registry / @tokenroll/watt / 0.1.1

@tokenroll/watt@0.1.1

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 880 KB of source, external domains: json-schema.org, llm.fantacy.live, open.feishu.cn, react.dev, www.w3.org

Oversized source lightweight scan

deploy/gateway/worker.js2.86 MB file, sampled 256 KB

ChildProcessShellHighEntropyStringsUrlStringsjson-schema.orgllm.fantacy.live

Source & flagged code

5 flagged

deploy/plugin-feishu/worker.jsView file

Lines 1511-1551javascript

1511 }

1512 return fromSPKI(formatPEM(encodeBase64(spki), "PUBLIC KEY"), alg, options);

1513 };

1514 }

1515});

1516

1517// node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/key/import.js

1518async function importSPKI(spki, alg, options) {

1519 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {

1520 throw new TypeError('"spki" must be SPKI formatted string');

1521 }

1522 return fromSPKI(spki, alg, options);

1523}

1524async function importX509(x509, alg, options) {

1525 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) {

1526 throw new TypeError('"x509" must be X.509 formatted string');

1527 }

1528 return fromX509(x509, alg, options);

1529}

1530async function importPKCS8(pkcs8, alg, options) {

1531 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

deploy/plugin-feishu/worker.jsView on unpkg · L1531

Critical

Secret Pattern

RSA private key in deploy/plugin-feishu/worker.js

deploy/plugin-feishu/worker.jsView on unpkg · L1531

1532 throw new TypeError('"pkcs8" must be PKCS#8 formatted string');

1533 }

1534 return fromPKCS8(pkcs8, alg, options);

1535}

1536async function importJWK(jwk, alg, options) {

1537 if (!isObject(jwk)) {

1538 throw new TypeError("JWK must be an object");

1539 }

1540 let ext;

1541 alg ??= jwk.alg;

1542 ext ??= options?.extractable ?? jwk.ext;

1543 switch (jwk.kty) {

1544 case "oct":

1545 if (typeof jwk.k !== "string" || !jwk.k) {

1546 throw new TypeError('missing "k" (Key Value) Parameter value');

1547 }

1548 return decode(jwk.k);

1549 case "RSA":

1550 if ("oth" in jwk && jwk.oth !== void 0) {

1551 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');

dist/bin.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { readFileSync, mkdirSync, writeFileSync, chmodSync, existsSync, cpSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve } from 'path';

5import { z } from 'zod';

6import { importJWK, SignJWT, generateKeyPair, exportJWK } from

deploy/gateway/worker.jsView file

•path = deploy/gateway/worker.js kind = oversized_source_file sizeBytes = 2998624 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

deploy/gateway/worker.jsView on unpkg

Source & flagged code

5 flagged · loading source

deploy/plugin-feishu/worker.jsView file

1531patternName = private_key_rsa severity = critical line = 1531 matchedText = if (type...0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

deploy/plugin-feishu/worker.jsView on unpkg · L1531

1531patternName = private_key_rsa severity = critical line = 1531 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in deploy/plugin-feishu/worker.js

deploy/plugin-feishu/worker.jsView on unpkg · L1531

dist/bin.jsView file

7import { Command } from 'commander'; L8: import { spawnSync } from 'child_process'; L9: import * as p from '@clack/prompts';

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L7

1886return (args) => { L1887: const res = spawn("npx", ["--yes", "wrangler@4.107.0", ...args]); L1888: return { status: res.status, out: `${res.stdout}${res.stderr}` };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L1886

deploy/gateway/worker.jsView file

•path = deploy/gateway/worker.js kind = oversized_source_file sizeBytes = 2998624 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

deploy/gateway/worker.jsView on unpkg

Findings

2 Critical4 High3 Medium6 Low

CriticalCritical Secretdeploy/plugin-feishu/worker.js

CriticalSecret Patterndeploy/plugin-feishu/worker.js

HighChild Processdist/bin.js

HighShell

HighRuntime Package Installdist/bin.js

HighOversized Source Filedeploy/gateway/worker.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

deploy/plugin-feishu/worker.jsView file

Lines 1511-1551javascript

1511 }

1512 return fromSPKI(formatPEM(encodeBase64(spki), "PUBLIC KEY"), alg, options);

1513 };

1514 }

1515});

1516

1517// node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/key/import.js

1518async function importSPKI(spki, alg, options) {

1519 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {

1520 throw new TypeError('"spki" must be SPKI formatted string');

1521 }

1522 return fromSPKI(spki, alg, options);

1523}

1524async function importX509(x509, alg, options) {

1525 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) {

1526 throw new TypeError('"x509" must be X.509 formatted string');

1527 }

1528 return fromX509(x509, alg, options);

1529}

1530async function importPKCS8(pkcs8, alg, options) {

1531 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

deploy/plugin-feishu/worker.jsView on unpkg · L1531

Critical

Secret Pattern

RSA private key in deploy/plugin-feishu/worker.js

deploy/plugin-feishu/worker.jsView on unpkg · L1531

1532 throw new TypeError('"pkcs8" must be PKCS#8 formatted string');

1533 }

1534 return fromPKCS8(pkcs8, alg, options);

1535}

1536async function importJWK(jwk, alg, options) {

1537 if (!isObject(jwk)) {

1538 throw new TypeError("JWK must be an object");

1539 }

1540 let ext;

1541 alg ??= jwk.alg;

1542 ext ??= options?.extractable ?? jwk.ext;

1543 switch (jwk.kty) {

1544 case "oct":

1545 if (typeof jwk.k !== "string" || !jwk.k) {

1546 throw new TypeError('missing "k" (Key Value) Parameter value');

1547 }

1548 return decode(jwk.k);

1549 case "RSA":

1550 if ("oth" in jwk && jwk.oth !== void 0) {

1551 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');

dist/bin.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { readFileSync, mkdirSync, writeFileSync, chmodSync, existsSync, cpSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve } from 'path';

5import { z } from 'zod';

6import { importJWK, SignJWT, generateKeyPair, exportJWK } from

deploy/gateway/worker.jsView file

•path = deploy/gateway/worker.js kind = oversized_source_file sizeBytes = 2998624 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

deploy/gateway/worker.jsView on unpkg

Lines 1866-1906javascript

1866 { key: "pluginFeishu", dir: "plugin-feishu" },

1867 { key: "gateway", dir: "gateway" }

1868];

1869function defaultSpawner() {

1870 return (bin, args, opts = {}) => {

1871 const res = spawnSync(bin, args, {

1872 env: process.env,

1873 cwd: opts.cwd,

1874 input: opts.input,

1875 encoding: "utf8",

1876 stdio: opts.input !== void 0 ? ["pipe", "pipe", "pipe"] : opts.inherit ? "inherit" : "pipe"

1877 });

1878 return {

1879 status: res.status ?? 1,

1880 stdout: res.stdout ?? "",

1881 stderr: res.stderr ?? ""

1882 };

1883 };

1884}

1885function provisionRunner(spawn) {

1886 return (args) => {

1887 const res = spawn("npx", ["--yes", "wrangler@4.107.0", ...args]);

1888 return { status: res.status, out: `${res.stdout}${res.stderr}` };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L1886

1889 };

1890}

1891function extractDeployUrl(stdout) {

1892 const m = stdout.match(/https?:\/\/[^\s'"]+/);

1893 return m ? m[0] : void 0;

1894}

1895async function runInit(cli, deps = {}) {

1896 const spawn = deps.spawn ?? defaultSpawner();

1897 const home = deps.home ?? homedir();

1898 const out = deps.out ?? ((l) => process.stdout.write(`${l}

1899`));

1900 p.intro("watt init \u2014 deploy Watt to your own Cloudflare account");

1901 let state;

1902 if (cli.resume) {

1903 const prefix = cli.prefix;

1904 if (!prefix) {

1905 throw new CliError("--resume requires --prefix <name> to locate the deployment archive", 2);

1906 }