registry / @wasabis3/mcp-darwin-arm64 / 0.1.10

@wasabis3/mcp-darwin-arm64@0.1.10

Wasabi MCP runtime for macOS arm64

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 106 file(s), 938 KB of source, external domains: 10.0.0.1, 127.0.0.1, 169.254.169.254, 172.16.0.1, 192.168.0.1, air.test.wasabi.local, air.wasabisys.com, api.example.test, api.test.wasabi.local, api.wacm.wasabisys.com, claude.ai, claude.com, custom.s3.us-east-1.wasabisys.com, demo-bucket.s3.us-east-1.wasabisys.com, evil.example, evil.example.test, example.com, example.test, fallback.example.com, iam.wasabisys.com, issuer.test.wasabi.local, localhost.evil.example, mcp.example.com, mcp.test.wasabi.local, mcp.wasabisys.dev, radix-ui.com, react.dev, s3.amazonaws.com, s3.eu-west-1.wasabisys.com, s3.us-east-1.wasabisys.com, s3.wasabisys.com, stats.wasabisys.com, sts.wasabisys.com, wasabi.com, web.example.test, web.test, web.test.wasabi.local, wrong.test.wasabi.local, www.cursor.com, www.w3.org

Source & flagged code

12 flagged

runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.jsView file

Lines 33-53javascript

33 }

35 .${ir} .${ir} {

36 right: 0 ${r};

37 }

39 .${ar} .${ar} {

40 margin-right: 0 ${r};

41 }

43 body[${Pr}] {

44 ${sr}: ${s}px;

45 }

46`},Ir=function(){var e=parseInt(document.body.getAttribute(`data-scroll-locked`)||`0`,10);return isFinite(e)?e:0},Lr=function(){C.useEffect(function(){return document.body.setAttribute(Pr,(Ir()+1).toString()),function(){var e=Ir()-1;e<=0?document.body.removeAttribute(Pr):document.body.setAttribute(Pr,e.toString())}},[])},Rr=function(e){var t=e.noRelative,n=e.noImportant,r=e.gapMode,i=r===void 0?`margin`:r;Lr();var a=C.useMemo(function(){return Mr(i)},[i]);return C.createElement(Nr,{styles:Fr(a,!t,i,n?``:`!important`)})},zr=!1;if(typeof window<`u`)try{var Br=Object.defineProperty({},"passive",{ ...

47 .block-interactivity-${e} {pointer-events: none;}

48 .allow-interactivity-${e} {pointer-events: all;}

49`},ii=0,ai=[];function oi(e){var t=C.useRef([]),n=C.useRef([0,0]),r=C.useRef(),i=C.useState(ii++)[0],a=C.useState(Or)[0],o=C

51If you want to hide the \`${t.titleName}\`, you can wrap it with our VisuallyHidden component.

53For more information, see https://radix-ui.com/primitives/docs/components/${t.docsSlug}`;return C.useEffect(()=>{e&&(document.getElementById(e)||console.error(n))},[n,e]),null},Yi=`DialogDescriptionWarning`,Xi=({contentRef:e,descriptionId:t})=>{let n=`Warning: Missing \`Description\` or \`aria-describedby={undefined}

Long lines were clipped for display.

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/client/wasabi-console.client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wasabis3/mcp-darwin-arm64@0.1.9 matchedIdentity = npm:[redacted]:0.1.9 similarity = 0.576 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/apps/api/dist/client/wasabi-console.client.jsView on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

Lines 64-104javascript

64 for (const definition of airOperationDefinitions) {

65 expect(definition.outputSchema.parse({ LiveEnvelope: { operation: definition.operation } })).toEqual({

66 LiveEnvelope: { operation: definition.operation }

67 });

68 }

69 });

70 it(

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

Lines 63-111javascript

63 addWacmCredential: vi.fn()

64 };

65 const wasabiConsoleClient = {

66 login: vi.fn().mockResolvedValue({

67 accessKeyId: "AKIAEXAMPLE",

68 secretAccessKey: "secret-value",

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

Lines 13-69javascript

13 });

14 it("uses the public CreateTemporaryAccessCredentials flow and parses expiry", async () => {

15 const fetchMock = vi.fn().mockResolvedValue(new Response(`<?xml version="1.0" encoding="UTF-8"?>

16 <CreateTemporaryAccessCredentialsResponse>

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

Lines 51-88javascript

51 await runOperation({ baseUrl: "https://api.wacm.wasabisys.com/api", username: "demo-account", apiKey: "demo-key" }, {

52 operation: "getSubAccountById",

53 params: { subAccountId: 42, subAccount: "kept" }

54 });

55 const [url] = fetchMock.mock.calls[

Source & flagged code

12 flagged · loading source

runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.jsView file

53patternName = aws_access_key severity = critical line = 53 matchedText = For more...}));

Critical

Critical Secret

Package contains a critical-looking secret pattern.

runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.jsView on unpkg · L53

53patternName = aws_access_key severity = critical line = 53 matchedText = For more...}));

Critical

Secret Pattern

AWS access key ID in runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.js

runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.jsView on unpkg · L53

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/client/wasabi-console.client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/apps/api/dist/client/wasabi-console.client.jsView on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

84patternName = generic_password severity = medium line = 84 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/model/mcp-operation.registry.test.js

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView on unpkg · L84

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

83patternName = generic_password severity = medium line = 83 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/service/wasabi-auth.service.test.js

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView on unpkg · L83

91patternName = generic_password severity = medium line = 91 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/service/wasabi-auth.service.test.js

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView on unpkg · L91

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

33patternName = generic_password severity = medium line = 33 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-console.client.test.js

runtime/apps/api/dist/client/wasabi-console.client.test.jsView on unpkg · L33

64patternName = generic_password severity = medium line = 64 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-console.client.test.js

runtime/apps/api/dist/client/wasabi-console.client.test.jsView on unpkg · L64

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

71patternName = generic_password severity = medium line = 71 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-wacm.client.test.js

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView on unpkg · L71

83patternName = generic_password severity = medium line = 83 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-wacm.client.test.js

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView on unpkg · L83

Findings

2 Critical2 High11 Medium4 Low

CriticalCritical Secretruntime/apps/api/dist/webdist/assets/index-CHZqNQIA.js

CriticalSecret Patternruntime/apps/api/dist/webdist/assets/index-CHZqNQIA.js

HighShips High Entropy Blobruntime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

HighPrevious Version Dangerous Deltaruntime/apps/api/dist/client/wasabi-console.client.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryruntime/bin/node

MediumStructural Risk Force Deep Review

MediumSecret Patternruntime/apps/api/dist/model/mcp-operation.registry.test.js

MediumSecret Patternruntime/apps/api/dist/service/wasabi-auth.service.test.js

MediumSecret Patternruntime/apps/api/dist/client/wasabi-console.client.test.js

MediumSecret Patternruntime/apps/api/dist/client/wasabi-wacm.client.test.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

runtime/apps/api/dist/webdist/assets/index-CHZqNQIA.jsView file

Lines 33-53javascript

33 }

35 .${ir} .${ir} {

36 right: 0 ${r};

37 }

39 .${ar} .${ar} {

40 margin-right: 0 ${r};

41 }

43 body[${Pr}] {

44 ${sr}: ${s}px;

45 }

47 .block-interactivity-${e} {pointer-events: none;}

48 .allow-interactivity-${e} {pointer-events: all;}

49`},ii=0,ai=[];function oi(e){var t=C.useRef([]),n=C.useRef([0,0]),r=C.useRef(),i=C.useState(ii++)[0],a=C.useState(Or)[0],o=C

51If you want to hide the \`${t.titleName}\`, you can wrap it with our VisuallyHidden component.

Long lines were clipped for display.

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/client/wasabi-console.client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/apps/api/dist/client/wasabi-console.client.jsView on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

Lines 64-104javascript

64 for (const definition of airOperationDefinitions) {

65 expect(definition.outputSchema.parse({ LiveEnvelope: { operation: definition.operation } })).toEqual({

66 LiveEnvelope: { operation: definition.operation }

67 });

68 }

69 });

70 it(

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

Lines 63-111javascript

63 addWacmCredential: vi.fn()

64 };

65 const wasabiConsoleClient = {

66 login: vi.fn().mockResolvedValue({

67 accessKeyId: "AKIAEXAMPLE",

68 secretAccessKey: "secret-value",

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

Lines 13-69javascript

13 });

14 it("uses the public CreateTemporaryAccessCredentials flow and parses expiry", async () => {

15 const fetchMock = vi.fn().mockResolvedValue(new Response(`<?xml version="1.0" encoding="UTF-8"?>

16 <CreateTemporaryAccessCredentialsResponse>

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

Lines 51-88javascript

51 await runOperation({ baseUrl: "https://api.wacm.wasabisys.com/api", username: "demo-account", apiKey: "demo-key" }, {

52 operation: "getSubAccountById",

53 params: { subAccountId: 42, subAccount: "kept" }

54 });

55 const [url] = fetchMock.mock.calls[