Loading npm security reports…

@stacksjs/push@0.70.66: Clean npm security report (Allow) | LPM Firewall

registry / @stacksjs/push / 0.70.66

@stacksjs/push@0.70.66

The Stacks Push integration

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network activity is limited to user-invoked Expo/FCM push delivery and FCM OAuth token exchange.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes `send`, FCM topic subscription, receipt retrieval, or related exported API.

Impact

Delivers notifications to caller-provided device tokens/topics; credentials are used only as API authorization.

Mechanism

Sends caller-provided notifications using Expo and Firebase Cloud Messaging APIs.

Rationale

Source implements an explicit Expo/FCM push client. The scanner's secret signal corresponds to caller-provided FCM service-account/server-key fields used to authenticate requested provider calls, not embedded secrets or exfiltration.

Evidence

package.jsondist/index.jsdist/index.d.tsdist/drivers/fcm.d.tsdist/drivers/expo.d.ts

Network endpoints7

exp.host/--/api/v2/push/sendexp.host/--/api/v2/push/getReceiptsfcm.googleapis.com/fcm/sendfcm.googleapis.com/v1/projectsoauth2.googleapis.com/tokeniid.googleapis.com/iid/v1:batchAddiid.googleapis.com/iid/v1:batchRemove

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has only `prepublishOnly`; no install lifecycle hook.
`dist/index.js` exports push-notification functions; importing only defines functions/configuration.
Network calls target Expo, Firebase, Google OAuth, and FCM endpoints for requested push operations.
FCM credentials are supplied to `configure`; no environment or filesystem harvesting is present.
No child-process, shell, eval, dynamic loading, filesystem writes, or persistence primitives found.

Behavioral surface

Source

Network

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.50 KB of source, external domains: exp.host, fcm.googleapis.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-3javascript

1// @bun

2var y=Object.defineProperty;var h=(G)=>G;function T(G,J){this[G]=h.bind(null,J)}var C=(G,J)=>{for(var N in J)y(G,N,{get:J[N],enumerable:!0,configurable:!0,set:T.bind(J,N)})};var z={};C(z,{sendBatch:()=>L,send:()=>j,isExpoPushToken:()=>w,getReceipts:()=>E,default:()=>u,Send:()=>j});import{log as X}from"@stacksjs/cli";var d="https://exp.host/--/api/v2/push/send";function w(G){return/^Expo(?:nent)?PushToken\[.+\]$/.test(G)||/^[a-zA-Z0-9-_]+$/.test(G)}async function j(G){let J=Array.isArray(G.to)?G.to:[G.to],N=J.filter((W)=>!w(W));if(N.length>0)X.warn(`Invalid Expo push tokens found: ${N.join(", " ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings