registry / autotel-subscribers / 41.0.3

autotel-subscribers@41.0.3

Write Once, Observe Anywhere - Event subscribers for autotel (PostHog, Mixpanel, Amplitude, Segment)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.82 MB of source, external domains: api.eu.amplitude.com, api.segment.io, api2.amplitude.com, app.amplitude.com, app.eu.amplitude.com, apps.stag2.amplitude.com, cdn.amplitude.com, diagnostics.prod.eu-central-1.amplitude.com, diagnostics.prod.us-west-2.amplitude.com, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, i.imgur.com, oauth2.segment.io, posthog.com, sentry.io, sr-client-cfg.amplitude.com, sr-client-cfg.eu.amplitude.com, us-assets.i.posthog.com, us.i.posthog.com, yandex.com

Source & flagged code

4 flagged

dist/cjs-j3aHAiuq.jsView file

Lines 2654-2694javascript

2654var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

2655 Object.defineProperty(exports, "__esModule", { value: true });

2656 exports.importSPKI = importSPKI;

2657 exports.importX509 = importX509;

2658 exports.importPKCS8 = importPKCS8;

2659 exports.importJWK = importJWK;

2660 const base64url_js_1 = require_base64url$1();

2661 const asn1_js_1 = require_asn1();

2662 const jwk_to_key_js_1 = require_jwk_to_key();

2663 const errors_js_1 = require_errors();

2664 const is_object_js_1 = require_is_object();

2665 async function importSPKI(spki, alg, options) {

2666 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) throw new TypeError("\"spki\" must be SPKI formatted string");

2667 return (0, asn1_js_1.fromSPKI)(spki, alg, options);

2668 }

2669 async function importX509(x509, alg, options) {

2670 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) throw new TypeError("\"x509\" must be X.509 formatted string");

2671 return (0, asn1_js_1.fromX509)(x509, alg, options);

2672 }

2673 async function importPKCS8(pkcs8, alg, options) {

2674 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) throw new TypeError("\"pkcs8\" must be PKCS#8 formatted string");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

Critical

Secret Pattern

RSA private key in dist/cjs-j3aHAiuq.js

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

2675 return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);

2676 }

2677 async function importJWK(jwk, alg) {

2678 if (!(0, is_object_js_1.default)(jwk)) throw new TypeError("JWK must be an object");

2679 alg ||= jwk.alg;

2680 switch (jwk.kty) {

2681 case "oct":

2682 if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");

2683 return (0, base64url_js_1.decode)(jwk.k);

2684 case "RSA": if ("oth" in jwk && jwk.oth !== void 0) throw new errors_js_1.JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");

2685 case "EC":

2686 case "OKP": return (0, jwk_to_key_js_1.default)({

2687 ...jwk,

2688 alg

2689 });

2690 default: throw new errors_js_1.JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");

2691 }

2692 }

2693}));

2694

dist/posthog-DTpCMk3r.jsView file

Lines 95-135javascript

95 if (this.enabled) this.initPromise = this.initialize();

96 }

97 async initialize() {

98 try {

99 if (this.config.useGlobalClient) {

100 const globalWindow

dist/cjs-CC1S3xV3.cjsView file

Lines 2654-2694javascript

2654var require_import = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

2655 Object.defineProperty(exports, "__esModule", { value: true });

2656 exports.importSPKI = importSPKI;

2657 exports.importX509 = importX509;

Source & flagged code

4 flagged · loading source

dist/cjs-j3aHAiuq.jsView file

2674patternName = private_key_rsa severity = critical line = 2674 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

2674patternName = private_key_rsa severity = critical line = 2674 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/cjs-j3aHAiuq.js

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

dist/posthog-DTpCMk3r.jsView file

115this.posthog = new PostHog(this.config.apiKey, { L116: host: this.config.host || "https://us.i.posthog.com", L117: flushAt: this.config.flushAt, ... L119: requestTimeout: this.config.requestTimeout, L120: disableGeoip: this.config.disableGeoip, L121: sendFeatureFlagEvent: this.config.sendFeatureFlags ... L200: if (payload.attributes?.["exception.list"]) try { L201: const formatted = formatExceptionForPostHog(JSON.parse(payload.attributes["exception.list"]), void 0, this.stringRedactor ?? void 0); L202: const exceptionProperties = {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/posthog-DTpCMk3r.jsView on unpkg · L115

dist/cjs-CC1S3xV3.cjsView file

2674patternName = private_key_rsa severity = critical line = 2674 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/cjs-CC1S3xV3.cjs

dist/cjs-CC1S3xV3.cjsView on unpkg · L2674

Findings

3 Critical1 High3 Medium5 Low

CriticalCritical Secretdist/cjs-j3aHAiuq.js

CriticalSecret Patterndist/cjs-j3aHAiuq.js

CriticalSecret Patterndist/cjs-CC1S3xV3.cjs

HighSandbox Evasion Gated Capabilitydist/posthog-DTpCMk3r.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/cjs-j3aHAiuq.jsView file

Lines 2654-2694javascript

2654var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

2655 Object.defineProperty(exports, "__esModule", { value: true });

2656 exports.importSPKI = importSPKI;

2657 exports.importX509 = importX509;

2658 exports.importPKCS8 = importPKCS8;

2659 exports.importJWK = importJWK;

2660 const base64url_js_1 = require_base64url$1();

2661 const asn1_js_1 = require_asn1();

2662 const jwk_to_key_js_1 = require_jwk_to_key();

2663 const errors_js_1 = require_errors();

2664 const is_object_js_1 = require_is_object();

2665 async function importSPKI(spki, alg, options) {

2666 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) throw new TypeError("\"spki\" must be SPKI formatted string");

2667 return (0, asn1_js_1.fromSPKI)(spki, alg, options);

2668 }

2669 async function importX509(x509, alg, options) {

2670 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) throw new TypeError("\"x509\" must be X.509 formatted string");

2671 return (0, asn1_js_1.fromX509)(x509, alg, options);

2672 }

2673 async function importPKCS8(pkcs8, alg, options) {

2674 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) throw new TypeError("\"pkcs8\" must be PKCS#8 formatted string");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

Critical

Secret Pattern

RSA private key in dist/cjs-j3aHAiuq.js

dist/cjs-j3aHAiuq.jsView on unpkg · L2674

2675 return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);

2676 }

2677 async function importJWK(jwk, alg) {

2678 if (!(0, is_object_js_1.default)(jwk)) throw new TypeError("JWK must be an object");

2679 alg ||= jwk.alg;

2680 switch (jwk.kty) {

2681 case "oct":

2682 if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");

2683 return (0, base64url_js_1.decode)(jwk.k);

2684 case "RSA": if ("oth" in jwk && jwk.oth !== void 0) throw new errors_js_1.JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");

2685 case "EC":

2686 case "OKP": return (0, jwk_to_key_js_1.default)({

2687 ...jwk,

2688 alg

2689 });

2690 default: throw new errors_js_1.JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");

2691 }

2692 }

2693}));

2694

dist/posthog-DTpCMk3r.jsView file

Lines 95-135javascript

95 if (this.enabled) this.initPromise = this.initialize();

96 }

97 async initialize() {

98 try {

99 if (this.config.useGlobalClient) {

100 const globalWindow

dist/cjs-CC1S3xV3.cjsView file

Lines 2654-2694javascript

2654var require_import = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

2655 Object.defineProperty(exports, "__esModule", { value: true });

2656 exports.importSPKI = importSPKI;

2657 exports.importX509 = importX509;