registry / commitcourier / 0.4.0

commitcourier@0.4.0

Transactional Outbound Webhook delivery for Node.js/TypeScript, backed by your existing PostgreSQL.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 398 KB of source

Source & flagged code

2 flagged

dist/otel/index.cjsView file

Lines 5-45javascript

5var __hasOwnProp = Object.prototype.hasOwnProperty;

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/otel/index.ts

21var otel_exports = {};

22__export(otel_exports, {

23 createOtelInstrumentation: () => createOtelInstrumentation

24});

25module.exports = __toCommonJS(otel_exports);

26var import_api = require("@opentelemetry/api");

27var DELIVERIES_COUNTER = "commitcourier.deliveries";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/otel/index.cjsView on unpkg · L25

28var DURATION_HISTOGRAM = "commitcourier.delivery.duration";

29function splitHost(host) {

30 if (host.startsWith("[")) {

31 const end = host.indexOf("]");

32 if (end !== -1) {

33 const address = host.slice(1, end);

34 const rest = host.slice(end + 1);

35 const port = rest.startsWith(":") ? Number(rest.slice(1)) : Number.NaN;

36 return { address, port: Number.isInteger(port) ? port : null };

37 }

38 }

39 const i = host.lastIndexOf(":");

40 if (i !== -1) {

41 const portStr = host.slice(i + 1);

42 if (/^\d+$/.test(portStr)) return { address: host.slice(0, i), port: Number(portStr) };

43 }

44 return { address: host, port: null };

45}

dist/index.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

Source & flagged code

2 flagged · loading source

dist/otel/index.cjsView file

25module.exports = __toCommonJS(otel_exports); L26: var import_api = require("@opentelemetry/api"); L27: var DELIVERIES_COUNTER = "commitcourier.deliveries";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/otel/index.cjsView on unpkg · L25

dist/index.cjsView file

34backoffMs: () => backoffMs, L35: base64ToBytes: () => base64ToBytes, L36: bytesToBase64: () => bytesToBase64, ... L343: ["fe80::/10", "link-local"], L344: ["10.0.0.0/8", "private"], L345: ["172.16.0.0/12", "private"], ... L940: // src/delivery/http.ts L941: var import_undici = require("undici"); L942: var import_node_dns = require("dns"); L943: ... L1373: const headers = buildHeaders(sig, row); L1374: const res = await ctx.deps.http.post({ url, headers, body });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L34

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessdist/index.cjs

MediumDynamic Requiredist/otel/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/otel/index.cjsView file

Lines 5-45javascript

5var __hasOwnProp = Object.prototype.hasOwnProperty;

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/otel/index.ts

21var otel_exports = {};

22__export(otel_exports, {

23 createOtelInstrumentation: () => createOtelInstrumentation

24});

25module.exports = __toCommonJS(otel_exports);

26var import_api = require("@opentelemetry/api");

27var DELIVERIES_COUNTER = "commitcourier.deliveries";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/otel/index.cjsView on unpkg · L25

28var DURATION_HISTOGRAM = "commitcourier.delivery.duration";

29function splitHost(host) {

30 if (host.startsWith("[")) {

31 const end = host.indexOf("]");

32 if (end !== -1) {

33 const address = host.slice(1, end);

34 const rest = host.slice(end + 1);

35 const port = rest.startsWith(":") ? Number(rest.slice(1)) : Number.NaN;

36 return { address, port: Number.isInteger(port) ? port : null };

37 }

38 }

39 const i = host.lastIndexOf(":");

40 if (i !== -1) {

41 const portStr = host.slice(i + 1);

42 if (/^\d+$/.test(portStr)) return { address: host.slice(0, i), port: Number(portStr) };

43 }

44 return { address: host, port: null };

45}

dist/index.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });