@wireio/cluster-tool@0.1.16: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@wireio/cluster-tool@0.1.16: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

3 flagged · loading source

lib/cjs/tools/solana/SolanaFundingTool.jsView file

21* `SystemProgram.createAccount` + `[redacted]` (not L22: * `@solana/spl-token`'s `createMint`, which relies on a WebSocket subscription L23: * for confirmation the test validator doesn't reliably serve) and confirmed via ... L50: log.info(`[SolanaFundingTool] generated mint pubkey=${mintKeypair.publicKey.toBase58()}`); L51: const rentLamports = await connection.[redacted](spl_token_1.MINT_SIZE); L52: const transaction = new web3_js_1.Transaction().add(web3_js_1.SystemProgram.createAccount({ ... L143: node_assert_1.default.ok(node_fs_1.default.existsSync(mintsFile), `SolanaFundingTool: mock SPL mints not found at ${mintsFile}`); L144: const mints = JSON.parse(node_fs_1.default.readFileSync(mintsFile, "utf8")); L145: const found = mints.find(entry => BigInt(entry.code) === tokenCode); .

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

lib/cjs/tools/solana/SolanaFundingTool.jsView on unpkg · L21

21Trigger-reachable chain: manifest.main -> lib/cjs/index.js -> lib/cjs/tools/solana/index.js -> [redacted].js L21: * `SystemProgram.createAccount` + `[redacted]` (not L22: * `@solana/spl-token`'s `createMint`, which relies on a WebSocket subscription L23: * for confirmation the test validator doesn't reliably serve) and confirmed via ... L50: log.info(`[SolanaFundingTool] generated mint pubkey=${mintKeypair.publicKey.toBase58()}`); L51: const rentLamports = await connection.[redacted](spl_token_1.MINT_SIZE); L52: const transaction = new web3_js_1.Transaction().add(web3_js_1.SystemProgram.createAccount({ ... L143: node_assert_1.default.ok(node_fs_1.default.existsSync(mintsFile), `SolanaFundingTool: mock SPL mints not found at ${mintsFile}`); L144: const mints = JSON.parse(node_fs_1.default.r

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/cjs/tools/solana/SolanaFundingTool.jsView on unpkg · L21

lib/test-cjs/clients/wire/WireWallet.test.jsView file

37patternName = generic_password severity = medium line = 37 matchedText = ` creat...;;`,

Medium

Secret Pattern

Hardcoded password in lib/test-cjs/clients/wire/WireWallet.test.js

lib/test-cjs/clients/wire/WireWallet.test.jsView on unpkg · L37

Source & flagged code

3 flagged

lib/cjs/tools/solana/SolanaFundingTool.jsView file

Lines 1-41javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.SolanaFundingTool = void 0;

7const node_assert_1 = __importDefault(require("node:assert"));

8const node_fs_1 = __importDefault(require("node:fs"));

9const node_path_1 = __importDefault(require("node:path"));

10const web3_js_1 = require("@solana/web3.js");

11const spl_token_1 = require("@solana/spl-token");

12const SolanaClient_js_1 = require("../../clients/solana/SolanaClient.js");

13const signatureUtils_js_1 = require("../../clients/solana/utils/signatureUtils.js");

14const ClusterBuildStep_js_1 = require("../../orchestration/ClusterBuildStep.js");

15const keyPairUtils_js_1 = require("../../utils/keyPairUtils.js");

16const Logger_js_1 = require("../../logging/Logger.js");

17const log = (0, Logger_js_1.getLogger)(__filename);

18/**

19 * Test-cluster helpers for creating mock SPL mints and funding wallets with

20 * token balances on the local Solana validator. Mints are created with manual

21 * `SystemProgram.createAccount` + `createInitializeMint2Instruction` (not

22 * `@solana/spl-token`'s `createMint`, which relies on a WebSocket subscription

23 * for confirmation the test validator doesn't reliably serve) and confirmed via

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

lib/cjs/tools/solana/SolanaFundingTool.jsView on unpkg · L21

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/cjs/tools/solana/SolanaFundingTool.jsView on unpkg · L21

24 * the polling {@link confirmSignature}.

25 *

26 * Recipient ATAs for swap *destinations* are NOT pre-created — the on-chain

27 * `handle_swap_remit` SPL branch creates them on demand with the Reserve PDA as

28 * rent payer.

29 */

30var SolanaFundingTool;

31(function (SolanaFundingTool) {

32 /** Minimum SPL mint decimal scale. */

33 SolanaFundingTool.MinDecimals = 0;

34 /** Maximum SPL mint decimal scale. */

35 SolanaFundingTool.MaxDecimals = 18;

36 /**

37 * Create a new SPL mint with `mintAuthority = funder.publicKey` and no freeze

38 * authority (the mock USDC / USDT / LIQSOL mints `SolanaOutpostBootstrapper`

39 * provisions).

40 *

41 * @param connection - RPC connection to the test validator.

lib/test-cjs/clients/wire/WireWallet.test.jsView file

Lines 17-57javascript

17 });

18 beforeEach(() => {

19 dir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "wirewallet-"));

20 });

21 afterEach(()