registry / @servicetitan/hammer-token / 3.2.0

@servicetitan/hammer-token@3.2.0

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 27 file(s), 473 KB of source, external domains: api.figma.com, www.figma.com

Source & flagged code

1 flagged

src/utils/figma/auth.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

3/**

4 * Figma Authentication Module

5 *

6 * Handles loading configuration and OAuth2 refresh token authentication for Figma API access.

7 */

9const fs = require("fs");

10const path = require("path");

11const {

12 FIGMA_PROD_FILE_KEY,

13 COLLECTION_NAME,

14 LIGHT_MODE_NAME,

15 DARK_MODE_NAME,

16} = require("./constants");

17const { ConfigurationError } = require("./errors");

18const { validateFileKey } = require("./utils");

20// .env.local file path (repo root)

21const ENV_FILE = path.join(__dirname, "../../../../../.env.local");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/figma/auth.jsView on unpkg · L20

23/**

24 * Load environment variables from .env.local file if it exists

25 */

26function loadEnvFile() {

27 if (fs.existsSync(ENV_FILE)) {

28 try {

29 const envContent = fs.readFileSync(ENV_FILE, "utf8");

30 const lines = envContent.split("\n");

32 for (const line of lines) {

33 // Skip comments and empty lines

34 const trimmed = line.trim();

35 if (!trimmed || trimmed.startsWith("#")) {

36 continue;

37 }

39 // Parse KEY=VALUE format

40 const match = trimmed.match(/^([^=]+)=(.*)$/);

Source & flagged code

1 flagged · loading source

src/utils/figma/auth.jsView file

20// .env.local file path (repo root) L21: const ENV_FILE = path.join(__dirname, "../../../../../.env.local"); L22: ... L43: const value = match[2].trim().replace(/^["']|["']$/g, ""); // Remove quotes L44: // Only set if not already in process.env (env vars take precedence) L45: if (!process.env[key]) { ... L79: // Figma OAuth2 endpoints L80: const FIGMA_OAUTH_BASE = "https://api.figma.com/v1"; L81: const TOKEN_EXPIRY_BUFFER_MS = 60000; // Refresh 1 minute before expiry ... L193: try { L194: // Figma requires HTTP Basic Authentication with Base64 encoded client_id:client_secret L195: const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code