registry / commitcourier / 0.4.0

commitcourier@0.4.0

Transactional Outbound Webhook delivery for Node.js/TypeScript, backed by your existing PostgreSQL.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 398 KB of source

Source & flagged code

2 flagged

dist/otel/index.cjsView file

Lines 5-45javascript

5var __hasOwnProp = Object.prototype.hasOwnProperty;

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable:

Source & flagged code

2 flagged · loading source

dist/otel/index.cjsView file

25module.exports = __toCommonJS(otel_exports); L26: var import_api = require("@opentelemetry/api"); L27: var DELIVERIES_COUNTER = "commitcourier.deliveries";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/otel/index.cjsView on unpkg · L25

dist/index.cjsView file

34backoffMs: () => backoffMs, L35: base64ToBytes: () => base64ToBytes, L36: bytesToBase64: () => bytesToBase64, ... L343: ["fe80::/10", "link-local"], L344: ["10.0.0.0/8", "private"], L345: ["172.16.0.0/12", "private"], ... L940: // src/delivery/http.ts L941: var import_undici = require("undici"); L942: var import_node_dns = require("dns"); L943: ... L1373: const headers = buildHeaders(sig, row); L1374: const res = await ctx.deps.http.post({ url, headers, body });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L34

Findings

1 High4 Medium4 Low

HighCloud Metadata Accessdist/index.cjs

MediumDynamic Requiredist/otel/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/index.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/index.ts

31var index_exports = {};

32__export(index_exports, {

33 RelayError: () => RelayError,

34 backoffMs: () => backoffMs,

35 base64ToBytes: () => base64ToBytes,

36 bytesToBase64: () => bytesToBase64,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L34

37 bytesToUtf8: () => bytesToUtf8,

38 createAesGcmCipher: () => createAesGcmCipher,

39 createConsoleLogger: () => createConsoleLogger,

40 createRelay: () => createRelay,

41 evaluateIp: () => evaluateIp,

42 generateSecretKey: () => generateSecretKey,

43 initialState: () => initialState,

44 matchHostList: () => matchHostList,

45 onCancel: () => onCancel,

46 onClaim: () => onClaim,

47 onFailure: () => onFailure,

48 onPermanentFailure: () => onPermanentFailure,

49 onReclaim: () => onReclaim,

50 onSuccess: () => onSuccess,

51 parseRetryAfter: () => parseRetryAfter,

52 resolveConfig: () => resolveConfig,

53 sign: () => sign,

54 utf8ToBytes: () => utf8ToBytes,