registry / @wasabis3/mcp-darwin-arm64 / 0.1.9

@wasabis3/mcp-darwin-arm64@0.1.9

Wasabi MCP runtime for macOS arm64

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 90 file(s), 820 KB of source, external domains: 10.0.0.1, 127.0.0.1, 169.254.169.254, 172.16.0.1, 192.168.0.1, air.test.wasabi.local, air.wasabisys.com, api.example.test, api.test.wasabi.local, api.wacm.wasabisys.com, claude.ai, claude.com, custom.s3.us-east-1.wasabisys.com, demo-bucket.s3.us-east-1.wasabisys.com, evil.example, evil.example.test, example.com, example.test, fallback.example.com, iam.wasabisys.com, issuer.test.wasabi.local, localhost.evil.example, mcp.example.com, mcp.test.wasabi.local, mcp.wasabisys.dev, radix-ui.com, react.dev, s3.amazonaws.com, s3.eu-west-1.wasabisys.com, s3.us-east-1.wasabisys.com, s3.wasabisys.com, sts.wasabisys.com, wasabi.com, web.example.test, web.test, web.test.wasabi.local, wrong.test.wasabi.local, www.cursor.com, www.w3.org

Source & flagged code

11 flagged

runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.jsView file

Lines 33-54javascript

33 }

35 .`).concat(Li," .").concat(Li,` {

36 right: 0 `).concat(c,`;

37 }

39 .`).concat(qi," .").concat(qi,` {

40 margin-right: 0 `).concat(c,`;

41 }

43 body[`).concat(fn,`] {

44 `).concat(Vb,": ").concat(p,`px;

45 }

46`)},yv=function(){var u=parseInt(document.body.getAttribute(fn)||"0",10);return isFinite(u)?u:0},r1=function(){S.useEffect(function(){return document.body.setAttribute(fn,(yv()+1).toString()),function(){var u=yv()-1;u<=0?document.body.removeAttribute(fn):document.body.setAttribute(fn,u.toString())}},[])},s1=function(u){var o=u.noRelative,s=u.noImportant,c=u.gapMode,d=c===void 0?"margin":c;r1();var m=S.useMemo(function(){return i1(d)},[d]);return S.createElement(c1,{styles:o1(m,!o,d,s?"":"!important")})},jr=!1;if(typeof window<"u")try{var wi=Object.defineProperty({},"passive",{get:function(){re ...

47 .block-interactivity-`.concat(u,` {pointer-events: none;}

48 .allow-interactivity-`).concat(u,` {pointer-events: all;}

49`)},x1=0,cn=[];function S1(u){var o=S.useRef([]),s=S.useRef([0,0]),c=S.useRef(),d=S.useState(x1++)[0],m=S.useState(fh)[0],x=S

51If you want to hide the \`${o.titleName}\`, you can wrap it with our VisuallyHidden component.

53For more information, see https://radix-ui.com/primitives/docs/components/${o.docsSlug}`;return S.useEffect(()=>{u&&(document.getElementById(u)||console.error(s))},[s,u]),null},U1="DialogDescriptionWarning",H1=({contentRef:u,descriptionId:o})=>{const c=`Warning: Missing \`Description\` or \`

Long lines were clipped for display.

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

Lines 62-102javascript

62 for (const definition of airOperationDefinitions) {

63 expect(definition.outputSchema.parse({ LiveEnvelope: { operation: definition.operation } })).toEqual({

64 LiveEnvelope: { operation: definition.operation }

65 });

66 }

67 });

68 it(

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

Lines 63-111javascript

63 addWacmCredential: vi.fn()

64 };

65 const wasabiConsoleClient = {

66 login: vi.fn().mockResolvedValue({

67 accessKeyId: "AKIAEXAMPLE",

68 secretAccessKey: "secret-value",

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

Lines 12-67javascript

12 });

13 it("uses the public CreateTemporaryAccessCredentials flow and parses expiry", async () => {

14 const fetchMock = vi.fn().mockResolvedValue(new Response(`<?xml version="1.0" encoding="UTF-8"?>

15 <CreateTemporaryAccessCredentialsResponse>

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

Lines 49-86javascript

49 await runOperation({ baseUrl: "https://api.wacm.wasabisys.com/api", username: "demo-account", apiKey: "demo-key" }, {

50 operation: "getSubAccountById",

51 params: { subAccountId: 42, subAccount: "kept" }

52 });

53 const [url] = fetchMock.mock.calls[

Source & flagged code

11 flagged · loading source

runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.jsView file

53patternName = aws_access_key severity = critical line = 53 matchedText = For more...}));

Critical

Critical Secret

Package contains a critical-looking secret pattern.

runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.jsView on unpkg · L53

53patternName = aws_access_key severity = critical line = 53 matchedText = For more...}));

Critical

Secret Pattern

AWS access key ID in runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.js

runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.jsView on unpkg · L53

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

82patternName = generic_password severity = medium line = 82 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/model/mcp-operation.registry.test.js

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView on unpkg · L82

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

83patternName = generic_password severity = medium line = 83 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/service/wasabi-auth.service.test.js

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView on unpkg · L83

91patternName = generic_password severity = medium line = 91 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/service/wasabi-auth.service.test.js

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView on unpkg · L91

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-console.client.test.js

runtime/apps/api/dist/client/wasabi-console.client.test.jsView on unpkg · L32

62patternName = generic_password severity = medium line = 62 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-console.client.test.js

runtime/apps/api/dist/client/wasabi-console.client.test.jsView on unpkg · L62

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

69patternName = generic_password severity = medium line = 69 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-wacm.client.test.js

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView on unpkg · L69

81patternName = generic_password severity = medium line = 81 matchedText = password...3!",

Medium

Secret Pattern

Hardcoded password in runtime/apps/api/dist/client/wasabi-wacm.client.test.js

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView on unpkg · L81

Findings

2 Critical1 High11 Medium4 Low

CriticalCritical Secretruntime/apps/api/dist/webdist/assets/index-BgVQ9ph_.js

CriticalSecret Patternruntime/apps/api/dist/webdist/assets/index-BgVQ9ph_.js

HighShips High Entropy Blobruntime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryruntime/bin/node

MediumStructural Risk Force Deep Review

MediumSecret Patternruntime/apps/api/dist/model/mcp-operation.registry.test.js

MediumSecret Patternruntime/apps/api/dist/service/wasabi-auth.service.test.js

MediumSecret Patternruntime/apps/api/dist/client/wasabi-console.client.test.js

MediumSecret Patternruntime/apps/api/dist/client/wasabi-wacm.client.test.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

11 flagged

runtime/apps/api/dist/webdist/assets/index-BgVQ9ph_.jsView file

Lines 33-54javascript

33 }

35 .`).concat(Li," .").concat(Li,` {

36 right: 0 `).concat(c,`;

37 }

39 .`).concat(qi," .").concat(qi,` {

40 margin-right: 0 `).concat(c,`;

41 }

43 body[`).concat(fn,`] {

44 `).concat(Vb,": ").concat(p,`px;

45 }

47 .block-interactivity-`.concat(u,` {pointer-events: none;}

48 .allow-interactivity-`).concat(u,` {pointer-events: all;}

49`)},x1=0,cn=[];function S1(u){var o=S.useRef([]),s=S.useRef([0,0]),c=S.useRef(),d=S.useState(x1++)[0],m=S.useState(fh)[0],x=S

51If you want to hide the \`${o.titleName}\`, you can wrap it with our VisuallyHidden component.

Long lines were clipped for display.

runtime/bin/nodeView file

•path = runtime/bin/node kind = native_binary sizeBytes = 112928848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/bin/nodeView on unpkg

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = [redacted]-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/apps/api/dist/webdist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runtime/apps/api/dist/model/mcp-operation.registry.test.jsView file

Lines 62-102javascript

62 for (const definition of airOperationDefinitions) {

63 expect(definition.outputSchema.parse({ LiveEnvelope: { operation: definition.operation } })).toEqual({

64 LiveEnvelope: { operation: definition.operation }

65 });

66 }

67 });

68 it(

runtime/apps/api/dist/service/wasabi-auth.service.test.jsView file

Lines 63-111javascript

63 addWacmCredential: vi.fn()

64 };

65 const wasabiConsoleClient = {

66 login: vi.fn().mockResolvedValue({

67 accessKeyId: "AKIAEXAMPLE",

68 secretAccessKey: "secret-value",

runtime/apps/api/dist/client/wasabi-console.client.test.jsView file

Lines 12-67javascript

12 });

13 it("uses the public CreateTemporaryAccessCredentials flow and parses expiry", async () => {

14 const fetchMock = vi.fn().mockResolvedValue(new Response(`<?xml version="1.0" encoding="UTF-8"?>

15 <CreateTemporaryAccessCredentialsResponse>

runtime/apps/api/dist/client/wasabi-wacm.client.test.jsView file

Lines 49-86javascript

49 await runOperation({ baseUrl: "https://api.wacm.wasabisys.com/api", username: "demo-account", apiKey: "demo-key" }, {

50 operation: "getSubAccountById",

51 params: { subAccountId: 42, subAccount: "kept" }

52 });

53 const [url] = fetchMock.mock.calls[