registry / @segment/action-destinations / 3.495.0

@segment/action-destinations@3.495.0

⚠ Under review

Destination Actions engine and definitions.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,304 file(s), 5.08 MB of source, external domains: a.klaviyo.com, accounts.google.com, accounts.snapchat.com, admin.listrak.com, ads-api.reddit.com, ads.microsoft.com, ads.nextdoor.com, ads.tiktok.com, adsapi.snapchat.com, advertising-api-eu.amazon.com, advertising-api-fe.amazon.com, advertising-api.amazon.com, altertable.ai, amplitude.com, analytex.userpilot.io, analytics.eu.amplitude.com, api-01.moengage.com, api-02.moengage.com, api-03.moengage.com, api-04.moengage.com, api-05.moengage.com, api-dashboard.getambee.com, api-dev.prodeology.com, api-eu.mixpanel.com, api-in.mixpanel.com, api-pls.outfunnel.com, api.altertable.ai, api.amazon.co.jp, api.amazon.co.uk, api.amazon.com, api.amplitude.com, api.appfit.io, api.attentivemobile.com, api.attio.com, api.avo.app, api.batch.com, api.blnd.ai, api.close.com, api.converscience.com, api.criteo.com, api.devrev.ai, api.dub.co, api.emarsys.net, api.encharge.io, api.eu.amplitude.com, api.eu.iterable.com, api.eu.sendgrid.com, api.fullstory.com, api.gameball.co, api.getcalliper.com

Source & flagged code

5 flagged

dist/destinations/kafka/utils.jsView file

Lines 64-104javascript

64 };

65 case 'aws':

66 return {

67 accessKeyId: settings.accessKeyId,

68 secretAccessKey: settings.secretAccessKey,

69 authorizationIdentity: settings.authorizationIdentity,

70 mechanism: settings.mechanism

71 };

72 default:

73 return undefined;

74 }

75 })(),

76 ssl: (() => {

77 if (settings?.ssl_ca) {

78 const ssl = {

79 ca: [`-----BEGIN CERTIFICATE-----\n${settings.ssl_ca.trim()}\n-----END CERTIFICATE-----`],

80 rejectUnauthorized: settings.ssl_reject_unauthorized_ca

81 };

82 if (settings.mechanism === 'client-cert-auth') {

83 ;

84 (ssl.key = `-----BEGIN PRIVATE KEY-----\n${settings?.ssl_key?.trim()}\n-----END PRIVATE KEY-----`),

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/destinations/kafka/utils.jsView on unpkg · L84

Critical

Secret Pattern

RSA private key in dist/destinations/kafka/utils.js

dist/destinations/kafka/utils.jsView on unpkg · L84

85 (ssl.cert = `-----BEGIN CERTIFICATE-----\n${settings?.ssl_cert?.trim()}\n-----END CERTIFICATE-----`);

86 }

87 return ssl;

88 }

89 else if (settings.ssl_enabled) {

90 return settings.ssl_enabled;

91 }

92 return undefined;

93 })(),

94 retry: {

95 retries: 0

96 }

97 };

98 try {

99 return new kafkajs_1.Kafka(kafkaConfig);

100 }

101 catch (error) {

102 throw new actions_core_1.IntegrationError(`Kafka Connection Error: ${error.message}`, 'KAFKA_CONNECTION_ERROR', 400);

103 }

104};

dist/destinations/facebook-custom-audiences/constants.jsView file

Lines 1-10javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.BASE_URL = exports.FACEBOOK_CUSTOM_AUDIENCE_JOURNEYS_FLAGON = exports.FACEBOOK_CUSTOM_AUDIENCE_FLAGON = exports.CANARY_API_VERSION

dist/destinations/vwo/utility.jsView file

Lines 13-53javascript

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v

dist/destinations/linkedin-conversions/index.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.

Source & flagged code

5 flagged · loading source

dist/destinations/kafka/utils.jsView file

84patternName = private_key_rsa severity = critical line = 84 matchedText = (ssl.key...-`),

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/destinations/kafka/utils.jsView on unpkg · L84

84patternName = private_key_rsa severity = critical line = 84 matchedText = (ssl.key...-`),

Critical

Secret Pattern

RSA private key in dist/destinations/kafka/utils.js

dist/destinations/kafka/utils.jsView on unpkg · L84

dist/destinations/facebook-custom-audiences/constants.jsView file

3exports.BASE_URL = exports.FACEBOOK_CUSTOM_AUDIENCE_JOURNEYS_FLAGON = exports.FACEBOOK_CUSTOM_AUDIENCE_FLAGON = exports.CANARY_API_VERSION = exports.API_VERSION = void 0; L4: const versioning_info_1 = require("./versioning-info"); L5: exports.API_VERSION = versioning_info_1.FACEBOOK_CUSTOM_AUDIENCES_API_VERSION;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/destinations/facebook-custom-audiences/constants.jsView on unpkg · L3

dist/destinations/vwo/utility.jsView file

33exports.hosts = { L34: US: 'https://dev.visualwebsiteoptimizer.com', L35: EU: 'https://dev.visualwebsiteoptimizer.com/eu01', ... L38: function uuidv5(name, namespace) { L39: const namespaceBuffer = Buffer.from(namespace.replace(/-/g, ''), 'hex'); L40: const nameBuffer = Buffer.from(name);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/destinations/vwo/utility.jsView on unpkg · L33

dist/destinations/linkedin-conversions/index.jsView file

8const constants_1 = require("./constants"); L9: const https_1 = __importDefault(require("https")); L10: const streamConversion_1 = __importDefault(require("./streamConversion")); ... L35: let res; L36: if (!process.env.ACTIONS_LINKEDIN_CONVERSIONS_CLIENT_ID) { L37: throw new actions_core_1.IntegrationError(`Missing client ID`, actions_core_1.ErrorCodes.OAUTH_REFRESH_FAILED, 500); ... L50: }, L51: body: new URLSearchParams({ L52: refresh_token: auth.refreshToken,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/destinations/linkedin-conversions/index.jsView on unpkg · L8

Findings

3 Critical3 Medium7 Low

CriticalCritical Secretdist/destinations/kafka/utils.js

CriticalCredential Exfiltrationdist/destinations/linkedin-conversions/index.js

CriticalSecret Patterndist/destinations/kafka/utils.js

MediumDynamic Requiredist/destinations/facebook-custom-audiences/constants.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/destinations/vwo/utility.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/destinations/kafka/utils.jsView file

Lines 64-104javascript

64 };

65 case 'aws':

66 return {

67 accessKeyId: settings.accessKeyId,

68 secretAccessKey: settings.secretAccessKey,

69 authorizationIdentity: settings.authorizationIdentity,

70 mechanism: settings.mechanism

71 };

72 default:

73 return undefined;

74 }

75 })(),

76 ssl: (() => {

77 if (settings?.ssl_ca) {

78 const ssl = {

79 ca: [`-----BEGIN CERTIFICATE-----\n${settings.ssl_ca.trim()}\n-----END CERTIFICATE-----`],

80 rejectUnauthorized: settings.ssl_reject_unauthorized_ca

81 };

82 if (settings.mechanism === 'client-cert-auth') {

83 ;

84 (ssl.key = `-----BEGIN PRIVATE KEY-----\n${settings?.ssl_key?.trim()}\n-----END PRIVATE KEY-----`),

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/destinations/kafka/utils.jsView on unpkg · L84

Critical

Secret Pattern

RSA private key in dist/destinations/kafka/utils.js

dist/destinations/kafka/utils.jsView on unpkg · L84

85 (ssl.cert = `-----BEGIN CERTIFICATE-----\n${settings?.ssl_cert?.trim()}\n-----END CERTIFICATE-----`);

86 }

87 return ssl;

88 }

89 else if (settings.ssl_enabled) {

90 return settings.ssl_enabled;

91 }

92 return undefined;

93 })(),

94 retry: {

95 retries: 0

96 }

97 };

98 try {

99 return new kafkajs_1.Kafka(kafkaConfig);

100 }

101 catch (error) {

102 throw new actions_core_1.IntegrationError(`Kafka Connection Error: ${error.message}`, 'KAFKA_CONNECTION_ERROR', 400);

103 }

104};

dist/destinations/facebook-custom-audiences/constants.jsView file

Lines 1-10javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.BASE_URL = exports.FACEBOOK_CUSTOM_AUDIENCE_JOURNEYS_FLAGON = exports.FACEBOOK_CUSTOM_AUDIENCE_FLAGON = exports.CANARY_API_VERSION

dist/destinations/vwo/utility.jsView file

Lines 13-53javascript

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default", { enumerable: true, value: v });

15}) : function(o, v

dist/destinations/linkedin-conversions/index.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.