registry / @servicetitan/hammer-token / 3.4.0
@servicetitan/hammer-token@3.4.0
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
2 flagged · loading sourcesrc/utils/figma/auth.jsView file
20// .env.local file path (repo root)
L21: const ENV_FILE = path.join(__dirname, "../../../../../.env.local");
L22:
...
L43: const value = match[2].trim().replace(/^["']|["']$/g, ""); // Remove quotes
L44: // Only set if not already in process.env (env vars take precedence)
L45: if (!process.env[key]) {
...
L79: // Figma OAuth2 endpoints
L80: const FIGMA_OAUTH_BASE = "https://api.figma.com/v1";
L81: const TOKEN_EXPIRY_BUFFER_MS = 60000; // Refresh 1 minute before expiry
...
L193: try {
L194: // Figma requires HTTP Basic Authentication with Base64 encoded client_id:client_secret
L195: const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/figma/auth.jsView on unpkg · L20src/utils/figma/auth.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitysrc/utils/figma/auth.js
HighSemantic Analysis Limitedsrc/utils/figma/auth.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @servicetitan/hammer-token@3.4.0.
See all versions of @servicetitan/hammer-token for other recorded verdicts.
- Review the evidence and your use of @servicetitan/hammer-token@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.