registry / @things-factory/auth-base / 10.0.0-zeta.8

@things-factory/auth-base@10.0.0-zeta.8

Server-side module for handling authentication.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 160 file(s), 528 KB of source, external domains: www.hatiolab.com

Source & flagged code

9 flagged

config/config.development.jsView file

Lines 70-110javascript

70 defaultLanguage: 'en-US',

71 disableUserFavoredLanguage: false

72 },

73 recaptcha: {

74 /*

75 reCAPTCHA Configuration

76 This section sets up the reCAPTCHA service account and site key.

77 reCAPTCHA is used to verify whether the user is a human or a bot.

79 The service account can be created in the Google Cloud Console.

80 To create a service account, navigate to the "IAM & Admin" section,

81 select "Service accounts", and then click "Create Service Account".

82 Follow the prompts to generate the necessary credentials.

84 recapthca: {

85 serviceAccount: {

86 type: 'service_account',

87 project_id: '--',

88 private_key_id: '-----',

89 private_key:

90 '-----BEGIN PRIVATE KEY-----\nXXXX==\n-----END PRIVATE KEY-----\n',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/config.development.jsView on unpkg · L90

Critical

Secret Pattern

RSA private key in config/config.development.js

config/config.development.jsView on unpkg · L90

91 client_email: 'abc@xyz.com',

92 client_id: '----',

93 auth_uri: 'https://accounts.google.com/o/oauth2/auth',

94 token_uri: 'https://oauth2.googleapis.com/token',

95 auth_provider_x509_cert_url: 'https://www.googleapis.com/oauth2/v1/certs',

96 client_x509_cert_url: 'https://www.googleapis.com/robot/v1/metadata/x509/abc%40xyz.com',

97 universe_domain: 'googleapis.com'

98 },

99 siteKey: '6Ld1Dr4qAAAAAMJBYZheIOw8wQopz5NwraHAbCzt'

100 }

101

102 serviceAccount: reCAPTCHA service account information

103 - type: Service account type

104 - project_id: Project ID

105 - private_key_id: Private key ID

106 - private_key: Private key

107 - client_email: Client email

108 - client_id: Client ID

109 - auth_uri: Authentication URI

110 - token_uri: Token URI

dist-server/migrations/1548206416130-SeedUser.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SeedUsers1548206416130 = void 0;

4const typeorm_1 = require("typeorm");

5const

config/config.production.jsView file

Lines 68-108javascript

68 defaultLanguage: 'en-US',

69 disableUserFavoredLanguage: false

70 },

71 recaptcha: {

72 /*

73 reCAPTCHA Configuration

74 This section sets up the reCAPTCHA service account and site key.

75 reCAPTCHA is used to verify whether the user is a human or a bot.

helps/config/recaptcha.mdView file

Lines 17-50markdown

17- **client_id**: Client ID

18- **auth_uri**: Auth URI

19- **token_uri**: Token URI

20- **auth_provider_x509_cert_url**: Auth provider x509 cert URL

21- **client_x509_cert_url**: Client x509 cert URL

22- **universe_domain**: Universe domain

helps/config/recaptcha.zh.mdView file

Lines 17-50markdown

17- **client_id**: 客户端 ID

18- **auth_uri**: 认证 URI

19- **token_uri**: 令牌 URI

20- **auth_provider_x509_cert_url**: 认证提供者 x509 证书 URL

21- **client_x509_cert_url**: 客户端 x509 证书 URL

22- **universe_domain**: 宇宙域

helps/config/recaptcha.ms.mdView file

Lines 17-50markdown

17- **client_id**: ID pelanggan

18- **auth_uri**: URI pengesahan

19- **token_uri**: URI token

20- **auth_provider_x509_cert_url**: URL sijil x509 penyedia pengesahan

21- **client_x509_cert_url**: URL sijil x509 pelanggan

22- **universe_domain**: Domain alam semesta

helps/config/recaptcha.ko.mdView file

Lines 17-50markdown

17- **client_id**: 클라이언트 ID

18- **auth_uri**: 인증 URI

19- **token_uri**: 토큰 URI

20- **auth_provider_x509_cert_url**: 인증 제공자 x509 인증서 URL

21- **client_x509_cert_url**: 클라이언트 x509 인증서 URL

22- **universe_domain**: 유니버스 도메인

helps/config/recaptcha.ja.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.ja.md

helps/config/recaptcha.ja.mdView on unpkg · L37

Source & flagged code

9 flagged · loading source

config/config.development.jsView file

90patternName = private_key_rsa severity = critical line = 90 matchedText = '-----BE...\n',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/config.development.jsView on unpkg · L90

90patternName = private_key_rsa severity = critical line = 90 matchedText = '-----BE...\n',

Critical

Secret Pattern

RSA private key in config/config.development.js

config/config.development.jsView on unpkg · L90

dist-server/migrations/1548206416130-SeedUser.jsView file

3exports.SeedUsers1548206416130 = void 0; L4: const typeorm_1 = require("typeorm"); L5: const env_1 = require("@things-factory/env");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/migrations/1548206416130-SeedUser.jsView on unpkg · L3

config/config.production.jsView file

88patternName = private_key_rsa severity = critical line = 88 matchedText = '-----BE...\n',

Critical

Secret Pattern

RSA private key in config/config.production.js

config/config.production.jsView on unpkg · L88

helps/config/recaptcha.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.md

helps/config/recaptcha.mdView on unpkg · L37

helps/config/recaptcha.zh.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.zh.md

helps/config/recaptcha.zh.mdView on unpkg · L37

helps/config/recaptcha.ms.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.ms.md

helps/config/recaptcha.ms.mdView on unpkg · L37

helps/config/recaptcha.ko.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.ko.md

helps/config/recaptcha.ko.mdView on unpkg · L37

helps/config/recaptcha.ja.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.ja.md

helps/config/recaptcha.ja.mdView on unpkg · L37

Findings

8 Critical3 Medium3 Low

CriticalCritical Secretconfig/config.development.js

CriticalSecret Patternconfig/config.development.js

CriticalSecret Patternconfig/config.production.js

CriticalSecret Patternhelps/config/recaptcha.md

CriticalSecret Patternhelps/config/recaptcha.zh.md

CriticalSecret Patternhelps/config/recaptcha.ms.md

CriticalSecret Patternhelps/config/recaptcha.ko.md

CriticalSecret Patternhelps/config/recaptcha.ja.md

MediumDynamic Requiredist-server/migrations/1548206416130-SeedUser.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

config/config.development.jsView file

Lines 70-110javascript

70 defaultLanguage: 'en-US',

71 disableUserFavoredLanguage: false

72 },

73 recaptcha: {

74 /*

75 reCAPTCHA Configuration

76 This section sets up the reCAPTCHA service account and site key.

77 reCAPTCHA is used to verify whether the user is a human or a bot.

79 The service account can be created in the Google Cloud Console.

80 To create a service account, navigate to the "IAM & Admin" section,

81 select "Service accounts", and then click "Create Service Account".

82 Follow the prompts to generate the necessary credentials.

84 recapthca: {

85 serviceAccount: {

86 type: 'service_account',

87 project_id: '--',

88 private_key_id: '-----',

89 private_key:

90 '-----BEGIN PRIVATE KEY-----\nXXXX==\n-----END PRIVATE KEY-----\n',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/config.development.jsView on unpkg · L90

Critical

Secret Pattern

RSA private key in config/config.development.js

config/config.development.jsView on unpkg · L90

91 client_email: 'abc@xyz.com',

92 client_id: '----',

93 auth_uri: 'https://accounts.google.com/o/oauth2/auth',

94 token_uri: 'https://oauth2.googleapis.com/token',

95 auth_provider_x509_cert_url: 'https://www.googleapis.com/oauth2/v1/certs',

96 client_x509_cert_url: 'https://www.googleapis.com/robot/v1/metadata/x509/abc%40xyz.com',

97 universe_domain: 'googleapis.com'

98 },

99 siteKey: '6Ld1Dr4qAAAAAMJBYZheIOw8wQopz5NwraHAbCzt'

100 }

101

102 serviceAccount: reCAPTCHA service account information

103 - type: Service account type

104 - project_id: Project ID

105 - private_key_id: Private key ID

106 - private_key: Private key

107 - client_email: Client email

108 - client_id: Client ID

109 - auth_uri: Authentication URI

110 - token_uri: Token URI

dist-server/migrations/1548206416130-SeedUser.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SeedUsers1548206416130 = void 0;

4const typeorm_1 = require("typeorm");

5const

config/config.production.jsView file

Lines 68-108javascript

68 defaultLanguage: 'en-US',

69 disableUserFavoredLanguage: false

70 },

71 recaptcha: {

72 /*

73 reCAPTCHA Configuration

74 This section sets up the reCAPTCHA service account and site key.

75 reCAPTCHA is used to verify whether the user is a human or a bot.

helps/config/recaptcha.mdView file

Lines 17-50markdown

17- **client_id**: Client ID

18- **auth_uri**: Auth URI

19- **token_uri**: Token URI

20- **auth_provider_x509_cert_url**: Auth provider x509 cert URL

21- **client_x509_cert_url**: Client x509 cert URL

22- **universe_domain**: Universe domain

helps/config/recaptcha.zh.mdView file

Lines 17-50markdown

17- **client_id**: 客户端 ID

18- **auth_uri**: 认证 URI

19- **token_uri**: 令牌 URI

20- **auth_provider_x509_cert_url**: 认证提供者 x509 证书 URL

21- **client_x509_cert_url**: 客户端 x509 证书 URL

22- **universe_domain**: 宇宙域

helps/config/recaptcha.ms.mdView file

Lines 17-50markdown

17- **client_id**: ID pelanggan

18- **auth_uri**: URI pengesahan

19- **token_uri**: URI token

20- **auth_provider_x509_cert_url**: URL sijil x509 penyedia pengesahan

21- **client_x509_cert_url**: URL sijil x509 pelanggan

22- **universe_domain**: Domain alam semesta

helps/config/recaptcha.ko.mdView file

Lines 17-50markdown

17- **client_id**: 클라이언트 ID

18- **auth_uri**: 인증 URI

19- **token_uri**: 토큰 URI

20- **auth_provider_x509_cert_url**: 인증 제공자 x509 인증서 URL

21- **client_x509_cert_url**: 클라이언트 x509 인증서 URL

22- **universe_domain**: 유니버스 도메인

helps/config/recaptcha.ja.mdView file

37patternName = private_key_rsa severity = critical line = 37 matchedText = private_...\n',

Critical

Secret Pattern

RSA private key in helps/config/recaptcha.ja.md

helps/config/recaptcha.ja.mdView on unpkg · L37