registry / autotel-subscribers / 41.0.5

autotel-subscribers@41.0.5

Write Once, Observe Anywhere - Event subscribers for autotel (PostHog, Mixpanel, Amplitude, Segment)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.86 MB of source, external domains: api.eu.amplitude.com, api.segment.io, api2.amplitude.com, app.amplitude.com, app.eu.amplitude.com, apps.stag2.amplitude.com, cdn.amplitude.com, diagnostics.prod.eu-central-1.amplitude.com, diagnostics.prod.us-west-2.amplitude.com, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, i.imgur.com, oauth2.segment.io, posthog.com, sentry.io, sr-client-cfg.amplitude.com, sr-client-cfg.eu.amplitude.com, us-assets.i.posthog.com, us.i.posthog.com, yandex.com

Source & flagged code

5 flagged

dist/cjs-C2fugEI8.cjsView file

Lines 2659-2699javascript

2659var require_import = /* @__PURE__ */ require_rolldown_runtime.__commonJSMin(((exports) => {

2660 Object.defineProperty(exports, "__esModule", { value: true });

2661 exports.importSPKI = importSPKI;

2662 exports.importX509 = importX509;

2663 exports.importPKCS8 = importPKCS8;

2664 exports.importJWK = importJWK;

2665 const base64url_js_1 = require_base64url$1();

2666 const asn1_js_1 = require_asn1();

2667 const jwk_to_key_js_1 = require_jwk_to_key();

2668 const errors_js_1 = require_errors();

2669 const is_object_js_1 = require_is_object();

2670 async function importSPKI(spki, alg, options) {

2671 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) throw new TypeError("\"spki\" must be SPKI formatted string");

2672 return (0, asn1_js_1.fromSPKI)(spki, alg, options);

2673 }

2674 async function importX509(x509, alg, options) {

2675 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) throw new TypeError("\"x509\" must be X.509 formatted string");

2676 return (0, asn1_js_1.fromX509)(x509, alg, options);

2677 }

2678 async function importPKCS8(pkcs8, alg, options) {

2679 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) throw new TypeError("\"pkcs8\" must be PKCS#8 formatted string");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

Critical

Secret Pattern

RSA private key in dist/cjs-C2fugEI8.cjs

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

2680 return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);

2681 }

2682 async function importJWK(jwk, alg) {

2683 if (!(0, is_object_js_1.default)(jwk)) throw new TypeError("JWK must be an object");

2684 alg ||= jwk.alg;

2685 switch (jwk.kty) {

2686 case "oct":

2687 if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");

2688 return (0, base64url_js_1.decode)(jwk.k);

2689 case "RSA": if ("oth" in jwk && jwk.oth !== void 0) throw new errors_js_1.JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");

2690 case "EC":

2691 case "OKP": return (0, jwk_to_key_js_1.default)({

2692 ...jwk,

2693 alg

2694 });

2695 default: throw new errors_js_1.JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");

2696 }

2697 }

2698}));

2699

dist/posthog-C9M1c_oG.jsView file

Lines 95-135javascript

95 if (this.enabled) this.initPromise = this.initialize();

96 }

97 async initialize() {

98 try {

99 if (this.config.useGlobalClient) {

100 const globalWindow

dist/index.node-DOkEUdYV.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-subscribers@41.0.3 matchedIdentity = npm:YXV0b3RlbC1zdWJzY3JpYmVycw:41.0.3 similarity = 0.920 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.node-DOkEUdYV.cjsView on unpkg

dist/cjs-CY69zXGd.jsView file

Lines 2659-2699javascript

2659var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

2660 Object.defineProperty(exports, "__esModule", { value: true });

2661 exports.importSPKI = importSPKI;

2662 exports.importX509 = importX509;

Source & flagged code

5 flagged · loading source

dist/cjs-C2fugEI8.cjsView file

2679patternName = private_key_rsa severity = critical line = 2679 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

2679patternName = private_key_rsa severity = critical line = 2679 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/cjs-C2fugEI8.cjs

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

dist/posthog-C9M1c_oG.jsView file

115this.posthog = new PostHog(this.config.apiKey, { L116: host: this.config.host || "https://us.i.posthog.com", L117: flushAt: this.config.flushAt, ... L119: requestTimeout: this.config.requestTimeout, L120: disableGeoip: this.config.disableGeoip, L121: sendFeatureFlagEvent: this.config.sendFeatureFlags ... L200: if (payload.attributes?.["exception.list"]) try { L201: const formatted = formatExceptionForPostHog(JSON.parse(payload.attributes["exception.list"]), void 0, this.stringRedactor ?? void 0); L202: const exceptionProperties = {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/posthog-C9M1c_oG.jsView on unpkg · L115

dist/index.node-DOkEUdYV.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.node-DOkEUdYV.cjsView on unpkg

dist/cjs-CY69zXGd.jsView file

2679patternName = private_key_rsa severity = critical line = 2679 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/cjs-CY69zXGd.js

dist/cjs-CY69zXGd.jsView on unpkg · L2679

Findings

3 Critical2 High3 Medium5 Low

CriticalCritical Secretdist/cjs-C2fugEI8.cjs

CriticalSecret Patterndist/cjs-C2fugEI8.cjs

CriticalSecret Patterndist/cjs-CY69zXGd.js

HighSandbox Evasion Gated Capabilitydist/posthog-C9M1c_oG.js

HighPrevious Version Dangerous Deltadist/index.node-DOkEUdYV.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/cjs-C2fugEI8.cjsView file

Lines 2659-2699javascript

2659var require_import = /* @__PURE__ */ require_rolldown_runtime.__commonJSMin(((exports) => {

2660 Object.defineProperty(exports, "__esModule", { value: true });

2661 exports.importSPKI = importSPKI;

2662 exports.importX509 = importX509;

2663 exports.importPKCS8 = importPKCS8;

2664 exports.importJWK = importJWK;

2665 const base64url_js_1 = require_base64url$1();

2666 const asn1_js_1 = require_asn1();

2667 const jwk_to_key_js_1 = require_jwk_to_key();

2668 const errors_js_1 = require_errors();

2669 const is_object_js_1 = require_is_object();

2670 async function importSPKI(spki, alg, options) {

2671 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) throw new TypeError("\"spki\" must be SPKI formatted string");

2672 return (0, asn1_js_1.fromSPKI)(spki, alg, options);

2673 }

2674 async function importX509(x509, alg, options) {

2675 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) throw new TypeError("\"x509\" must be X.509 formatted string");

2676 return (0, asn1_js_1.fromX509)(x509, alg, options);

2677 }

2678 async function importPKCS8(pkcs8, alg, options) {

2679 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) throw new TypeError("\"pkcs8\" must be PKCS#8 formatted string");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

Critical

Secret Pattern

RSA private key in dist/cjs-C2fugEI8.cjs

dist/cjs-C2fugEI8.cjsView on unpkg · L2679

2680 return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);

2681 }

2682 async function importJWK(jwk, alg) {

2683 if (!(0, is_object_js_1.default)(jwk)) throw new TypeError("JWK must be an object");

2684 alg ||= jwk.alg;

2685 switch (jwk.kty) {

2686 case "oct":

2687 if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");

2688 return (0, base64url_js_1.decode)(jwk.k);

2689 case "RSA": if ("oth" in jwk && jwk.oth !== void 0) throw new errors_js_1.JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");

2690 case "EC":

2691 case "OKP": return (0, jwk_to_key_js_1.default)({

2692 ...jwk,

2693 alg

2694 });

2695 default: throw new errors_js_1.JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");

2696 }

2697 }

2698}));

2699

dist/posthog-C9M1c_oG.jsView file

Lines 95-135javascript

95 if (this.enabled) this.initPromise = this.initialize();

96 }

97 async initialize() {

98 try {

99 if (this.config.useGlobalClient) {

100 const globalWindow

dist/index.node-DOkEUdYV.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.node-DOkEUdYV.cjsView on unpkg

dist/cjs-CY69zXGd.jsView file

Lines 2659-2699javascript

2659var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

2660 Object.defineProperty(exports, "__esModule", { value: true });

2661 exports.importSPKI = importSPKI;

2662 exports.importX509 = importX509;