

Unified LLM API with automatic model discovery and provider configuration

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 179 file(s), 2.31 MB of source, external domains: 127.0.0.1, accounts.google.com, ai-gateway.vercel.sh, aiplatform.googleapis.com, api.anthropic.com, api.cerebras.ai, api.deepinfra.com, api.deepseek.com, api.fireworks.ai, api.github.com, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.openai.com, api.sakana.ai, api.synthetic.new, api.together.xyz, api.venice.ai, api.x.ai, api.xiaomimimo.com, api.z.ai, api2.cursor.sh, app.fireworks.ai, app.tavily.com, auth.kimi.com, auth.openai.com, auth.x.ai, bedrock-runtime.us-east-1.amazonaws.com, chat.openai.com, chat.qwen.ai, chat.z.ai, chatgpt.com, claude.ai, cli-chat-proxy.grok.com, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, console.bce.baidu.com, cursor.com, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, deepinfra.com, dev.synthetic.new, developers.cloudflare.com

Source & flagged code

1 flagged

src/providers/google-auth.tsView file

Lines 1-40typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Replaces `google-auth-library` with a direct WebCrypto + REST implementation.

5 * Sources, in priority order:

6 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)

7 * or `type: "authorized_user"` (refresh-token exchange).

8 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).

9 * 3. GCE / Cloud Run metadata server (`metadata.google.internal`).

10 *

11 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry

12 * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.

13 */

15import { Buffer } from "node:buffer";

16import * as os from "node:os";

17import * as path from "node:path";

18import { $envpos, isEnoent, logger } from "@sayknow-cli/utils";

19import type { FetchImpl } from "../types";

21const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";

22const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";

23const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";

24const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";

26interface CachedToken {

27 token: string;

28 expiresAtMs: number;

29}

31interface ServiceAccountCredentials {

32 type: "service_account";

33 client_email: string;

34 private_key: string;

35 private_key_id?: string;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L20

36}

38interface AuthorizedUserCredentials {

39 type: "authorized_user";

40 client_id: string;

Source & flagged code

1 flagged · loading source

src/providers/google-auth.tsView file

20L21: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L22: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L23: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L33: client_email: string; L34: private_key: string; L35: private_key_id?: string; ... L60: function userAdcPath(): string { L61: return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"); L62: } ... L65: try { L66: return (await Bun.file(filePath).json()) as T;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L20

Findings

1 High3 Medium4 Low

HighCloud Metadata Accesssrc/providers/google-auth.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/providers/google-auth.tsView file

Lines 1-40typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Replaces `google-auth-library` with a direct WebCrypto + REST implementation.

5 * Sources, in priority order:

6 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)

7 * or `type: "authorized_user"` (refresh-token exchange).

8 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).

9 * 3. GCE / Cloud Run metadata server (`metadata.google.internal`).

10 *

11 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry

12 * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.

13 */

15import { Buffer } from "node:buffer";

16import * as os from "node:os";

17import * as path from "node:path";

18import { $envpos, isEnoent, logger } from "@sayknow-cli/utils";

19import type { FetchImpl } from "../types";

21const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";

22const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";

23const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";

24const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";

26interface CachedToken {

27 token: string;

28 expiresAtMs: number;

29}

31interface ServiceAccountCredentials {

32 type: "service_account";

33 client_email: string;

34 private_key: string;

35 private_key_id?: string;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/providers/google-auth.tsView on unpkg · L20

36}

38interface AuthorizedUserCredentials {

39 type: "authorized_user";

40 client_id: string;