registry / @sedibyte/auth / 0.3.2

@sedibyte/auth@0.3.2

Provider-agnostic authentication manager for various platforms (Microsoft, Salesforce, with more to come).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 8 file(s), 16.3 KB of source, external domains: graph.microsoft.com, login.microsoftonline.com, login.salesforce.com, sts.windows.net

Source & flagged code

4 flagged

dist/providers/salesforce/provider.d.tsView file

Lines 1-34typescript

1import type { AuthProvider } from "../../auth.js";

2/** Options for {@link createSalesforceProvider}. */

3export interface SalesforceProviderOptions {

4 /**

5 * Connected-app consumer key. Used as the JWT `iss` claim.

6 */

7 clientId: string;

8 /**

9 * Salesforce username to impersonate. Used as the JWT `sub` claim. This user

10 * must be pre-authorized for the connected app.

11 */

12 username: string;

13 /**

14 * RSA private key in **PKCS#8 PEM** form (a `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

15 * block) whose matching certificate is uploaded to the connected app. Used to

16 * RS256-sign the assertion. Convert a PKCS#1 (`BEGIN RSA PRIVATE KEY`) key

17 * with `openssl pkcs8 -topk8 -nocrypt`.

18 */

19 privateKey: string;

20 /**

21 * Login host to POST the assertion to. Defaults to

22 * {@link DEFAULT_LOGIN_URL}; use `https://test.salesforce.com` for sandboxes,

23 * or your My Domain login URL.

24 */

25 loginUrl?: string;

26 /**

27 * Expected JWT `aud` claim. Defaults to {@link loginUrl}. Salesforce validates

28 * this against the authorization server; production accepts

29 * `https://login.salesforce.com` and sandboxes `https://test.salesforce.com`

30 * regardless of a My Domain {@link loginUrl}.

31 */

32 audience?: string;

33 /** Registry key. Defaults to "salesforce". */

34 name?: string;

dist/providers/microsoft/validate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sedibyte/auth@0.2.0 matchedIdentity = npm:QHNlZGlieXRlL2F1dGg:0.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/providers/microsoft/validate.jsView on unpkg

README.mdView file

Lines 110-150markdown

110

111```js

112import { registerProvider } from "@sedibyte/auth";

113import { createSalesforceProvider, createSalesforceClient } from "@sedibyte/auth/salesforce";

114import { readFileSync } from "node:fs";

115

116registerProvider(

117 createSalesforceProvider({

Source & flagged code

4 flagged · loading source

dist/providers/salesforce/provider.d.tsView file

14patternName = private_key_rsa severity = critical line = 14 matchedText = * RSA pr...---`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

14patternName = private_key_rsa severity = critical line = 14 matchedText = * RSA pr...---`

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

dist/providers/microsoft/validate.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/providers/microsoft/validate.jsView on unpkg

README.mdView file

130patternName = private_key_rsa severity = critical line = 130 matchedText = The priv...ck).

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L130

Findings

3 Critical1 High1 Medium4 Low

CriticalCritical Secretdist/providers/salesforce/provider.d.ts

CriticalSecret Patterndist/providers/salesforce/provider.d.ts

CriticalSecret PatternREADME.md

HighPrevious Version Dangerous Deltadist/providers/microsoft/validate.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/providers/salesforce/provider.d.tsView file

Lines 1-34typescript

1import type { AuthProvider } from "../../auth.js";

2/** Options for {@link createSalesforceProvider}. */

3export interface SalesforceProviderOptions {

4 /**

5 * Connected-app consumer key. Used as the JWT `iss` claim.

6 */

7 clientId: string;

8 /**

9 * Salesforce username to impersonate. Used as the JWT `sub` claim. This user

10 * must be pre-authorized for the connected app.

11 */

12 username: string;

13 /**

14 * RSA private key in **PKCS#8 PEM** form (a `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

15 * block) whose matching certificate is uploaded to the connected app. Used to

16 * RS256-sign the assertion. Convert a PKCS#1 (`BEGIN RSA PRIVATE KEY`) key

17 * with `openssl pkcs8 -topk8 -nocrypt`.

18 */

19 privateKey: string;

20 /**

21 * Login host to POST the assertion to. Defaults to

22 * {@link DEFAULT_LOGIN_URL}; use `https://test.salesforce.com` for sandboxes,

23 * or your My Domain login URL.

24 */

25 loginUrl?: string;

26 /**

27 * Expected JWT `aud` claim. Defaults to {@link loginUrl}. Salesforce validates

28 * this against the authorization server; production accepts

29 * `https://login.salesforce.com` and sandboxes `https://test.salesforce.com`

30 * regardless of a My Domain {@link loginUrl}.

31 */

32 audience?: string;

33 /** Registry key. Defaults to "salesforce". */

34 name?: string;

dist/providers/microsoft/validate.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/providers/microsoft/validate.jsView on unpkg

README.mdView file

Lines 110-150markdown

110

111```js

112import { registerProvider } from "@sedibyte/auth";

113import { createSalesforceProvider, createSalesforceClient } from "@sedibyte/auth/salesforce";

114import { readFileSync } from "node:fs";

115

116registerProvider(

117 createSalesforceProvider({