registry / @virtru/dsp-sdk / 0.7.8

@virtru/dsp-sdk@0.7.8

The DSP Web SDK enables integration with the Virtru Data Security Platform (DSP). It provides tools for encrypting and decrypting TDF (Trusted Data Format) content, as well as managing Attribute-Based Access Control (ABAC) operations.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequire

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 29 file(s), 236 KB of source, external domains: only-required-for-back-compat.invalid, www.w3.org

Source & flagged code

6 flagged

dist/src/lib/fips-crypto/key-format.d.tsView file

Lines 1-52typescript

1import { type KeyOptions, type PrivateKey, type PublicKey, type PublicKeyInfo } from '@opentdf/sdk/singlecontainer';

2/**

3 * Import a PEM public key (SPKI) as an opaque PublicKey.

4 * Only RSA keys are supported in FIPS mode.

5 *

6 * @param pem - PEM-encoded public key (`-----BEGIN PUBLIC KEY-----`)

7 * @param options.usage - `'encrypt'` (RSA-OAEP) or `'sign'` (RS256 verify). Defaults to `'encrypt'`.

8 * @param options.extractable - Defaults to `true`.

9 * @param options.algorithmHint - Skips SPKI parsing when provided.

10 */

11export declare function importPublicKey(pem: string, options: KeyOptions): Promise<PublicKey>;

12/**

13 * Import a PEM private key (PKCS#8) as an opaque PrivateKey.

14 * Only RSA keys are supported in FIPS mode.

15 *

16 * @param pem - PEM-encoded private key (`-----BEGIN PRIVATE KEY-----`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

17 * @param options.usage - `'encrypt'` (RSA-OAEP decrypt) or `'sign'` (RS256). Defaults to `'encrypt'`.

18 * @param options.extractable - Defaults to `false`.

19 * @param options.algorithmHint - Algorithm label to attach. Defaults to `'rsa:2048'`.

20 */

21export declare function importPrivateKey(pem: string, options: KeyOptions): Promise<PrivateKey>;

22/**

23 * Export an opaque public key to PEM (SPKI / `-----BEGIN PUBLIC KEY-----`).

24 * Handles VirtruCrypto's PKCS#1 output for generated keys transparently.

25 */

26export declare function exportPublicKeyPem(key: PublicKey): Promise<string>;

27/**

28 * Export an opaque public key to JWK.

29 * Uses WebCrypto for the JWK conversion after normalizing to SPKI.

30 */

31export declare function exportPublicKeyJwk(key: PublicKey): Promise<JsonWebKey>;

32/**

33 * Export an opaque private key to PEM (PKCS#8 / `-----BEGIN PRIVATE KEY-----`).

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L33

34 *

35 * FOR TESTING / DEVELOPMENT ONLY — not included in the CryptoService interface.

36 * Only works for keys that were imported via importPrivateKey (PKCS#8 format).

37 * Generated private keys cannot be exported from the FIPS keystore.

38 */

39export declare function exportPrivateKeyPem(key: PrivateKey): Promise<string>;

40/**

41 * Use the WebCrypto API to parse a PEM public key and extract its algorithm info.

42 */

43export declare function parsePublicKeyPem(pem: string): Promise<PublicKeyInfo>;

44/**

45 * Use the WebCrypto API to extract the public key PEM from a certificate or PEM string.

46 */

47export declare function extractPublicKeyPem(certOrPem: string): Promise<string>;

48/**

49 * Use the WebCrypto API to convert a JWK public key to PEM format.

50 */

51export declare function jwkToPublicKeyPem(jwk: JsonWebKey): Promise<string>;

dist/src/lib/fips-crypto/primitives.jsView file

Lines 53-93javascript

53 window.removeEventListener('wasmReady', onReady);

54 clearTimeout(timeout);

55 resolve();

56 }

57 });

58 await virtruCryptoInitPromise;

59 virtruCryptoInstance = window.VirtruFipsWasmLib;

60 if (!

dist/src/lib/fips-crypto/key-format.jsView file

Lines 143-223javascript

143 algorithm = algorithmHint;

144 }

145 else {

146 const modulusBits = rsaModulusBitsFromSpki(keyBytes);

147 algorithm = modulusBits <= 2048 ? 'rsa:2048' : 'rsa:4096'

Source & flagged code

6 flagged · loading source

dist/src/lib/fips-crypto/key-format.d.tsView file

16patternName = private_key_rsa severity = critical line = 16 matchedText = * @param...--`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

16patternName = private_key_rsa severity = critical line = 16 matchedText = * @param...--`)

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

33patternName = private_key_rsa severity = critical line = 33 matchedText = * Export...-`).

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L33

dist/src/lib/fips-crypto/primitives.jsView file

73const modulePath = ['@virtru-private', 'fips-crypto-js'].join('/'); L74: void import(/* @vite-ignore */ modulePath).catch((err) => { L75: console.error('Virtru FIPS crypto initialization failed: @virtru-private/fips-crypto-js is not installed.', err);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/lib/fips-crypto/primitives.jsView on unpkg · L73

dist/src/lib/fips-crypto/key-format.jsView file

163patternName = private_key_rsa severity = critical line = 163 matchedText = * @param...--`)

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.js

dist/src/lib/fips-crypto/key-format.jsView on unpkg · L163

203patternName = private_key_rsa severity = critical line = 203 matchedText = * Export...-`).

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.js

dist/src/lib/fips-crypto/key-format.jsView on unpkg · L203

Findings

5 Critical1 Medium4 Low

CriticalCritical Secretdist/src/lib/fips-crypto/key-format.d.ts

CriticalSecret Patterndist/src/lib/fips-crypto/key-format.d.ts

CriticalSecret Patterndist/src/lib/fips-crypto/key-format.js

MediumDynamic Requiredist/src/lib/fips-crypto/primitives.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/src/lib/fips-crypto/key-format.d.tsView file

Lines 1-52typescript

1import { type KeyOptions, type PrivateKey, type PublicKey, type PublicKeyInfo } from '@opentdf/sdk/singlecontainer';

2/**

3 * Import a PEM public key (SPKI) as an opaque PublicKey.

4 * Only RSA keys are supported in FIPS mode.

5 *

6 * @param pem - PEM-encoded public key (`-----BEGIN PUBLIC KEY-----`)

7 * @param options.usage - `'encrypt'` (RSA-OAEP) or `'sign'` (RS256 verify). Defaults to `'encrypt'`.

8 * @param options.extractable - Defaults to `true`.

9 * @param options.algorithmHint - Skips SPKI parsing when provided.

10 */

11export declare function importPublicKey(pem: string, options: KeyOptions): Promise<PublicKey>;

12/**

13 * Import a PEM private key (PKCS#8) as an opaque PrivateKey.

14 * Only RSA keys are supported in FIPS mode.

15 *

16 * @param pem - PEM-encoded private key (`-----BEGIN PRIVATE KEY-----`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L16

17 * @param options.usage - `'encrypt'` (RSA-OAEP decrypt) or `'sign'` (RS256). Defaults to `'encrypt'`.

18 * @param options.extractable - Defaults to `false`.

19 * @param options.algorithmHint - Algorithm label to attach. Defaults to `'rsa:2048'`.

20 */

21export declare function importPrivateKey(pem: string, options: KeyOptions): Promise<PrivateKey>;

22/**

23 * Export an opaque public key to PEM (SPKI / `-----BEGIN PUBLIC KEY-----`).

24 * Handles VirtruCrypto's PKCS#1 output for generated keys transparently.

25 */

26export declare function exportPublicKeyPem(key: PublicKey): Promise<string>;

27/**

28 * Export an opaque public key to JWK.

29 * Uses WebCrypto for the JWK conversion after normalizing to SPKI.

30 */

31export declare function exportPublicKeyJwk(key: PublicKey): Promise<JsonWebKey>;

32/**

33 * Export an opaque private key to PEM (PKCS#8 / `-----BEGIN PRIVATE KEY-----`).

Critical

Secret Pattern

RSA private key in dist/src/lib/fips-crypto/key-format.d.ts

dist/src/lib/fips-crypto/key-format.d.tsView on unpkg · L33

34 *

35 * FOR TESTING / DEVELOPMENT ONLY — not included in the CryptoService interface.

36 * Only works for keys that were imported via importPrivateKey (PKCS#8 format).

37 * Generated private keys cannot be exported from the FIPS keystore.

38 */

39export declare function exportPrivateKeyPem(key: PrivateKey): Promise<string>;

40/**

41 * Use the WebCrypto API to parse a PEM public key and extract its algorithm info.

42 */

43export declare function parsePublicKeyPem(pem: string): Promise<PublicKeyInfo>;

44/**

45 * Use the WebCrypto API to extract the public key PEM from a certificate or PEM string.

46 */

47export declare function extractPublicKeyPem(certOrPem: string): Promise<string>;

48/**

49 * Use the WebCrypto API to convert a JWK public key to PEM format.

50 */

51export declare function jwkToPublicKeyPem(jwk: JsonWebKey): Promise<string>;

dist/src/lib/fips-crypto/primitives.jsView file

Lines 53-93javascript

53 window.removeEventListener('wasmReady', onReady);

54 clearTimeout(timeout);

55 resolve();

56 }

57 });

58 await virtruCryptoInitPromise;

59 virtruCryptoInstance = window.VirtruFipsWasmLib;

60 if (!

dist/src/lib/fips-crypto/key-format.jsView file

Lines 143-223javascript

143 algorithm = algorithmHint;

144 }

145 else {

146 const modulusBits = rsaModulusBitsFromSpki(keyBytes);

147 algorithm = modulusBits <= 2048 ? 'rsa:2048' : 'rsa:4096'