registry / @tak-ps/node-tak / 12.19.0

@tak-ps/node-tak@12.19.0

Lightweight JavaScript library for communicating with TAK Server

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 288 KB of source

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 117-158javascript

117 value: 'stream'

118 }].concat(Object.keys(CommandList).map((profile) => {

119 return {

120 name: profile,

121 value: profile

122 };

123 }))

124 });

125}

126await fs.writeFile(configPath, JSON.stringify(config, null, 4));

127let auth = config.profiles[profile].auth;

128if (authPath) {

129 const password = process.env.TAK_P12_PASSWORD || await input({ message: 'P12 Container Password' });

130 const certs = getPemFromP12(authPath, password);

131 const cert = certs.pemCertificate

132 .split('-----BEGIN CERTIFICATE-----')

133 .join('-----BEGIN CERTIFICATE-----\n')

134 .split('-----END CERTIFICATE-----')

135 .join('\n-----END CERTIFICATE-----');

136 const key = certs.pemKey

137 .split('-----BEGIN RSA PRIVATE KEY-----')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.jsView on unpkg · L137

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L137

138 .join('-----BEGIN RSA PRIVATE KEY-----\n')

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L138

139 .split('-----END RSA PRIVATE KEY-----')

140 .join('\n-----END RSA PRIVATE KEY-----');

141 auth = { cert, key };

142}

143if (!auth)

144 throw new Error(`No Auth in ${profile} profile`);

145if (command === 'stream') {

146 const tak = await TAK.connect(new URL('ssl://' + config.profiles[profile].host + ':' + config.profiles[profile].ports.stream), auth);

147 tak.on('cot', (cot) => {

148 console.log(JSON.stringify(CoTParser.to_geojson(cot)));

149 });

150}

151else {

152 if (!config.profiles[profile].auth) {

153 throw new Error(`No Auth in ${profile} profile`);

154 }

155 const tak = new TAKAPI(new URL('https://' + config.profiles[profile].host + ':' + config.profiles[profile].ports.marti), new APIAuthCertificate(auth.cert, auth.key));

156 const invokeTest = tak[CommandList[command]];

157 if (!invokeTest || !(invokeTest instanceof Commands)) {

158 throw new Error(`${command} not found`);

cli.tsView file

Lines 160-201typescript

160await fs.writeFile(

161 configPath,

162 JSON.stringify(config, null, 4)

163)

164

165

166let auth = config.profiles[profile].auth;

167

168if (authPath) {

169

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

137patternName = private_key_rsa severity = critical line = 137 matchedText = .split('...--')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.jsView on unpkg · L137

137patternName = private_key_rsa severity = critical line = 137 matchedText = .split('...--')

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L137

138patternName = private_key_rsa severity = critical line = 138 matchedText = .join('-...\n')

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L138

cli.tsView file

180patternName = private_key_rsa severity = critical line = 180 matchedText = .split('...--')

Critical

Secret Pattern

RSA private key in cli.ts

cli.tsView on unpkg · L180

181patternName = private_key_rsa severity = critical line = 181 matchedText = .join('-...\n')

Critical

Secret Pattern

RSA private key in cli.ts

cli.tsView on unpkg · L181

Findings

5 Critical2 Medium3 Low

CriticalCritical Secretdist/cli.js

CriticalSecret Patterndist/cli.js

CriticalSecret Patterncli.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 117-158javascript

117 value: 'stream'

118 }].concat(Object.keys(CommandList).map((profile) => {

119 return {

120 name: profile,

121 value: profile

122 };

123 }))

124 });

125}

126await fs.writeFile(configPath, JSON.stringify(config, null, 4));

127let auth = config.profiles[profile].auth;

128if (authPath) {

129 const password = process.env.TAK_P12_PASSWORD || await input({ message: 'P12 Container Password' });

130 const certs = getPemFromP12(authPath, password);

131 const cert = certs.pemCertificate

132 .split('-----BEGIN CERTIFICATE-----')

133 .join('-----BEGIN CERTIFICATE-----\n')

134 .split('-----END CERTIFICATE-----')

135 .join('\n-----END CERTIFICATE-----');

136 const key = certs.pemKey

137 .split('-----BEGIN RSA PRIVATE KEY-----')

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli.jsView on unpkg · L137

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L137

138 .join('-----BEGIN RSA PRIVATE KEY-----\n')

Critical

Secret Pattern

RSA private key in dist/cli.js

dist/cli.jsView on unpkg · L138

139 .split('-----END RSA PRIVATE KEY-----')

140 .join('\n-----END RSA PRIVATE KEY-----');

141 auth = { cert, key };

142}

143if (!auth)

144 throw new Error(`No Auth in ${profile} profile`);

145if (command === 'stream') {

146 const tak = await TAK.connect(new URL('ssl://' + config.profiles[profile].host + ':' + config.profiles[profile].ports.stream), auth);

147 tak.on('cot', (cot) => {

148 console.log(JSON.stringify(CoTParser.to_geojson(cot)));

149 });

150}

151else {

152 if (!config.profiles[profile].auth) {

153 throw new Error(`No Auth in ${profile} profile`);

154 }

155 const tak = new TAKAPI(new URL('https://' + config.profiles[profile].host + ':' + config.profiles[profile].ports.marti), new APIAuthCertificate(auth.cert, auth.key));

156 const invokeTest = tak[CommandList[command]];

157 if (!invokeTest || !(invokeTest instanceof Commands)) {

158 throw new Error(`${command} not found`);

cli.tsView file

Lines 160-201typescript

160await fs.writeFile(

161 configPath,

162 JSON.stringify(config, null, 4)

163)

164

165

166let auth = config.profiles[profile].auth;

167

168if (authPath) {

169