registry / @tapi-dev/sdk / 0.1.34

@tapi-dev/sdk@0.1.34

Official JavaScript and TypeScript client for TAPI developer APIs.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 172 KB of source, external domains: 127.0.0.1, d4xaf52nfwiok.cloudfront.net, determined-motivation-production.up.railway.app, identitytoolkit.googleapis.com, rsarlong-1f92fd.gitlab.io, securetoken.googleapis.com

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { createServer as createNetServer } from "node:net";

5import { createHash, randomUUID } from "node:crypto";

6import { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";

7import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises";

8import { homedir } from "node:os";

9import { basename, dirname, join, resolve } from "node:path";

10import { performance } from "node:perf_hooks";

11import { emitKeypressEvents } from "node:readline";

12import { Readable, Transform } from "node:stream";

13import { pipeline } from "node:stream/promises";

14import { fileURLToPath, pathToFileURL } from "node:url";

15import { TapiClient } from "./index.js";

16import { loadWorkspace, normalizeProjectValue, writeWorkspaceConfig, } from "./workspace.js";

17const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";

18const DEFAULT_STUDIO_API_BASE_URL = "https://determined-motivation-production.up.railway.app";

19const DEFAULT_STUDIO_AUTH_HTML_URL = "https://rsarlong-1f92fd.gitlab.io/auth.html";

20const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

21const DEFAULT_CHANNEL = "pilot";

22const SUPPORTED_STUDIO_PLATFORM = "windows-x86_64";

23const DEFAULT_INSTALL_AUTH_TIMEOUT_MS = 120_000;

24const PORTABLE_STUDIO_SERVER_READY_TIMEOUT_MS = 30_000;

25const PORTABLE_STUDIO_SERVER_READY_INTERVAL_MS = 250;

26const DOWNLOAD_STALL_TIMEOUT_MS = 30_000;

27const DOWNLOAD_PROGRESS_LOG_BYTES = 50 * 1024 * 1024;

28const MAX_WIDE_EVENT_PROCESS_ROOTS = 5;

29const MAX_NONCURRENT_MANAGED_DOWNLOADS = 0;

30const MAX_NONCURRENT_MANAGED_RELEASES = 0;

31const WINDOWS_SERVICE_STATUS_TIMEOUT_MS = 8_000;

32const WINDOWS_SERVICE_COMMAND_TIMEOUT_MS = 30_000;

33const MANAGED_RELEASE_MARKER = ".tapi-managed-release";

34const MIN_EXTRACTION_REQUIRED_BYTES = 1024 * 1024 * 1024;

35const EXTRACTION_REQUIRED_MULTIPLIER = 3;

36class StudioInstallApprovalError extends Error {

37 code;

38 status;

39 constructor(message, code, status) {

40 super(message);

Lines 986-1026javascript

986 return path;

987 }

988 }

989 return join(root, "tapi.config.json");

990}

991async function readApiTriggerConfig(configPath) {

992 if (!existsSync(configPath)) {

993 throw new

•matchType = previous_version_dangerous_delta matchedPackage = @tapi-dev/sdk@0.1.31 matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.1.31 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

20patternName = google_api_key severity = high line = 20 matchedText = const DE...gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

20patternName = google_api_key severity = high line = 20 matchedText = const DE...gE";

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

1006const moduleUrl = pathToFileURL(configPath).href; L1007: const module = await import(moduleUrl); L1008: return module.default ?? module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1006

Findings

3 High4 Medium6 Low

HighHigh Secretdist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

HighSecret Patterndist/cli.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { createServer as createNetServer } from "node:net";

5import { createHash, randomUUID } from "node:crypto";

6import { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";

7import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises";

8import { homedir } from "node:os";

9import { basename, dirname, join, resolve } from "node:path";

10import { performance } from "node:perf_hooks";

11import { emitKeypressEvents } from "node:readline";

12import { Readable, Transform } from "node:stream";

13import { pipeline } from "node:stream/promises";

14import { fileURLToPath, pathToFileURL } from "node:url";

15import { TapiClient } from "./index.js";

16import { loadWorkspace, normalizeProjectValue, writeWorkspaceConfig, } from "./workspace.js";

17const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";

18const DEFAULT_STUDIO_API_BASE_URL = "https://determined-motivation-production.up.railway.app";

19const DEFAULT_STUDIO_AUTH_HTML_URL = "https://rsarlong-1f92fd.gitlab.io/auth.html";

20const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/cli.jsView on unpkg · L20

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L20

21const DEFAULT_CHANNEL = "pilot";

22const SUPPORTED_STUDIO_PLATFORM = "windows-x86_64";

23const DEFAULT_INSTALL_AUTH_TIMEOUT_MS = 120_000;

24const PORTABLE_STUDIO_SERVER_READY_TIMEOUT_MS = 30_000;

25const PORTABLE_STUDIO_SERVER_READY_INTERVAL_MS = 250;

26const DOWNLOAD_STALL_TIMEOUT_MS = 30_000;

27const DOWNLOAD_PROGRESS_LOG_BYTES = 50 * 1024 * 1024;

28const MAX_WIDE_EVENT_PROCESS_ROOTS = 5;

29const MAX_NONCURRENT_MANAGED_DOWNLOADS = 0;

30const MAX_NONCURRENT_MANAGED_RELEASES = 0;

31const WINDOWS_SERVICE_STATUS_TIMEOUT_MS = 8_000;

32const WINDOWS_SERVICE_COMMAND_TIMEOUT_MS = 30_000;

33const MANAGED_RELEASE_MARKER = ".tapi-managed-release";

34const MIN_EXTRACTION_REQUIRED_BYTES = 1024 * 1024 * 1024;

35const EXTRACTION_REQUIRED_MULTIPLIER = 3;

36class StudioInstallApprovalError extends Error {

37 code;

38 status;

39 constructor(message, code, status) {

40 super(message);

Lines 986-1026javascript

986 return path;

987 }

988 }

989 return join(root, "tapi.config.json");

990}

991async function readApiTriggerConfig(configPath) {

992 if (!existsSync(configPath)) {

993 throw new

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg