registry / @servicetitan/hammer-token / 3.6.1
@servicetitan/hammer-token@3.6.1
⚠ Under reviewStatic Scan Results
scanned 3d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcesrc/utils/figma/auth.jsView file
20// .env.local file path (repo root)
L21: const ENV_FILE = path.join(__dirname, "../../../../../.env.local");
L22:
...
L43: const value = match[2].trim().replace(/^["']|["']$/g, ""); // Remove quotes
L44: // Only set if not already in process.env (env vars take precedence)
L45: if (!process.env[key]) {
...
L79: // Figma OAuth2 endpoints
L80: const FIGMA_OAUTH_BASE = "https://api.figma.com/v1";
L81: const TOKEN_EXPIRY_BUFFER_MS = 60000; // Refresh 1 minute before expiry
...
L193: try {
L194: // Figma requires HTTP Basic Authentication with Base64 encoded client_id:client_secret
L195: const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/utils/figma/auth.jsView on unpkg · L20•matchType = previous_version_dangerous_delta
matchedPackage = @servicetitan/hammer-token@3.4.0
matchedIdentity = npm:[redacted]:3.4.0
similarity = 0.929
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
src/utils/figma/auth.jsView on unpkgFindings
3 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitysrc/utils/figma/auth.js
HighSemantic Analysis Limitedsrc/utils/figma/auth.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/utils/figma/auth.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @servicetitan/hammer-token@3.6.1.
See all versions of @servicetitan/hammer-token for other recorded verdicts.
- Review the evidence and your use of @servicetitan/hammer-token@3.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.