registry / @sharkvoid/rasp / 2.2.12

@sharkvoid/rasp@2.2.12

Production-grade Runtime Application Self-Protection for Express, Next.js, Firebase, and Supabase. Defends against SQL injection, XSS, path traversal, command injection, bots, brute force, and AI-powered attackers. Powered by SharkVoid.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 102 KB of source, external domains: api.hcaptcha.com, check.torproject.org, github.com, js.hcaptcha.com, us-central1-sharkvoid-bd9df.cloudfunctions.net

Source & flagged code

2 flagged

src/honeypot.jsView file

Lines 130-165javascript

130 'daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin',

131 'www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin',

132 'fakeuser:x:1001:1001::/home/fakeuser:/bin/bash',

133 ].join('\n');

134 }

135

136 if (p.includes('git/config')) {

137 return [

138 '[core]',

139 ' repositoryformatversion = 0',

140 ' filemode = true',

141 '[remote "origin"]',

142 ' url = https://github.com/fake/repo.git',

143 ' fetch = +refs/heads/*:refs/remotes/origin/*',

144 ].join('\n');

145 }

146

147 if (p.includes('aws')) {

148 return [

149 '[default]',

150 'aws_access_key_id = AKIAFAKE7X9K2M4N8P3Q',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/honeypot.jsView on unpkg · L150

Critical

Secret Pattern

AWS access key ID in src/honeypot.js

src/honeypot.jsView on unpkg · L150

151 'aws_secret_access_key = fake/secret/key/8x2k9m4n7p3q1r5s',

152 'region = us-east-1',

153 ].join('\n');

154 }

155

156 // Generic fake admin panel

157 return JSON.stringify({

158 status: 'ok',

159 message: 'Access granted',

160 token: 'fake_admin_token_9f2k1x8m',

161 user: { id: 1, role: 'admin', email: 'admin@fake.internal' },

162 }, null, 2);

163}

164

165module.exports = { checkHoneypot, generateFakeResponse };

Source & flagged code

2 flagged · loading source

src/honeypot.jsView file

150patternName = aws_access_key severity = critical line = 150 matchedText = 'aws_acc...3Q',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/honeypot.jsView on unpkg · L150

150patternName = aws_access_key severity = critical line = 150 matchedText = 'aws_acc...3Q',

Critical

Secret Pattern

AWS access key ID in src/honeypot.js

src/honeypot.jsView on unpkg · L150

Findings

2 Critical1 High3 Medium2 Low

CriticalCritical Secretsrc/honeypot.js

CriticalSecret Patternsrc/honeypot.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/honeypot.jsView file

Lines 130-165javascript

130 'daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin',

131 'www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin',

132 'fakeuser:x:1001:1001::/home/fakeuser:/bin/bash',

133 ].join('\n');

134 }

135

136 if (p.includes('git/config')) {

137 return [

138 '[core]',

139 ' repositoryformatversion = 0',

140 ' filemode = true',

141 '[remote "origin"]',

142 ' url = https://github.com/fake/repo.git',

143 ' fetch = +refs/heads/*:refs/remotes/origin/*',

144 ].join('\n');

145 }

146

147 if (p.includes('aws')) {

148 return [

149 '[default]',

150 'aws_access_key_id = AKIAFAKE7X9K2M4N8P3Q',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/honeypot.jsView on unpkg · L150

Critical

Secret Pattern

AWS access key ID in src/honeypot.js

src/honeypot.jsView on unpkg · L150

151 'aws_secret_access_key = fake/secret/key/8x2k9m4n7p3q1r5s',

152 'region = us-east-1',

153 ].join('\n');

154 }

155

156 // Generic fake admin panel

157 return JSON.stringify({

158 status: 'ok',

159 message: 'Access granted',

160 token: 'fake_admin_token_9f2k1x8m',

161 user: { id: 1, role: 'admin', email: 'admin@fake.internal' },

162 }, null, 2);

163}

164

165module.exports = { checkHoneypot, generateFakeResponse };