Loading npm security reports…

@stacksjs/push@0.70.64: Clean npm security report (Allow) | LPM Firewall

registry / @stacksjs/push / 0.70.64

@stacksjs/push@0.70.64

The Stacks Push integration

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package performs user-invoked Expo and FCM push-notification requests using caller-supplied tokens or FCM credentials.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer calls exported Expo or FCM send, receipt, or topic functions.

Impact

Sends requested notifications; no install-time execution, file mutation, or credential harvesting is established.

Mechanism

User-invoked HTTPS requests to push-provider APIs.

Rationale

Source implements a conventional push-notification client with explicit exported calls to Expo and FCM. The scanner's secret signal is a README placeholder and credential-shaped configuration types, not a bundled secret or exfiltration path.

Evidence

package.jsondist/index.jsdist/index.d.tsdist/drivers/expo.d.tsdist/drivers/fcm.d.tsREADME.md

Network endpoints7

exp.host/--/api/v2/push/sendexp.host/--/api/v2/push/getReceiptsfcm.googleapis.com/fcm/sendfcm.googleapis.com/v1/projectsoauth2.googleapis.com/tokeniid.googleapis.com/iid/v1:batchAddiid.googleapis.com/iid/v1:batchRemove

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has only `prepublishOnly`; no install lifecycle hook or bin.
`dist/index.js` exports push functions without import-time network activity.
Network calls target Expo/Google FCM endpoints only when send/receipt/topic APIs are invoked.
FCM credentials are caller-provided through `configure`; no embedded credential was found.
README `SLACK_SECRET_KEY=SSK123` is a placeholder unrelated to runtime code.
No filesystem, shell, eval, dynamic-loading, or persistence primitives found.

Behavioral surface

Source

Network

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.50 KB of source, external domains: exp.host, fcm.googleapis.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-3javascript

1// @bun

2var y=Object.defineProperty;var h=(G)=>G;function T(G,J){this[G]=h.bind(null,J)}var C=(G,J)=>{for(var N in J)y(G,N,{get:J[N],enumerable:!0,configurable:!0,set:T.bind(J,N)})};var z={};C(z,{sendBatch:()=>L,send:()=>j,isExpoPushToken:()=>w,getReceipts:()=>E,default:()=>u,Send:()=>j});import{log as X}from"@stacksjs/cli";var d="https://exp.host/--/api/v2/push/send";function w(G){return/^Expo(?:nent)?PushToken\[.+\]$/.test(G)||/^[a-zA-Z0-9-_]+$/.test(G)}async function j(G){let J=Array.isArray(G.to)?G.to:[G.to],N=J.filter((W)=>!w(W));if(N.length>0)X.warn(`Invalid Expo push tokens found: ${N.join(", " ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings