registry / @servicelabsco/slabs-access-manager / 1.0.44

@servicelabsco/slabs-access-manager@1.0.44

Support for application level menus and dashboards

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,400 file(s), 2.97 MB of source, external domains: 127.0.0.1, accounts.google.com, accounts.zoho.com, accounts.zoho.in, api.amazon.com, client.finnoto.in, docs.google.com, ei5oni4xxk.execute-api.ap-south-1.amazonaws.com, gmail.googleapis.com, oauth2.googleapis.com, sellercentral.amazon.in, slack.com, stogyux6hk.execute-api.ap-south-1.amazonaws.com, www.googleapis.com

Source & flagged code

3 flagged

dist/access/libraries/send.fcm.notification.jsView file

Lines 69-103javascript

69 attributes: { ...this.payload?.attributes, response },

70 });

71 return wm.save();

72 }

73 async getToken() {

74 const cacheKey = `fcm.access.token`;

75 const token = await this.cacheService.get(cacheKey);

76 if (token)

77 return token;

78 const newToken = await this.getTokenFromTheGoogle();

79 if (!newToken)

80 return;

81 await this.cacheService.set(cacheKey, newToken?.access_token, (0, date_fns_1.addMinutes)(new Date(), 45));

82 return newToken?.access_token;

83 }

84 async getTokenFromTheGoogle() {

85 const email = await this.propertyService.get('fcm.email');

86 const propertyKey = await this.propertyService.get('fcm.api.key');

87 const client = new google_auth_library_1.JWT({

88 email,

89 key: `-----BEGIN PRIVATE KEY-----\n${propertyKey}\n-----END PRIVATE KEY-----`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

90 scopes: ['https://www.googleapis.com/auth/cloud-platform'],

91 });

92 try {

93 const newToken = await client.authorize();

94 return newToken;

95 }

96 catch (error) {

97 console.log(error);

98 return;

99 }

100 }

101}

102exports.SendFcmNotification = SendFcmNotification;

103//# sourceMappingURL=send.fcm.notification.js.map

dist/access/libraries/process.notification.jsView file

Lines 13-53javascript

13 const notification = await notification_entity_1.NotificationEntity.findOne({

14 where: { identifier: payload.identifier },

15 relations: ['sms.template', 'emails.template', 'whatsapp.template', 'slack.template', 'gchat.template', 'inapp', 'fcm.template'],

16 });

Source & flagged code

3 flagged · loading source

dist/access/libraries/send.fcm.notification.jsView file

89patternName = private_key_rsa severity = critical line = 89 matchedText = key: `--...--`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

89patternName = private_key_rsa severity = critical line = 89 matchedText = key: `--...--`,

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

dist/access/libraries/process.notification.jsView file

33const { condition = '' } = email?.filter_condition || {}; L34: eval(condition); L35: if (send)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/access/libraries/process.notification.jsView on unpkg · L33

Findings

2 Critical2 Medium5 Low

CriticalCritical Secretdist/access/libraries/send.fcm.notification.js

CriticalSecret Patterndist/access/libraries/send.fcm.notification.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/access/libraries/process.notification.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/access/libraries/send.fcm.notification.jsView file

Lines 69-103javascript

69 attributes: { ...this.payload?.attributes, response },

70 });

71 return wm.save();

72 }

73 async getToken() {

74 const cacheKey = `fcm.access.token`;

75 const token = await this.cacheService.get(cacheKey);

76 if (token)

77 return token;

78 const newToken = await this.getTokenFromTheGoogle();

79 if (!newToken)

80 return;

81 await this.cacheService.set(cacheKey, newToken?.access_token, (0, date_fns_1.addMinutes)(new Date(), 45));

82 return newToken?.access_token;

83 }

84 async getTokenFromTheGoogle() {

85 const email = await this.propertyService.get('fcm.email');

86 const propertyKey = await this.propertyService.get('fcm.api.key');

87 const client = new google_auth_library_1.JWT({

88 email,

89 key: `-----BEGIN PRIVATE KEY-----\n${propertyKey}\n-----END PRIVATE KEY-----`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

90 scopes: ['https://www.googleapis.com/auth/cloud-platform'],

91 });

92 try {

93 const newToken = await client.authorize();

94 return newToken;

95 }

96 catch (error) {

97 console.log(error);

98 return;

99 }

100 }

101}

102exports.SendFcmNotification = SendFcmNotification;

103//# sourceMappingURL=send.fcm.notification.js.map

dist/access/libraries/process.notification.jsView file

Lines 13-53javascript

13 const notification = await notification_entity_1.NotificationEntity.findOne({

14 where: { identifier: payload.identifier },

15 relations: ['sms.template', 'emails.template', 'whatsapp.template', 'slack.template', 'gchat.template', 'inapp', 'fcm.template'],

16 });