registry / citra / 0.29.2

citra@0.29.2

OAuth2 library for Typescript

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 83.8 KB of source, external domains: access.line.me, account.box.com, account.withings.com, accounts.google.com, accounts.platform.intuit.com, accounts.spotify.com, accounts.zoho, anilist.co, api.atlassian.com, api.attio.com, api.bitbucket.org, api.box.com, api.calendly.com, api.close.com, api.coinbase.com, api.dribbble.com, api.dropboxapi.com, api.epicgames.dev, api.etsy.com, api.figma.com, api.github.com, api.hubapi.com, api.intra.42.fr, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.login.yahoo.com, api.mercadolibre.com, api.mercadopago.com, api.monday.com, api.myanimelist.net, api.notion.com, api.pipedrive.com, api.polar.sh, api.spotify.com, api.start.gg, api.tumblr.com, api.twitch.tv, api.twitter.com, api.userprofile.autodesk.com, api.vk.com, api.zoom.us, apis.roblox.com, app.attio.com, app.close.com, app.hubspot.com, appcenter.intuit.com, appleid.apple.com, auth.atlassian.com

Source & flagged code

2 flagged

.env.exampleView file

Lines 1-37text

1# FORTY_TWO_CLIENT_ID=12345678901234567890123456789012

2# FORTY_TWO_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

3# FORTY_TWO_REDIRECT_URI=http://localhost:3000/oauth2/42/callback

5# AMAZON_COGNITO_CLIENT_ID=012345678901234567890123456789012

6# AMAZON_COGNITO_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

7# AMAZON_COGNITO_REDIRECT_URI=http://localhost:3000/oauth2/amazon/callback

8# AMAZON_COGNITO_DOMAIN=your-cognito-domain.auth.us-east-1.amazoncognito.com

10# ANILIST_CLIENT_ID=12345678901234567890123456789012

11# ANILIST_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

12# ANILIST_REDIRECT_URI=http://localhost:3000/oauth2/anilist/callback

14# APPLE_CLIENT_ID=1234567890.com.example.app

15# APPLE_REDIRECT_URI=http://localhost:3000/oauth2/apple/callback

16# APPLE_TEAM_ID=your-apple-team-id

17# APPLE_PKCS8_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L17

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L17

18# APPLE_KEY_ID=your-apple-key-id

20# ATLASSIAN_CLIENT_ID=12345678901234567890123456789012

21# ATLASSIAN_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

22# ATLASSIAN_REDIRECT_URI=http://localhost:3000/oauth2/atlassian/callback

24# AUTH0_CLIENT_ID= 12345678901234567890123456789012

25# AUTH0_CLIENT_SECRET= 12345678901234567890123456789012

26# AUTH0_REDIRECT_URI=http://localhost:3000/oauth2/auth0/callback

27# AUTH0_DOMAIN= your-auth0-domain.auth0.com

29# AUTHENTIK_CLIENT_ID= 12345678901234567890123456789012

30# AUTHENTIK_CLIENT_SECRET= 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

31# AUTHENTIK_REDIRECT_URI= http://localhost:3000/oauth2/authentik/callback

32# AUTHENTIK_BASE_URL= http://localhost:3000

34# AUTODESK_CLIENT_ID = 12345678901234567890123456789012

35# AUTODESK_CLIENT_SECRET = 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

36# AUTODESK_REDIRECT_URI=http://localhost:3000/oauth2/autodesk/callback

Source & flagged code

2 flagged · loading source

.env.exampleView file

17patternName = private_key_rsa severity = critical line = 17 matchedText = # APPLE_...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L17

17patternName = private_key_rsa severity = critical line = 17 matchedText = # APPLE_...----

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L17

Findings

2 Critical1 Medium3 Low

CriticalCritical Secret.env.example

CriticalSecret Pattern.env.example

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

.env.exampleView file

Lines 1-37text

1# FORTY_TWO_CLIENT_ID=12345678901234567890123456789012

2# FORTY_TWO_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

3# FORTY_TWO_REDIRECT_URI=http://localhost:3000/oauth2/42/callback

5# AMAZON_COGNITO_CLIENT_ID=012345678901234567890123456789012

6# AMAZON_COGNITO_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

7# AMAZON_COGNITO_REDIRECT_URI=http://localhost:3000/oauth2/amazon/callback

8# AMAZON_COGNITO_DOMAIN=your-cognito-domain.auth.us-east-1.amazoncognito.com

10# ANILIST_CLIENT_ID=12345678901234567890123456789012

11# ANILIST_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

12# ANILIST_REDIRECT_URI=http://localhost:3000/oauth2/anilist/callback

14# APPLE_CLIENT_ID=1234567890.com.example.app

15# APPLE_REDIRECT_URI=http://localhost:3000/oauth2/apple/callback

16# APPLE_TEAM_ID=your-apple-team-id

17# APPLE_PKCS8_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.exampleView on unpkg · L17

Critical

Secret Pattern

RSA private key in .env.example

.env.exampleView on unpkg · L17

18# APPLE_KEY_ID=your-apple-key-id

20# ATLASSIAN_CLIENT_ID=12345678901234567890123456789012

21# ATLASSIAN_CLIENT_SECRET=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

22# ATLASSIAN_REDIRECT_URI=http://localhost:3000/oauth2/atlassian/callback

24# AUTH0_CLIENT_ID= 12345678901234567890123456789012

25# AUTH0_CLIENT_SECRET= 12345678901234567890123456789012

26# AUTH0_REDIRECT_URI=http://localhost:3000/oauth2/auth0/callback

27# AUTH0_DOMAIN= your-auth0-domain.auth0.com

29# AUTHENTIK_CLIENT_ID= 12345678901234567890123456789012

30# AUTHENTIK_CLIENT_SECRET= 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

31# AUTHENTIK_REDIRECT_URI= http://localhost:3000/oauth2/authentik/callback

32# AUTHENTIK_BASE_URL= http://localhost:3000

34# AUTODESK_CLIENT_ID = 12345678901234567890123456789012

35# AUTODESK_CLIENT_SECRET = 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

36# AUTODESK_REDIRECT_URI=http://localhost:3000/oauth2/autodesk/callback