registry / expensify-common / 2.0.191

expensify-common@2.0.191

Expensify libraries and components shared across different repos

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 76 file(s), 777 KB of source, external domains: buy.itunes.apple.com, cdn.plaid.com, community.expensify.com, d2k5nsl2zxldvw.cloudfront.net, developer.android.com, developer.apple.com, developer.mozilla.org, github.com, help.expensify.com, privacy.microsoft.com, reactnative.dev, salesforce.expensify.com, secure.expensify.com, secure.expensify.com.dev, stackoverflow.com, staging-secure.expensify.com, staging.expensify.com, support.apple.com, support.microsoft.com, support.mozilla.com, use.expensify.com, www.expensify.com, www.expensify.com.dev, www.google.com, www.opera.com

Source & flagged code

2 flagged

dist/esm/API.jsView file

Lines 127-167javascript

127 }

128 /**

129 * @throws {Error} If the "parameters" object has a null or undefined value for any of the given parameterNames

130 *

131 * @private

132 *

133 * @param {String[]} parameterNames Array of the required parameter names

134 * @param {Object} parameters A map from available parameter names to their values

135 * @param {String} commandName The name of the API command

136 */

137 function requireParameters(parameterNames, parameters, commandName) {

138 for (const parameterName of parameterNames) {

139 if (has(parameters, parameterName) && parameters[parameterName] !== null && parameters[parameterName] !== undefined) {

140 continue;

141 }

142 const parametersCopy = Object.assign({}, parameters);

143 if (has(parametersCopy, 'authToken')) {

144 parametersCopy.authToken = '<redacted>';

145 }

146 if (has(parametersCopy, 'password')) {

147 parametersCopy.password = '<redacted>';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/API.jsView on unpkg · L147

148 }

149 const keys = Object.keys(parametersCopy).join(', ') || 'none';

150 throw new Error(`Parameter ${parameterName} is required for "${commandName}". Supplied parameters: ${keys}`);

151 }

152 }

153 return {

154 /**

155 * @param {Number[]} jsonCodes

156 * @param {Function} callback

157 */

158 registerDefaultHandler(jsonCodes, callback) {

159 if (!Utils.isFunction(callback)) {

160 return;

161 }

162 for (const jsonCode of jsonCodes) {

163 if (!defaultHandlers[jsonCode]) {

164 defaultHandlers[jsonCode] = [];

165 }

166 defaultHandlers[jsonCode].push(callback);

167 }

dist/API.jsView file

Lines 166-206javascript

166 }

167 /**

168 * @throws {Error} If the "parameters" object has a null or undefined value for any of the given parameterNames

169 *

170 * @private

171 *

172 * @param {String[]} parameterNames Array of the required parameter names

173 * @param {Object}

Source & flagged code

2 flagged · loading source

dist/esm/API.jsView file

147patternName = generic_password severity = medium line = 147 matchedText = paramete...d>';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/API.jsView on unpkg · L147

dist/API.jsView file

186patternName = generic_password severity = medium line = 186 matchedText = paramete...d>';

Medium

Secret Pattern

Hardcoded password in dist/API.js

dist/API.jsView on unpkg · L186

Findings

4 Medium3 Low

MediumSecret Patterndist/esm/API.js

MediumNetwork

MediumGit Dependency

MediumSecret Patterndist/API.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/esm/API.jsView file

Lines 127-167javascript

127 }

128 /**

129 * @throws {Error} If the "parameters" object has a null or undefined value for any of the given parameterNames

130 *

131 * @private

132 *

133 * @param {String[]} parameterNames Array of the required parameter names

134 * @param {Object} parameters A map from available parameter names to their values

135 * @param {String} commandName The name of the API command

136 */

137 function requireParameters(parameterNames, parameters, commandName) {

138 for (const parameterName of parameterNames) {

139 if (has(parameters, parameterName) && parameters[parameterName] !== null && parameters[parameterName] !== undefined) {

140 continue;

141 }

142 const parametersCopy = Object.assign({}, parameters);

143 if (has(parametersCopy, 'authToken')) {

144 parametersCopy.authToken = '<redacted>';

145 }

146 if (has(parametersCopy, 'password')) {

147 parametersCopy.password = '<redacted>';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/API.jsView on unpkg · L147

148 }

149 const keys = Object.keys(parametersCopy).join(', ') || 'none';

150 throw new Error(`Parameter ${parameterName} is required for "${commandName}". Supplied parameters: ${keys}`);

151 }

152 }

153 return {

154 /**

155 * @param {Number[]} jsonCodes

156 * @param {Function} callback

157 */

158 registerDefaultHandler(jsonCodes, callback) {

159 if (!Utils.isFunction(callback)) {

160 return;

161 }

162 for (const jsonCode of jsonCodes) {

163 if (!defaultHandlers[jsonCode]) {

164 defaultHandlers[jsonCode] = [];

165 }

166 defaultHandlers[jsonCode].push(callback);

167 }

dist/API.jsView file

Lines 166-206javascript

166 }

167 /**

168 * @throws {Error} If the "parameters" object has a null or undefined value for any of the given parameterNames

169 *

170 * @private

171 *

172 * @param {String[]} parameterNames Array of the required parameter names

173 * @param {Object}