registry / @tapi-dev/sdk / 0.1.31

@tapi-dev/sdk@0.1.31

Official JavaScript and TypeScript client for TAPI developer APIs.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 172 KB of source, external domains: 127.0.0.1, d4xaf52nfwiok.cloudfront.net, determined-motivation-production.up.railway.app, identitytoolkit.googleapis.com, rsarlong-1f92fd.gitlab.io, securetoken.googleapis.com

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { createServer as createNetServer } from "node:net";

5import { createHash, randomUUID } from "node:crypto";

6import { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";

7import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises";

8import { homedir } from "node:os";

9import { basename, dirname, join, resolve } from "node:path";

10import { performance } from "node:perf_hooks";

11import { emitKeypressEvents } from "node:readline";

12import { Readable, Transform } from "node:stream";

13import { pipeline } from "node:stream/promises";

14import { fileURLToPath, pathToFileURL } from "node:url";

15import { TapiClient } from "./index.js";

16import { loadWorkspace, normalizeProjectValue, writeWorkspaceConfig, } from "./workspace.js";

17const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";

18const DEFAULT_STUDIO_API_BASE_URL = "https://determined-motivation-production.up.railway.app";

19const DEFAULT_STUDIO_AUTH_HTML_URL = "https://rsarlong-1f92fd.gitlab.io/auth.html";

20const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

21const DEFAULT_CHANNEL = "pilot";

22const SUPPORTED_STUDIO_PLATFORM = "windows-x86_64";

23const DEFAULT_INSTALL_AUTH_TIMEOUT_MS = 120_000;

24const PORTABLE_STUDIO_SERVER_READY_TIMEOUT_MS = 30_000;

25const PORTABLE_STUDIO_SERVER_READY_INTERVAL_MS = 250;

26const DOWNLOAD_STALL_TIMEOUT_MS = 30_000;

27const DOWNLOAD_PROGRESS_LOG_BYTES = 50 * 1024 * 1024;

28const MAX_WIDE_EVENT_PROCESS_ROOTS = 5;

29const MAX_NONCURRENT_MANAGED_DOWNLOADS = 0;

30const MAX_NONCURRENT_MANAGED_RELEASES = 0;

31const MANAGED_RELEASE_MARKER = ".tapi-managed-release";

32const MIN_EXTRACTION_REQUIRED_BYTES = 1024 * 1024 * 1024;

33const EXTRACTION_REQUIRED_MULTIPLIER = 3;

34class StudioInstallApprovalError extends Error {

35 code;

36 status;

37 constructor(message, code, status) {

38 super(message);

39 this.code = code;

40 this.status = status;

Lines 984-1024javascript

984 return path;

985 }

986 }

987 return join(root, "tapi.config.json");

988}

989async function readApiTriggerConfig(configPath) {

990 if (!existsSync(configPath)) {

991 throw new

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

20patternName = google_api_key severity = high line = 20 matchedText = const DE...gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

20patternName = google_api_key severity = high line = 20 matchedText = const DE...gE";

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

1004const moduleUrl = pathToFileURL(configPath).href; L1005: const module = await import(moduleUrl); L1006: return module.default ?? module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1004

Findings

2 High4 Medium6 Low

HighHigh Secretdist/cli.js

HighSecret Patterndist/cli.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { createServer as createNetServer } from "node:net";

5import { createHash, randomUUID } from "node:crypto";

6import { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";

7import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises";

8import { homedir } from "node:os";

9import { basename, dirname, join, resolve } from "node:path";

10import { performance } from "node:perf_hooks";

11import { emitKeypressEvents } from "node:readline";

12import { Readable, Transform } from "node:stream";

13import { pipeline } from "node:stream/promises";

14import { fileURLToPath, pathToFileURL } from "node:url";

15import { TapiClient } from "./index.js";

16import { loadWorkspace, normalizeProjectValue, writeWorkspaceConfig, } from "./workspace.js";

17const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";

18const DEFAULT_STUDIO_API_BASE_URL = "https://determined-motivation-production.up.railway.app";

19const DEFAULT_STUDIO_AUTH_HTML_URL = "https://rsarlong-1f92fd.gitlab.io/auth.html";

20const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

21const DEFAULT_CHANNEL = "pilot";

22const SUPPORTED_STUDIO_PLATFORM = "windows-x86_64";

23const DEFAULT_INSTALL_AUTH_TIMEOUT_MS = 120_000;

24const PORTABLE_STUDIO_SERVER_READY_TIMEOUT_MS = 30_000;

25const PORTABLE_STUDIO_SERVER_READY_INTERVAL_MS = 250;

26const DOWNLOAD_STALL_TIMEOUT_MS = 30_000;

27const DOWNLOAD_PROGRESS_LOG_BYTES = 50 * 1024 * 1024;

28const MAX_WIDE_EVENT_PROCESS_ROOTS = 5;

29const MAX_NONCURRENT_MANAGED_DOWNLOADS = 0;

30const MAX_NONCURRENT_MANAGED_RELEASES = 0;

31const MANAGED_RELEASE_MARKER = ".tapi-managed-release";

32const MIN_EXTRACTION_REQUIRED_BYTES = 1024 * 1024 * 1024;

33const EXTRACTION_REQUIRED_MULTIPLIER = 3;

34class StudioInstallApprovalError extends Error {

35 code;

36 status;

37 constructor(message, code, status) {

38 super(message);

39 this.code = code;

40 this.status = status;

Lines 984-1024javascript

984 return path;

985 }

986 }

987 return join(root, "tapi.config.json");

988}

989async function readApiTriggerConfig(configPath) {

990 if (!existsSync(configPath)) {

991 throw new