Loading npm security reports…

@stacksjs/push@0.70.68: Clean npm security report (Allow) | LPM Firewall

registry / @stacksjs/push / 0.70.68

@stacksjs/push@0.70.68

The Stacks Push integration

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network activity is limited to user-invoked push-notification delivery and FCM authentication.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes exported Expo or FCM send, receipt, or topic functions.

Impact

Delivers notifications using caller-provided tokens and configured FCM credentials.

Mechanism

Posts caller-supplied notification data to Expo and Firebase APIs.

Rationale

The package is a push-notification client whose network requests are explicit runtime functionality, not install- or import-time behavior. The scanner's secret finding is a false positive caused by FCM credential configuration support; no concrete malicious chain is present.

Evidence

package.jsondist/index.jsdist/index.d.tsdist/drivers/fcm.d.tsdist/drivers/expo.d.tsREADME.md

Network endpoints7

exp.host/--/api/v2/push/sendexp.host/--/api/v2/push/getReceiptsfcm.googleapis.com/fcm/sendfcm.googleapis.com/v1/projectsoauth2.googleapis.com/tokeniid.googleapis.com/iid/v1:batchAddiid.googleapis.com/iid/v1:batchRemove

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` sends caller-provided Expo/FCM push payloads via `fetch`.
`dist/index.js` creates an OAuth JWT from caller-configured FCM service-account credentials.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook.
`dist/index.js` exports notification functions; network calls occur only when those functions are invoked.
No filesystem access, shell/process execution, dynamic code loading, or persistence APIs found.
No embedded credentials found; the apparent secret signal is the `privateKey` configuration field.
All observed endpoints are Expo, Firebase Cloud Messaging, or Google OAuth services aligned with push delivery.

Behavioral surface

Source

Network

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.50 KB of source, external domains: exp.host, fcm.googleapis.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-3javascript

1// @bun

2var y=Object.defineProperty;var h=(G)=>G;function T(G,J){this[G]=h.bind(null,J)}var C=(G,J)=>{for(var N in J)y(G,N,{get:J[N],enumerable:!0,configurable:!0,set:T.bind(J,N)})};var z={};C(z,{sendBatch:()=>L,send:()=>j,isExpoPushToken:()=>w,getReceipts:()=>E,default:()=>u,Send:()=>j});import{log as X}from"@stacksjs/cli";var d="https://exp.host/--/api/v2/push/send";function w(G){return/^Expo(?:nent)?PushToken\[.+\]$/.test(G)||/^[a-zA-Z0-9-_]+$/.test(G)}async function j(G){let J=Array.isArray(G.to)?G.to:[G.to],N=J.filter((W)=>!w(W));if(N.length>0)X.warn(`Invalid Expo push tokens found: ${N.join(", " ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings