Loading npm security reports…

get-jitney: Suspicious npm security report (Warn) | LPM Firewall

registry / get-jitney / 0.2.0

get-jitney@0.2.0

Deploy Jitney to Cloudflare and configure its GitHub App

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.53 MB of source, external domains: 127.0.0.1, api.github.com, developer.github.com, developers.cloudflare.com, docs.github.com, fetch.spec.whatwg.org, github.com, github.test, octokit.github.io, uploads.github.com, www.githubstatus.com

Source & flagged code

8 flagged

assets/worker/index.jsView file

30886patternName = private_key_rsa severity = critical line = 30886 matchedText = return p...-");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/worker/index.jsView on unpkg · L30886

30886patternName = private_key_rsa severity = critical line = 30886 matchedText = return p...-");

Critical

Secret Pattern

RSA private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L30886

30890patternName = private_key_openssh severity = critical line = 30890 matchedText = return p...-");

Critical

Secret Pattern

OpenSSH private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L30890

31179patternName = private_key_rsa severity = critical line = 31179 matchedText = if (priv...") {

Critical

Secret Pattern

RSA private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L31179

31181patternName = private_key_rsa severity = critical line = 31181 matchedText = "The 'pr...\n'"

Critical

Secret Pattern

RSA private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L31181

15266prop: "value", L15267: eval(fiber) { L15268: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

assets/worker/index.jsView on unpkg · L15266

dist/cli.jsView file

Lines 5-45javascript

5import { Cause, Effect as Effect7, Exit, Option } from "effect";

7// src/deploy.ts

8import { chmod as chmod2, mkdtemp as mkdtemp2, readFile, rm as rm2, writeFile as writeFile2 } from "fs/promises";

Source & flagged code

8 flagged · loading source

assets/worker/index.jsView file

30886patternName = private_key_rsa severity = critical line = 30886 matchedText = return p...-");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/worker/index.jsView on unpkg · L30886

30886patternName = private_key_rsa severity = critical line = 30886 matchedText = return p...-");

Critical

Secret Pattern

RSA private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L30886

30890patternName = private_key_openssh severity = critical line = 30890 matchedText = return p...-");

Critical

Secret Pattern

OpenSSH private key in assets/worker/index.js

assets/worker/index.jsView on unpkg · L30890

31179patternName = private_key_rsa severity = critical line = 31179 matchedText = if (priv...") {

Findings

5 Critical3 High2 Medium5 Low

CriticalCritical Secretassets/worker/index.js

CriticalSecret Patternassets/worker/index.js

HighChild Processdist/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalassets/worker/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings