registry / @splyntra/sdk / 1.3.0

@splyntra/sdk@1.3.0

Splyntra TypeScript SDK - Agent observability & security, built on OpenTelemetry

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEvalNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 58.2 KB of source

Source & flagged code

5 flagged

dist/redaction.test.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3// SPDX-License-Identifier: Apache-2.0

4const vitest_1 = require("vitest");

5const redaction_1 = require("./redaction");

6(0, vitest_1.describe)("redactString", () => {

7 (0, vitest_1.it)("redacts AWS access keys", () => {

8 const out = (0, redaction_1.redactString)("key AKIAIOSFODNN7EXAMPLE end");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/redaction.test.jsView on unpkg · L8

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L8

9 (0, vitest_1.expect)(out).not.toContain("AKIA");

10 (0, vitest_1.expect)(out).toContain("[REDACTED:AWS_KEY]");

11 });

12 (0, vitest_1.it)("redacts JWTs", () => {

13 const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.abc123def";

14 (0, vitest_1.expect)((0, redaction_1.redactString)(`token=${jwt}`)).toContain("[REDACTED:JWT]");

15 });

16 (0, vitest_1.it)("redacts bearer tokens and api keys", () => {

17 (0, vitest_1.expect)((0, redaction_1.redactString)("Authorization: Bearer abcDEF123.tok")).toContain("[REDACTED:BEARER]");

18 (0, vitest_1.expect)((0, redaction_1.redactString)('api_key="abcdef0123456789abcdef"')).toContain("[REDACTED:API_KEY]");

19 });

20 (0, vitest_1.it)("leaves clean text untouched", () => {

21 const clean = "The agent planned a refund for order 42.";

22 (0, vitest_1.expect)((0, redaction_1.redactString)(clean)).toBe(clean);

23 });

24});

25(0, vitest_1.describe)("RedactingSpanProcessor", () => {

26 (0, vitest_1.it)("scrubs string attributes on span end", () => {

27 const span = { attributes: { "splyntra.input": "key AKIAIOSFODNN7EXAMPLE", n: 5 } };

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L27

28 new redaction_1.RedactingSpanProcessor().onEnd(span);

29 (0, vitest_1.expect)(span.attributes["splyntra.input"]).not.toContain("AKIA");

30 (0, vitest_1.expect)(span.attributes.n).toBe(5);

31 });

32});

33//# sourceMappingURL=redaction.test.js.map

dist/instrumentors/patch.jsView file

Lines 8-48javascript

8// prototypes. An instrumentor that patches only the require() copy is therefore

9// a silent no-op in an ESM app (which imports the ESM copy) — the exact bug this

10// helper fixes. patchDual applies a patch to both builds:

11//

12// • require(): synchronous — covers CJS apps immediately.

13// • import(): the ESM copy. In an ESM app the target module is already loaded

14// by the time Splyntra initializes, so the patch lands on the next microtask

15// — before any network call in a long-lived process (e.g. a server that

16// serves requests after startup). For a script that makes its very first

17// provider call synchronously in the same tick as Splyntra construction,

dist/guard.test.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3// SPDX-License-Identifier: Apache-2.0

4const vitest_1 = require("vitest");

5const guard_1 = require("./guard");

Source & flagged code

5 flagged · loading source

dist/redaction.test.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = const ou...d");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/redaction.test.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = const ou...d");

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L8

27patternName = aws_access_key severity = critical line = 27 matchedText = const sp...} };

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L27

dist/instrumentors/patch.jsView file

28// `module: commonjs`, which would reload the CJS build and defeat the purpose. L29: const esmImport = new Function("spec", "return import(spec)"); L30: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/instrumentors/patch.jsView on unpkg · L28

dist/guard.test.jsView file

3// SPDX-License-Identifier: Apache-2.0 L4: const vitest_1 = require("vitest"); L5: const guard_1 = require("./guard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/guard.test.jsView on unpkg · L3

Findings

3 Critical3 Medium4 Low

CriticalCritical Secretdist/redaction.test.js

CriticalSecret Patterndist/redaction.test.js

MediumDynamic Requiredist/guard.test.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/instrumentors/patch.js

LowHigh Entropy Strings

Source & flagged code

5 flagged

dist/redaction.test.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3// SPDX-License-Identifier: Apache-2.0

4const vitest_1 = require("vitest");

5const redaction_1 = require("./redaction");

6(0, vitest_1.describe)("redactString", () => {

7 (0, vitest_1.it)("redacts AWS access keys", () => {

8 const out = (0, redaction_1.redactString)("key AKIAIOSFODNN7EXAMPLE end");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/redaction.test.jsView on unpkg · L8

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L8

9 (0, vitest_1.expect)(out).not.toContain("AKIA");

10 (0, vitest_1.expect)(out).toContain("[REDACTED:AWS_KEY]");

11 });

12 (0, vitest_1.it)("redacts JWTs", () => {

13 const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.abc123def";

14 (0, vitest_1.expect)((0, redaction_1.redactString)(`token=${jwt}`)).toContain("[REDACTED:JWT]");

15 });

16 (0, vitest_1.it)("redacts bearer tokens and api keys", () => {

17 (0, vitest_1.expect)((0, redaction_1.redactString)("Authorization: Bearer abcDEF123.tok")).toContain("[REDACTED:BEARER]");

18 (0, vitest_1.expect)((0, redaction_1.redactString)('api_key="abcdef0123456789abcdef"')).toContain("[REDACTED:API_KEY]");

19 });

20 (0, vitest_1.it)("leaves clean text untouched", () => {

21 const clean = "The agent planned a refund for order 42.";

22 (0, vitest_1.expect)((0, redaction_1.redactString)(clean)).toBe(clean);

23 });

24});

25(0, vitest_1.describe)("RedactingSpanProcessor", () => {

26 (0, vitest_1.it)("scrubs string attributes on span end", () => {

27 const span = { attributes: { "splyntra.input": "key AKIAIOSFODNN7EXAMPLE", n: 5 } };

Critical

Secret Pattern

AWS access key ID in dist/redaction.test.js

dist/redaction.test.jsView on unpkg · L27

28 new redaction_1.RedactingSpanProcessor().onEnd(span);

29 (0, vitest_1.expect)(span.attributes["splyntra.input"]).not.toContain("AKIA");

30 (0, vitest_1.expect)(span.attributes.n).toBe(5);

31 });

32});

33//# sourceMappingURL=redaction.test.js.map

dist/instrumentors/patch.jsView file

Lines 8-48javascript

8// prototypes. An instrumentor that patches only the require() copy is therefore

9// a silent no-op in an ESM app (which imports the ESM copy) — the exact bug this

10// helper fixes. patchDual applies a patch to both builds:

11//

12// • require(): synchronous — covers CJS apps immediately.

13// • import(): the ESM copy. In an ESM app the target module is already loaded

14// by the time Splyntra initializes, so the patch lands on the next microtask

15// — before any network call in a long-lived process (e.g. a server that

16// serves requests after startup). For a script that makes its very first

17// provider call synchronously in the same tick as Splyntra construction,

dist/guard.test.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3// SPDX-License-Identifier: Apache-2.0

4const vitest_1 = require("vitest");

5const guard_1 = require("./guard");