registry / @simply-static/static-studio / 0.1.5

@simply-static/static-studio@0.1.5

Command-line interface for Static Studio hosting workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 179 KB of source, external domains: api.static.studio

Source & flagged code

3 flagged

dist/chunk-DEPNUBWV.jsView file

Lines 205-245javascript

205 for (const row of metricRows || []) {

206 const siteId = String(row.site_id || "");

207 if (!siteId ||

Source & flagged code

3 flagged · loading source

dist/chunk-DEPNUBWV.jsView file

225patternName = supabase_service_key severity = critical line = 225 matchedText = var DEFA...GM";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-DEPNUBWV.jsView on unpkg · L225

225patternName = supabase_service_key severity = critical line = 225 matchedText = var DEFA...GM";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-DEPNUBWV.js

dist/chunk-DEPNUBWV.jsView on unpkg · L225

dist/index.d.tsView file

189patternName = supabase_service_key severity = critical line = 189 matchedText = declare ...GM";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.d.ts

dist/index.d.tsView on unpkg · L189

Findings

3 Critical2 Medium5 Low

CriticalCritical Secretdist/chunk-DEPNUBWV.js

CriticalSecret Patterndist/chunk-DEPNUBWV.js

CriticalSecret Patterndist/index.d.ts

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

225var DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InlpbmdxZGltdmtlcW9udGFlc3hrIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Mjc3OTA4MzQsImV4cCI6MjA0MzM2NjgzNH0.wgw5P41QmXkdPkek9sUFBWEKTh_8ZVFLTmBwVGohVGM";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-DEPNUBWV.jsView on unpkg · L225

Critical

Secret Pattern

Supabase service role key (JWT) in dist/chunk-DEPNUBWV.js

dist/chunk-DEPNUBWV.jsView on unpkg · L225

dist/index.d.tsView file

Lines 169-209typescript

169declare function saveSiteAlerts(supabase: SupabaseClient, siteId: string | number, options: SaveSiteAlertsOptions): Promise<SaveSiteAlertsResult>;

170declare function sendTestSiteAlert(supabase: SupabaseClient, siteId: string | number, recipients: readonly string[]): Promise<SendTestSiteAlertResult>;

171

172declare function getConfigPath(): string;

173declare function getEmptyConfig(): StoredConfig;

174declare function loadConfig(): Promise<StoredConfig>;

175declare function saveConfig(config: StoredConfig): Promise<void>;

176declare function getProfile(profileName?: string): Promise<{

177 config: StoredConfig;

178 profileName: string;

179 profile: StoredProfile | undefined;

180}>;

181declare function setProfile(profile: StoredProfile, profileName?: string): Promise<void>;

182declare function removeProfile(profileName?: string): Promise<boolean>;

183declare function getSupabaseConfig(config: StoredConfig): {

184 url: string;

185 anonKey: string;

186};

187

188declare const DEFAULT_SUPABASE_URL = "https://api.static.studio";

189declare const DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InlpbmdxZGltdmtlcW9udGFlc3hrIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Mjc3OTA4MzQsImV4cCI6MjA0MzM2NjgzNH0.wgw5P41QmXkdPkek9sUFBWEKTh_8ZVFLTmBwVGohVGM";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.d.ts

dist/index.d.tsView on unpkg · L189

190declare const DEFAULT_TLD = "onstatic.studio";

191declare const SUPABASE_API_VERSION = 2;

192

193interface DomainMutationResult {

194 domain: string;

195 primary?: string | null;

196 removed?: string[];

197 connect?: unknown;

198 refresh?: unknown;

199 registry?: unknown;

200 export?: unknown;

201 warnings?: string[];

202}

203declare function getHostnames(supabase: SupabaseClient, pullZoneId: string): Promise<string[]>;

204declare function addDomain(supabase: SupabaseClient, siteId: string, domain: string): Promise<DomainMutationResult>;

205declare function setPrimaryDomain(supabase: SupabaseClient, siteId: string, domain: string): Promise<DomainMutationResult>;

206declare function setMountPath(supabase: SupabaseClient, siteId: string, publicDomain: string, mountPath: string): Promise<DomainMutationResult & {

207 mount_path: string;

208}>;

209declare function removeDomain(supabase: SupabaseClient, siteId: string, domain: string): Promise<DomainMutationResult>;