registry / @sedibyte/auth / 0.3.3

@sedibyte/auth@0.3.3

Provider-agnostic authentication manager for various platforms (Microsoft, Salesforce, with more to come).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Runtime Graph and Salesforce helpers can attach access tokens to arbitrary HTTPS destinations when callers supply absolute URLs. No install-time, import-time, persistence, or local-file attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer calls `graphFetch` or `restFetch` with an attacker-controlled absolute HTTPS URL.

Impact

An application that passes untrusted request paths could disclose its Microsoft or Salesforce access token to an external host.

Mechanism

Bearer-token forwarding to caller-supplied absolute HTTPS URLs.

Rationale

Source inspection found no malicious lifecycle behavior, credential harvesting, persistence, or hidden network destination. However, unrestricted absolute-URL support combined with automatic bearer-token headers creates a concrete credential-disclosure risk in unsafe integrations.

Evidence

package.jsondist/providers/microsoft/graph.jsdist/providers/salesforce/client.jsdist/providers/microsoft/provider.jsdist/providers/salesforce/provider.jsdist/auth.jsdist/providers/microsoft/validate.jsdist/providers/microsoft/index.jsdist/providers/salesforce/index.jsdist/providers/salesforce/provider.d.ts

Network endpoints3

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/providers/microsoft/graph.js` sends its bearer token to any caller-supplied absolute `https://` URL.
`dist/providers/salesforce/client.js` likewise accepts arbitrary absolute HTTPS URLs and attaches its Salesforce bearer token.

Evidence against

`package.json` has only `prepublishOnly`; no install-time hook is present.
`dist/auth.js` only maintains in-memory provider/token caches.
Provider credentials are explicit options; no environment, filesystem, shell, eval, or dynamic loading is used.
Fixed token exchanges target Microsoft and Salesforce authentication endpoints.
`dist/providers/salesforce/provider.d.ts` describes a caller-provided private-key field, not an embedded secret.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 8 file(s), 16.3 KB of source, external domains: graph.microsoft.com, login.microsoftonline.com, login.salesforce.com, sts.windows.net

Source & flagged code

3 flagged

dist/providers/salesforce/provider.d.tsView file

Lines 1-34typescript

1import type { AuthProvider } from "../../auth.js";

2/** Options for {@link createSalesforceProvider}. */

3export interface SalesforceProviderOptions {

4 /**

5 * Connected-app consumer key. Used as the JWT `iss` claim.

6 */

7 clientId: string;

8 /**

9 * Salesforce username to impersonate. Used as the JWT `sub` claim. This user

10 * must be pre-authorized for the connected app.

11 */

12 username: string;

13 /**

14 * RSA private key in **PKCS#8 PEM** form (a `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

15 * block) whose matching certificate is uploaded to the connected app. Used to

16 * RS256-sign the assertion. Convert a PKCS#1 (`BEGIN RSA PRIVATE KEY`) key

17 * with `openssl pkcs8 -topk8 -nocrypt`.

18 */

19 privateKey: string;

20 /**

21 * Login host to POST the assertion to. Defaults to

22 * {@link DEFAULT_LOGIN_URL}; use `https://test.salesforce.com` for sandboxes,

23 * or your My Domain login URL.

24 */

25 loginUrl?: string;

26 /**

27 * Expected JWT `aud` claim. Defaults to {@link loginUrl}. Salesforce validates

28 * this against the authorization server; production accepts

29 * `https://login.salesforce.com` and sandboxes `https://test.salesforce.com`

30 * regardless of a My Domain {@link loginUrl}.

31 */

32 audience?: string;

33 /** Registry key. Defaults to "salesforce". */

34 name?: string;

README.mdView file

Lines 110-150markdown

110

111```js

112import { registerProvider } from "@sedibyte/auth";

113import { createSalesforceProvider, createSalesforceClient } from "@sedibyte/auth/salesforce";

114import { readFileSync } from "node:fs";

115

116registerProvider(

117 createSalesforceProvider({

Source & flagged code

3 flagged · loading source

dist/providers/salesforce/provider.d.tsView file

14patternName = private_key_rsa severity = critical line = 14 matchedText = * RSA pr...---`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

14patternName = private_key_rsa severity = critical line = 14 matchedText = * RSA pr...---`

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

README.mdView file

130patternName = private_key_rsa severity = critical line = 130 matchedText = The priv...ck).

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L130

Findings

3 Critical1 Medium4 Low

CriticalCritical Secretdist/providers/salesforce/provider.d.ts

CriticalSecret Patterndist/providers/salesforce/provider.d.ts

CriticalSecret PatternREADME.md

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/providers/salesforce/provider.d.tsView file

Lines 1-34typescript

1import type { AuthProvider } from "../../auth.js";

2/** Options for {@link createSalesforceProvider}. */

3export interface SalesforceProviderOptions {

4 /**

5 * Connected-app consumer key. Used as the JWT `iss` claim.

6 */

7 clientId: string;

8 /**

9 * Salesforce username to impersonate. Used as the JWT `sub` claim. This user

10 * must be pre-authorized for the connected app.

11 */

12 username: string;

13 /**

14 * RSA private key in **PKCS#8 PEM** form (a `-----BEGIN PRIVATE KEY-----`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/providers/salesforce/provider.d.tsView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/providers/salesforce/provider.d.ts

dist/providers/salesforce/provider.d.tsView on unpkg · L14

15 * block) whose matching certificate is uploaded to the connected app. Used to

16 * RS256-sign the assertion. Convert a PKCS#1 (`BEGIN RSA PRIVATE KEY`) key

17 * with `openssl pkcs8 -topk8 -nocrypt`.

18 */

19 privateKey: string;

20 /**

21 * Login host to POST the assertion to. Defaults to

22 * {@link DEFAULT_LOGIN_URL}; use `https://test.salesforce.com` for sandboxes,

23 * or your My Domain login URL.

24 */

25 loginUrl?: string;

26 /**

27 * Expected JWT `aud` claim. Defaults to {@link loginUrl}. Salesforce validates

28 * this against the authorization server; production accepts

29 * `https://login.salesforce.com` and sandboxes `https://test.salesforce.com`

30 * regardless of a My Domain {@link loginUrl}.

31 */

32 audience?: string;

33 /** Registry key. Defaults to "salesforce". */

34 name?: string;

README.mdView file

Lines 110-150markdown

110

111```js

112import { registerProvider } from "@sedibyte/auth";

113import { createSalesforceProvider, createSalesforceClient } from "@sedibyte/auth/salesforce";

114import { readFileSync } from "node:fs";

115

116registerProvider(

117 createSalesforceProvider({