registry / bybit-api / 4.7.0

bybit-api@4.7.0

Complete & robust Node.js SDK for Bybit's REST APIs and WebSockets, with TypeScript & strong end to end tests.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 94 file(s), 278 KB of source, external domains: api-demo.bybit.com, api-testnet.bybit.com, api.bybit-tr.com, api.bybit.ae, api.bybit.com, api.bybit.eu, api.bybit.kz, api.bybit.nl, api.bybitgeorgia.ge, api.byhkbit.com, api.bytick.com, github.com

Source & flagged code

4 flagged

lib/util/webCryptoAPI.jsView file

Lines 9-66javascript

9 });

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.getSignKeyType = getSignKeyType;

13exports.hashMessage = hashMessage;

14exports.signMessage = signMessage;

15exports.signBinaryData = signBinaryData;

16exports.checkWebCryptoAPISupported = checkWebCryptoAPISupported;

17const typeGuards_1 = require("./typeGuards");

18function bufferToB64(buffer) {

19 let binary = '';

20 const bytes = new Uint8Array(buffer);

21 const len = bytes.byteLength;

22 for (let i = 0; i < len; i++) {

23 binary += String.fromCharCode(bytes[i]);

24 }

25 return globalThis.btoa(binary);

26}

27/**

28 * Determine the key type based on the secret format

29 * RSA keys contain "-----BEGIN PRIVATE KEY-----" or "-----BEGIN RSA PRIVATE KEY-----"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/util/webCryptoAPI.jsView on unpkg · L29

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L29

30 * HMAC keys are plain strings

31 */

32function getSignKeyType(secret) {

33 if (secret === null || secret === void 0 ? void 0 : secret.includes('PRIVATE KEY')) {

34 return 'RSASSA-PKCS1-v1_5';

35 }

36 return 'HMAC';

37}

38/**

39 * Import a key for signing based on its type

40 */

41function importKey(secret, type, algorithm, encoder) {

42 return __awaiter(this, void 0, void 0, function* () {

43 switch (type) {

44 case 'RSASSA-PKCS1-v1_5': {

45 // Remove PEM headers/footers and whitespace to get base64 content

46 const base64Key = secret.replace(/(?:-----BEGIN RSA PRIVATE KEY-----|-----BEGIN PRIVATE KEY-----|-----END RSA PRIVATE KEY-----|-----END PRIVATE KEY-----|\s+)/g, '');

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L46

47 const binaryKey = Uint8Array.from(atob(base64Key), (c) => c.charCodeAt(0));

48 return crypto.subtle.importKey('pkcs8', binaryKey.buffer, { name: type, hash: { name: algorithm } }, false, ['sign']);

49 }

50 case 'HMAC': {

51 return globalThis.crypto.subtle.importKey('raw', encoder.encode(secret), { name: type, hash: algorithm }, false, ['sign']);

52 }

53 default: {

54 throw (0, typeGuards_1.neverGuard)(type, `Unhandled key type: "${type}"`);

55 }

56 }

57 });

58}

59/**

60 * Similar to node crypto's `createHash()` function

61 */

62function hashMessage(message, method, algorithm) {

63 return __awaiter(this, void 0, void 0, function* () {

64 const encoder = new TextEncoder();

65 const buffer = yield globalThis.crypto.subtle.digest(algorithm, encoder.encode(message));

66 switch (method) {

lib/util/webCryptoAPI.d.tsView file

Lines 1-26typescript

1export type SignEncodeMethod = 'hex' | 'base64';

2export type SignAlgorithm = 'SHA-256' | 'SHA-512';

3type KeyType = 'HMAC' |

Source & flagged code

4 flagged · loading source

lib/util/webCryptoAPI.jsView file

29patternName = private_key_rsa severity = critical line = 29 matchedText = * RSA ke...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/util/webCryptoAPI.jsView on unpkg · L29

29patternName = private_key_rsa severity = critical line = 29 matchedText = * RSA ke...---"

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L29

46patternName = private_key_rsa severity = critical line = 46 matchedText = const ba...'');

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L46

lib/util/webCryptoAPI.d.tsView file

6patternName = private_key_rsa severity = critical line = 6 matchedText = * RSA ke...---"

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.d.ts

lib/util/webCryptoAPI.d.tsView on unpkg · L6

Findings

4 Critical2 Medium4 Low

CriticalCritical Secretlib/util/webCryptoAPI.js

CriticalSecret Patternlib/util/webCryptoAPI.js

CriticalSecret Patternlib/util/webCryptoAPI.d.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

lib/util/webCryptoAPI.jsView file

Lines 9-66javascript

9 });

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.getSignKeyType = getSignKeyType;

13exports.hashMessage = hashMessage;

14exports.signMessage = signMessage;

15exports.signBinaryData = signBinaryData;

16exports.checkWebCryptoAPISupported = checkWebCryptoAPISupported;

17const typeGuards_1 = require("./typeGuards");

18function bufferToB64(buffer) {

19 let binary = '';

20 const bytes = new Uint8Array(buffer);

21 const len = bytes.byteLength;

22 for (let i = 0; i < len; i++) {

23 binary += String.fromCharCode(bytes[i]);

24 }

25 return globalThis.btoa(binary);

26}

27/**

28 * Determine the key type based on the secret format

29 * RSA keys contain "-----BEGIN PRIVATE KEY-----" or "-----BEGIN RSA PRIVATE KEY-----"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/util/webCryptoAPI.jsView on unpkg · L29

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L29

30 * HMAC keys are plain strings

31 */

32function getSignKeyType(secret) {

33 if (secret === null || secret === void 0 ? void 0 : secret.includes('PRIVATE KEY')) {

34 return 'RSASSA-PKCS1-v1_5';

35 }

36 return 'HMAC';

37}

38/**

39 * Import a key for signing based on its type

40 */

41function importKey(secret, type, algorithm, encoder) {

42 return __awaiter(this, void 0, void 0, function* () {

43 switch (type) {

44 case 'RSASSA-PKCS1-v1_5': {

45 // Remove PEM headers/footers and whitespace to get base64 content

46 const base64Key = secret.replace(/(?:-----BEGIN RSA PRIVATE KEY-----|-----BEGIN PRIVATE KEY-----|-----END RSA PRIVATE KEY-----|-----END PRIVATE KEY-----|\s+)/g, '');

Critical

Secret Pattern

RSA private key in lib/util/webCryptoAPI.js

lib/util/webCryptoAPI.jsView on unpkg · L46

47 const binaryKey = Uint8Array.from(atob(base64Key), (c) => c.charCodeAt(0));

48 return crypto.subtle.importKey('pkcs8', binaryKey.buffer, { name: type, hash: { name: algorithm } }, false, ['sign']);

49 }

50 case 'HMAC': {

51 return globalThis.crypto.subtle.importKey('raw', encoder.encode(secret), { name: type, hash: algorithm }, false, ['sign']);

52 }

53 default: {

54 throw (0, typeGuards_1.neverGuard)(type, `Unhandled key type: "${type}"`);

55 }

56 }

57 });

58}

59/**

60 * Similar to node crypto's `createHash()` function

61 */

62function hashMessage(message, method, algorithm) {

63 return __awaiter(this, void 0, void 0, function* () {

64 const encoder = new TextEncoder();

65 const buffer = yield globalThis.crypto.subtle.digest(algorithm, encoder.encode(message));

66 switch (method) {

lib/util/webCryptoAPI.d.tsView file

Lines 1-26typescript

1export type SignEncodeMethod = 'hex' | 'base64';

2export type SignAlgorithm = 'SHA-256' | 'SHA-512';

3type KeyType = 'HMAC' |