registry / goldenmatch / 1.2.0

goldenmatch@1.2.0

Entity resolution toolkit — deduplicate, match, and create golden records

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 15.2 MB of source, external domains: api.anthropic.com, api.hubapi.com, api.openai.com, api.voyageai.com, github.com

Source & flagged code

4 flagged

dist/core/documentsWasm.cjsView file

Lines 290-330javascript

290 return wasm;

291}

292function initSync(module) {

293 if (wasm !== void 0) return wasm;

294 if (module !== void 0) {

295 if (Object.getPrototypeOf(module) === Object.prototype) {

296 ({ module } = module);

297 } else {

298 console.warn("using deprecated parameters for `initSync()`; pass a single object instead");

299 }

300 }

301 const imports = __wbg_get_imports();

302 if (!(module instanceof WebAssembly.Module)) {

303 module = new WebAssembly.Module(module);

304 }

305 const instance = new WebAssembly.Instance(module, imports);

306 return __wbg_finalize_init(instance);

307}

308

309// src/core/_wasm/documentsWasmBytes.ts

310var DOCUMENTS_WASM_BASE64 = "AGFzbQEAAAAB1AEeYAAAYAABf2AAAn9/YAF/AGABfwF/YAJ/fwBgAn9/AX9gAn9/BH9/f39gAn9/AW9gA39/fwBgA39/fwF/YAR/f39/AGAEf39/fwF/YAR/f39/BH9/f39gBX9/f39/AGAFf39/f38Bf2AGf39/f39/AGAGf39/f39/AX9gBn9/f39/fwR/f39/YAd/f39/f39/AGAEf39/fgBgBX9/f35/AGAEf39/fABgBX9/f3x/AGADf39+AGAFf35+fn4AYAJ/fABgAX4Bf2ACfn8Bf2ACfH8BfwKIAQIiLi9nb2xkZW5tYXRjaF9kb2N1bWVudHNfd2FzbV9iZy5qcxxfX3diZ19FcnJvcl85MmIyOWIwNTQ4ZjhiNzQ2AAgiLi9nb2xkZW5tYXRjaF9kb2N1bWVudHNfd2FzbV9iZy5qcx9fX3diaW5kZ2VuX2luaXRfZXh0ZXJucmVmX3RhYmxlAAADpwKlAhMOBAkFBQsdEwYQEAUJBg4ODgUJCQkEDg4OEBAGCgkMCQYMBgkJAwULBgYKBQ4MEQMFBQUTAwkJBgQFBQY ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/documentsWasm.cjsView on unpkg · L310

Critical

Secret Pattern

AWS access key ID in dist/core/documentsWasm.cjs

dist/core/documentsWasm.cjsView on unpkg · L310

311

312// src/core/documentsWasm.ts

313var initialized = false;

314function base64ToBytes(b64) {

315 const bin = atob(b64);

316 const len = bin.length;

317 const bytes = new Uint8Array(len);

318 for (let i = 0; i < len; i++) bytes[i] = bin.charCodeAt(i);

319 return bytes;

320}

321function ensureInit() {

322 if (initialized) return;

323 initSync({ module: base64ToBytes(DOCUMENTS_WASM_BASE64) });

324 initialized = true;

325}

326function validateSchema(schema) {

327 ensureInit();

328 return JSON.parse(schema_validate(JSON.stringify(schema)));

329}

330function parseMessageText(resp) {

Long lines were clipped for display.

dist/core/index.jsView file

1201if (isNode) { L1202: const fs = await import('fs/promises'); L1203: const buf = await fs.readFile(url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/index.jsView on unpkg · L1201

dist/core/documentsWasm.jsView file

Lines 288-328javascript

288 return wasm;

289}

290function initSync(module) {

291 if (wasm !== void 0) return wasm;

292 if (module !== void 0) {

Source & flagged code

4 flagged · loading source

dist/core/documentsWasm.cjsView file

310patternName = aws_access_key severity = critical line = 310 matchedText = var DOCU...h0";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/documentsWasm.cjsView on unpkg · L310

310patternName = aws_access_key severity = critical line = 310 matchedText = var DOCU...h0";

Critical

Secret Pattern

AWS access key ID in dist/core/documentsWasm.cjs

dist/core/documentsWasm.cjsView on unpkg · L310

dist/core/index.jsView file

1201if (isNode) { L1202: const fs = await import('fs/promises'); L1203: const buf = await fs.readFile(url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/index.jsView on unpkg · L1201

dist/core/documentsWasm.jsView file

308patternName = aws_access_key severity = critical line = 308 matchedText = var DOCU...h0";

Critical

Secret Pattern

AWS access key ID in dist/core/documentsWasm.js

dist/core/documentsWasm.jsView on unpkg · L308

Findings

3 Critical3 Medium4 Low

CriticalCritical Secretdist/core/documentsWasm.cjs

CriticalSecret Patterndist/core/documentsWasm.cjs

CriticalSecret Patterndist/core/documentsWasm.js

MediumDynamic Requiredist/core/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/core/documentsWasm.cjsView file

Lines 290-330javascript

290 return wasm;

291}

292function initSync(module) {

293 if (wasm !== void 0) return wasm;

294 if (module !== void 0) {

295 if (Object.getPrototypeOf(module) === Object.prototype) {

296 ({ module } = module);

297 } else {

298 console.warn("using deprecated parameters for `initSync()`; pass a single object instead");

299 }

300 }

301 const imports = __wbg_get_imports();

302 if (!(module instanceof WebAssembly.Module)) {

303 module = new WebAssembly.Module(module);

304 }

305 const instance = new WebAssembly.Instance(module, imports);

306 return __wbg_finalize_init(instance);

307}

308

309// src/core/_wasm/documentsWasmBytes.ts

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/documentsWasm.cjsView on unpkg · L310

Critical

Secret Pattern

AWS access key ID in dist/core/documentsWasm.cjs

dist/core/documentsWasm.cjsView on unpkg · L310

311

312// src/core/documentsWasm.ts

313var initialized = false;

314function base64ToBytes(b64) {

315 const bin = atob(b64);

316 const len = bin.length;

317 const bytes = new Uint8Array(len);

318 for (let i = 0; i < len; i++) bytes[i] = bin.charCodeAt(i);

319 return bytes;

320}

321function ensureInit() {

322 if (initialized) return;

323 initSync({ module: base64ToBytes(DOCUMENTS_WASM_BASE64) });

324 initialized = true;

325}

326function validateSchema(schema) {

327 ensureInit();

328 return JSON.parse(schema_validate(JSON.stringify(schema)));

329}

330function parseMessageText(resp) {

Long lines were clipped for display.

dist/core/index.jsView file

1201if (isNode) { L1202: const fs = await import('fs/promises'); L1203: const buf = await fs.readFile(url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/index.jsView on unpkg · L1201

dist/core/documentsWasm.jsView file

Lines 288-328javascript

288 return wasm;

289}

290function initSync(module) {

291 if (wasm !== void 0) return wasm;

292 if (module !== void 0) {