registry / @servicelabsco/slabs-access-manager / 1.0.47

@servicelabsco/slabs-access-manager@1.0.47

Support for application level menus and dashboards

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Unverified scanner metadata points to runtime notification and FCM authentication functionality. No source-confirmed attack surface could be established because package reads failed.

Static reason

One or more suspicious static signals were detected.

Trigger

unknown

Impact

unknown

Mechanism

unknown pending source inspection

Rationale

The required direct source inspection could not occur: read-only shell creation failed for both configured shell attempts. Scanner hints alone are insufficient to classify the package as clean, suspicious, or malicious.

Decision evidence

public snapshot

AI called this Manual Review at 5.0% confidence as Unknown with high false-positive risk.

Evidence for warning

Read-only inspection attempted twice; shell process creation failed before any package file could be read.
Static hints identify network and Google FCM code, but are unverified scanner metadata.

Evidence against

No lifecycle hooks are reported in the unverified manifest hint.
No package source was successfully inspected, so no concrete malicious behavior is established.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,403 file(s), 2.98 MB of source, external domains: 127.0.0.1, accounts.google.com, accounts.zoho.com, accounts.zoho.in, api.amazon.com, client.finnoto.in, docs.google.com, ei5oni4xxk.execute-api.ap-south-1.amazonaws.com, gmail.googleapis.com, oauth2.googleapis.com, sellercentral.amazon.in, slack.com, stogyux6hk.execute-api.ap-south-1.amazonaws.com, www.googleapis.com

Source & flagged code

3 flagged

dist/access/libraries/send.fcm.notification.jsView file

Lines 69-103javascript

69 attributes: { ...this.payload?.attributes, response },

70 });

71 return wm.save();

72 }

73 async getToken() {

74 const cacheKey = `fcm.access.token`;

75 const token = await this.cacheService.get(cacheKey);

76 if (token)

77 return token;

78 const newToken = await this.getTokenFromTheGoogle();

79 if (!newToken)

80 return;

81 await this.cacheService.set(cacheKey, newToken?.access_token, (0, date_fns_1.addMinutes)(new Date(), 45));

82 return newToken?.access_token;

83 }

84 async getTokenFromTheGoogle() {

85 const email = await this.propertyService.get('fcm.email');

86 const propertyKey = await this.propertyService.get('fcm.api.key');

87 const client = new google_auth_library_1.JWT({

88 email,

89 key: `-----BEGIN PRIVATE KEY-----\n${propertyKey}\n-----END PRIVATE KEY-----`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

90 scopes: ['https://www.googleapis.com/auth/cloud-platform'],

91 });

92 try {

93 const newToken = await client.authorize();

94 return newToken;

95 }

96 catch (error) {

97 console.log(error);

98 return;

99 }

100 }

101}

102exports.SendFcmNotification = SendFcmNotification;

103//# sourceMappingURL=send.fcm.notification.js.map

dist/access/libraries/process.notification.jsView file

Lines 13-53javascript

13 const notification = await notification_entity_1.NotificationEntity.findOne({

14 where: { identifier: payload.identifier },

15 relations: ['sms.template', 'emails.template', 'whatsapp.template', 'slack.template', 'gchat.template', 'inapp', 'fcm.template'],

16 });

Source & flagged code

3 flagged · loading source

dist/access/libraries/send.fcm.notification.jsView file

89patternName = private_key_rsa severity = critical line = 89 matchedText = key: `--...--`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

89patternName = private_key_rsa severity = critical line = 89 matchedText = key: `--...--`,

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

dist/access/libraries/process.notification.jsView file

33const { condition = '' } = email?.filter_condition || {}; L34: eval(condition); L35: if (send)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/access/libraries/process.notification.jsView on unpkg · L33

Findings

2 Critical2 Medium5 Low

CriticalCritical Secretdist/access/libraries/send.fcm.notification.js

CriticalSecret Patterndist/access/libraries/send.fcm.notification.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/access/libraries/process.notification.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/access/libraries/send.fcm.notification.jsView file

Lines 69-103javascript

69 attributes: { ...this.payload?.attributes, response },

70 });

71 return wm.save();

72 }

73 async getToken() {

74 const cacheKey = `fcm.access.token`;

75 const token = await this.cacheService.get(cacheKey);

76 if (token)

77 return token;

78 const newToken = await this.getTokenFromTheGoogle();

79 if (!newToken)

80 return;

81 await this.cacheService.set(cacheKey, newToken?.access_token, (0, date_fns_1.addMinutes)(new Date(), 45));

82 return newToken?.access_token;

83 }

84 async getTokenFromTheGoogle() {

85 const email = await this.propertyService.get('fcm.email');

86 const propertyKey = await this.propertyService.get('fcm.api.key');

87 const client = new google_auth_library_1.JWT({

88 email,

89 key: `-----BEGIN PRIVATE KEY-----\n${propertyKey}\n-----END PRIVATE KEY-----`,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

Critical

Secret Pattern

RSA private key in dist/access/libraries/send.fcm.notification.js

dist/access/libraries/send.fcm.notification.jsView on unpkg · L89

90 scopes: ['https://www.googleapis.com/auth/cloud-platform'],

91 });

92 try {

93 const newToken = await client.authorize();

94 return newToken;

95 }

96 catch (error) {

97 console.log(error);

98 return;

99 }

100 }

101}

102exports.SendFcmNotification = SendFcmNotification;

103//# sourceMappingURL=send.fcm.notification.js.map

dist/access/libraries/process.notification.jsView file

Lines 13-53javascript

13 const notification = await notification_entity_1.NotificationEntity.findOne({

14 where: { identifier: payload.identifier },

15 relations: ['sms.template', 'emails.template', 'whatsapp.template', 'slack.template', 'gchat.template', 'inapp', 'fcm.template'],

16 });