Loading npm security reports…

@stacksjs/push@0.70.69: Clean npm security report (Allow) | LPM Firewall

registry / @stacksjs/push / 0.70.69

@stacksjs/push@0.70.69

The Stacks Push integration

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network requests occur only when exported push or topic-management functions are called with caller-provided messages and credentials.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes exported Expo or FCM send, receipt, or topic functions.

Impact

Delivers requested push notifications or manages requested FCM topics; no unconsented local mutation or exfiltration is established.

Mechanism

User-invoked Expo/FCM API requests using supplied tokens or credentials.

Rationale

The package is a push-notification client whose network and credential-handling code is invoked explicitly through its exported API. The scanner's critical secret signal is a false positive: the bundle handles a configured FCM private key but contains no credential or malicious collection path.

Evidence

package.jsondist/index.jsdist/drivers/expo.d.tsdist/drivers/fcm.d.ts

Network endpoints7

exp.host/--/api/v2/push/sendexp.host/--/api/v2/push/getReceiptsfcm.googleapis.com/fcm/sendfcm.googleapis.com/v1/projectsoauth2.googleapis.com/tokeniid.googleapis.com/iid/v1:batchAddiid.googleapis.com/iid/v1:batchRemove

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` sends user-supplied push payloads to Expo and FCM endpoints.
`dist/index.js` signs a configured FCM service-account key to obtain an OAuth token.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook.
`dist/index.js` exports push functions and makes no network request at import time.
No filesystem access, shell execution, dynamic code loading, or persistence primitives found.
The apparent private-key pattern processes caller-provided FCM configuration; no embedded credential is present.
All observed network calls implement the package's advertised Expo/FCM push functionality.

Behavioral surface

Source

Network

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.50 KB of source, external domains: exp.host, fcm.googleapis.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-3javascript

1// @bun

2var y=Object.defineProperty;var h=(G)=>G;function T(G,J){this[G]=h.bind(null,J)}var C=(G,J)=>{for(var N in J)y(G,N,{get:J[N],enumerable:!0,configurable:!0,set:T.bind(J,N)})};var z={};C(z,{sendBatch:()=>L,send:()=>j,isExpoPushToken:()=>w,getReceipts:()=>E,default:()=>u,Send:()=>j});import{log as X}from"@stacksjs/cli";var d="https://exp.host/--/api/v2/push/send";function w(G){return/^Expo(?:nent)?PushToken\[.+\]$/.test(G)||/^[a-zA-Z0-9-_]+$/.test(G)}async function j(G){let J=Array.isArray(G.to)?G.to:[G.to],N=J.filter((W)=>!w(W));if(N.length>0)X.warn(`Invalid Expo push tokens found: ${N.join(", " ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings