registry / garmin-connect-nexxt / 1.6.24

garmin-connect-nexxt@1.6.24

Makes it simple to interface with Garmin Connect to get or set any data point

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a user-invoked Garmin OAuth/API client and supports explicit token export.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer constructs `GarminConnect` and calls `login()` or `exportTokenToFile(dirPath)`.

Impact

Credentials are sent to Garmin authentication endpoints for the requested login; token files are written only through an explicit API call.

Mechanism

Garmin SSO/OAuth requests with optional caller-directed token-file export.

Rationale

Static inspection shows expected Garmin authentication, API access, and explicit token persistence rather than covert execution or exfiltration. Scanner signals are explained by normal network/OAuth behavior, examples reading Garmin environment variables, and Node's built-in `crypto` module.

Evidence

package.jsondist/index.jsdist/common/HttpClient.jsdist/garmin/GarminConnect.jsdist/garmin/UrlClass.jsdist/utils.jsexamples/example-image.js

Network endpoints5

thegarth.s3.amazonaws.com/oauth_consumer.jsonsso.garmin.comconnectapi.garmin.comconnect.garmin.commobile.integration.garmin.com

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/common/HttpClient.js` fetches OAuth consumer data from an external S3 URL during user-invoked login.
`dist/garmin/GarminConnect.js` can explicitly export OAuth tokens to caller-supplied directories.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`dist/index.js` only exports library modules; no import-time network or command execution was found.
No child-process, shell, eval, Function, dynamic import, AI-agent config, or persistence primitive appears in runtime source.
Login posts supplied credentials to constructed Garmin SSO endpoints; no unrelated credential-exfiltration endpoint was found.
`dist/utils.js` file writes are reached only by the explicit `exportTokenToFile(dirPath)` API.
`crypto` use is HMAC-SHA1 for OAuth signing, not payload encryption or obfuscation.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 130 KB of source, external domains: connect.garmin.com, mobile.integration, thegarth.s3.amazonaws.com

Source & flagged code

5 flagged

examples/example.jsView file

Lines 1-35javascript

1const { GarminConnect } = require('garmin-connect-nexxt`');

3// Has to be run in an async function to be able to use the await keyword

4const main = async () => {

5 // Create a new Garmin Connect Client

6 const GCClient = new GarminConnect({

7 username: 'your-email',

8 password: 'your-password'

Medium

Secret Pattern

Package contains a possible secret pattern.

examples/example.jsView on unpkg · L8

9 });

11 // TODO: Test China Domain

12 // China Domain

13 // const GCClient = new GarminConnect({

14 // username: 'your-email',

15 // password: 'your-password'

Medium

Secret Pattern

Hardcoded password in examples/example.js

examples/example.jsView on unpkg · L15

16 // }, 'garmin.cn');

18 // Uses credentials from garmin.config.json or uses supplied params

19 await GCClient.login();

21 // // Get user info

22 // const info = await GCClient.getUserInfo();

24 // Log info to make sure signin was successful

25 // console.log(info);

26 // // Get user settings

27 const settings = await GCClient.getUserSettings();

29 // Log info to make sure signin was successful

30 console.log(settings);

31};

33// Run the code

34main();

dist/common/HttpClient.jsView file

Lines 33-73javascript

33 case 4: _.label++; return { value: op[1], done: false };

34 case 5: _.label++; y = op[1]; op = [0]; continue;

35 case 7: op =

package.jsonView file

Lines 1-27json

2 "name": "garmin-connect-nexxt",

3 "version": "1.6.24",

4 "description": "Makes it simple to interface with Garmin Connect to get or set any data point",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "scripts"

README.mdView file

Lines 31-71markdown

31 - [Hydration](#hydration)

32 - [Heart Rate](#heart-rate)

33- [Golf](#golf)

34- [Gear](#gear)

35- [GPX and Courses](#gpx-and-courses)

36- [Calendar](#calendar)

Source & flagged code

5 flagged · loading source

examples/example.jsView file

8patternName = generic_password severity = medium line = 8 matchedText = password...ord'

Medium

Secret Pattern

Package contains a possible secret pattern.

examples/example.jsView on unpkg · L8

15patternName = generic_password severity = medium line = 15 matchedText = // p...ord'

Medium

Secret Pattern

Hardcoded password in examples/example.js

examples/example.jsView on unpkg · L15

dist/common/HttpClient.jsView file

53exports.HttpClient = void 0; L54: var axios_1 = __importDefault(require("axios")); L55: var lodash_1 = __importDefault(require("lodash")); ... L275: switch (_a.label) { L276: case 0: return [4 /*yield*/, this.client.post(url, data, config)]; L277: case 1: ... L531: .update(base_string) L532: .digest('base64'); L533: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/common/HttpClient.jsView on unpkg · L53

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

README.mdView file

51patternName = generic_password severity = medium line = 51 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L51

Findings

1 High5 Medium5 Low

HighNode Builtin Dependency Squatpackage.json

MediumSecret Patternexamples/example.js

MediumNetwork

MediumEnvironment Vars

MediumSecret PatternREADME.md

MediumSecret Patternexamples/example.js

LowScripts Present

LowWeak Cryptodist/common/HttpClient.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

examples/example.jsView file

Lines 1-35javascript

1const { GarminConnect } = require('garmin-connect-nexxt`');

3// Has to be run in an async function to be able to use the await keyword

4const main = async () => {

5 // Create a new Garmin Connect Client

6 const GCClient = new GarminConnect({

7 username: 'your-email',

8 password: 'your-password'

Medium

Secret Pattern

Package contains a possible secret pattern.

examples/example.jsView on unpkg · L8

9 });

11 // TODO: Test China Domain

12 // China Domain

13 // const GCClient = new GarminConnect({

14 // username: 'your-email',

15 // password: 'your-password'

Medium

Secret Pattern

Hardcoded password in examples/example.js

examples/example.jsView on unpkg · L15

16 // }, 'garmin.cn');

18 // Uses credentials from garmin.config.json or uses supplied params

19 await GCClient.login();

21 // // Get user info

22 // const info = await GCClient.getUserInfo();

24 // Log info to make sure signin was successful

25 // console.log(info);

26 // // Get user settings

27 const settings = await GCClient.getUserSettings();

29 // Log info to make sure signin was successful

30 console.log(settings);

31};

33// Run the code

34main();

dist/common/HttpClient.jsView file

Lines 33-73javascript

33 case 4: _.label++; return { value: op[1], done: false };

34 case 5: _.label++; y = op[1]; op = [0]; continue;

35 case 7: op =

package.jsonView file

Lines 1-27json

2 "name": "garmin-connect-nexxt",

3 "version": "1.6.24",

4 "description": "Makes it simple to interface with Garmin Connect to get or set any data point",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "scripts"

README.mdView file

Lines 31-71markdown

31 - [Hydration](#hydration)

32 - [Heart Rate](#heart-rate)

33- [Golf](#golf)

34- [Gear](#gear)

35- [GPX and Courses](#gpx-and-courses)

36- [Calendar](#calendar)