registry / codebase-shared-functions / 2.0.27
codebase-shared-functions@2.0.27
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential use sends DO_API_TOKEN to a DigitalOcean serverless endpoint as authorization for the mail action, and the mail flow is invoked through callable package functions. No install-time or automatic credential exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Mail delivery occurs when the caller invokes sendMail or consumeEmailMessages; database connection is initiated on entry-point import.
Impact
No unauthorized collection or action was established from the inspected flows.
Mechanism
sendMail posts its supplied mail details to a DigitalOcean serverless email action, and entry-point import passes MONGODB_URI to codebase-models.connect.
AI rationale
The flagged credential use sends DO_API_TOKEN to a DigitalOcean serverless endpoint as authorization for the mail action, and the mail flow is invoked through callable package functions. No install-time or automatic credential exfiltration was found.
Evidence
src/mailer.jssrc/rabbitmq.jssrc/index.js
Network endpoints1
faas-fra1-afec6ce7.doserverless.co
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; its main entry is src/index.js.
- src/mailer.js sends mail details to a DigitalOcean serverless email action, using DO_API_TOKEN for authorization.
- Mail sending is invoked from the explicitly called consumeEmailMessages function when it consumes a queue message.
- Importing src/index.js connects through codebase-models using the caller-configured MONGODB_URI.
Evidence against
- The mailer is exported as a callable function; importing it does not itself send a request.
- The queue consumer connects and processes messages only when consumeEmailMessages is called.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedsrc/mailer.jsView file
1const axios = require('axios');
L2: const sendMail = async (mailDetails) => {
...
L6: const headers = {
L7: Authorization: `Basic ${process.env.DO_API_TOKEN}`,
L8: 'Content-Type': 'application/json',
...
L10:
L11: const res = await axios.post(url, mailDetails, { headers });
L12: console.log('logger give infor error', res);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/mailer.jsView on unpkg · L11Trigger-reachable chain: scripts.start -> src/index.js -> src/mailer.js
L1: const axios = require('axios');
L2: const sendMail = async (mailDetails) => {
...
L6: const headers = {
L7: Authorization: `Basic ${process.env.DO_API_TOKEN}`,
L8: 'Content-Type': 'application/json',
...
L10:
L11: const res = await axios.post(url, mailDetails, { headers });
L12: console.log('logger give infor error', res);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
src/mailer.jsView on unpkg · L11Trigger-reachable credential exfiltration chain: scripts.start -> src/index.js -> src/mailer.js
L1: const axios = require('axios');
L2: const sendMail = async (mailDetails) => {
...
L6: const headers = {
L7: Authorization: `Basic ${process.env.DO_API_TOKEN}`,
L8: 'Content-Type': 'application/json',
...
L10:
L11: const res = await axios.post(url, mailDetails, { headers });
L12: console.log('logger give infor error', res);
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationsrc/mailer.js
CriticalTrigger Reachable Dangerous Capabilitysrc/mailer.js
HighTrigger Reachable Credential Exfiltrationsrc/mailer.js
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatasrc/mailer.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to codebase-shared-functions@2.0.27.
See all versions of codebase-shared-functions for other recorded verdicts.
- Review the evidence and your use of codebase-shared-functions@2.0.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.