registry / iobroker.anthbot / 0.1.0

iobroker.anthbot@0.1.0

Connect with Anthbot devices such as their robot mowers

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 126 KB of source

Source & flagged code

5 flagged

lib/anthbotApi.jsView file

Lines 1-47javascript

1/**

2 * API client for Anthbot Genie cloud polling

3 * NodeJS port of the Python api.py module by @vincentjanv...

4 * https://github.com/vincentjanv/anthbot_genie_ha

5 * ... with a few addions/changes of course ;)

6 */

8const { Buffer } = require('node:buffer');

9const crypto = require('node:crypto');

10const zlib = require('node:zlib');

12const tarStream = require('tar-stream');

13const { URLSearchParams } = require('node:url');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/anthbotApi.jsView on unpkg · L3

15// Constants

16const DEFAULT_API_HOST = 'api.anthbot.com';

17const DEFAULT_IOT_REGION = 'us-east-1';

18const DEFAULT_IOT_ENDPOINT = 'a2bhy9nr7jkgaj-ats.iot.us-east-1.amazonaws.com';

19const CN_NORTHWEST_IOT_ENDPOINT = 'a2iw0czxjowiip-ats.iot.cn-northwest-1.amazonaws.com.cn';

21const AWS_ACCESS_KEY_DEFAULT = 'AKIAV2C4RVIAOLEXB545';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/anthbotApi.jsView on unpkg · L21

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L21

22const AWS_SECRET_KEY_DEFAULT = 'ZYE0HGBogztfOrU2R4m1bKckcwjCKZ+4tpHh8cIi';

24const AWS_ACCESS_KEY_CN = 'AKIAWJ3KIT7IV6AHMJ5V';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L24

25const AWS_SECRET_KEY_CN = '9uqNfRASNsjjjxAR6HG9Nby18gehRnoV9/87amA3';

27const AWS_ACCESS_KEY_CN_NORTHWEST = 'AKIAYVWVSSRF7W5YWI74';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L27

28const AWS_SECRET_KEY_CN_NORTHWEST = 'MPQhRjYNUoYP8grS9zkxtfNmH8SAY/5wk9BJLtEw';

30const CLIENT_USER_AGENT = 'LdMower/1581 CFNetwork/3860.400.51 Darwin/25.3.0';

32const REQUEST_TIMEOUT = 15000; // 15 seconds

34/**

35 * Return a shallow copy of headers with the Authorization value masked, for safe logging

36 *

37 * @param {object} headers - Headers to redact

38 * @returns {object} - Redacted copy of headers

39 */

40function redactAuthorizationHeader(headers) {

41 if (!headers || !Object.prototype.hasOwnProperty.call(headers, 'Authorization')) {

42 return headers;

43 }

44 return { ...headers, Authorization: '***REDACTED***' };

45}

47/**

Source & flagged code

5 flagged · loading source

lib/anthbotApi.jsView file

21patternName = aws_access_key severity = critical line = 21 matchedText = const AW...45';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/anthbotApi.jsView on unpkg · L21

21patternName = aws_access_key severity = critical line = 21 matchedText = const AW...45';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L21

24patternName = aws_access_key severity = critical line = 24 matchedText = const AW...5V';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L24

27patternName = aws_access_key severity = critical line = 27 matchedText = const AW...74';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L27

3* NodeJS port of the Python api.py module by @vincentjanv... L4: * https://github.com/vincentjanv/anthbot_genie_ha L5: * ... with a few addions/changes of course ;) ... L12: const tarStream = require('tar-stream'); L13: const { URLSearchParams } = require('node:url'); L14: ... L113: if (contentType.includes('application/json') || contentType.startsWith('text/')) { L114: const responseBody = await responseClone.text(); L115: if (responseBody) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/anthbotApi.jsView on unpkg · L3

Findings

4 Critical1 Medium3 Low

CriticalCritical Secretlib/anthbotApi.js

CriticalSecret Patternlib/anthbotApi.js

MediumNetwork

LowScripts Present

LowWeak Cryptolib/anthbotApi.js

LowHigh Entropy Strings

Source & flagged code

5 flagged

lib/anthbotApi.jsView file

Lines 1-47javascript

1/**

2 * API client for Anthbot Genie cloud polling

3 * NodeJS port of the Python api.py module by @vincentjanv...

4 * https://github.com/vincentjanv/anthbot_genie_ha

5 * ... with a few addions/changes of course ;)

6 */

8const { Buffer } = require('node:buffer');

9const crypto = require('node:crypto');

10const zlib = require('node:zlib');

12const tarStream = require('tar-stream');

13const { URLSearchParams } = require('node:url');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/anthbotApi.jsView on unpkg · L3

15// Constants

16const DEFAULT_API_HOST = 'api.anthbot.com';

17const DEFAULT_IOT_REGION = 'us-east-1';

18const DEFAULT_IOT_ENDPOINT = 'a2bhy9nr7jkgaj-ats.iot.us-east-1.amazonaws.com';

19const CN_NORTHWEST_IOT_ENDPOINT = 'a2iw0czxjowiip-ats.iot.cn-northwest-1.amazonaws.com.cn';

21const AWS_ACCESS_KEY_DEFAULT = 'AKIAV2C4RVIAOLEXB545';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/anthbotApi.jsView on unpkg · L21

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L21

22const AWS_SECRET_KEY_DEFAULT = 'ZYE0HGBogztfOrU2R4m1bKckcwjCKZ+4tpHh8cIi';

24const AWS_ACCESS_KEY_CN = 'AKIAWJ3KIT7IV6AHMJ5V';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L24

25const AWS_SECRET_KEY_CN = '9uqNfRASNsjjjxAR6HG9Nby18gehRnoV9/87amA3';

27const AWS_ACCESS_KEY_CN_NORTHWEST = 'AKIAYVWVSSRF7W5YWI74';

Critical

Secret Pattern

AWS access key ID in lib/anthbotApi.js

lib/anthbotApi.jsView on unpkg · L27

28const AWS_SECRET_KEY_CN_NORTHWEST = 'MPQhRjYNUoYP8grS9zkxtfNmH8SAY/5wk9BJLtEw';

30const CLIENT_USER_AGENT = 'LdMower/1581 CFNetwork/3860.400.51 Darwin/25.3.0';

32const REQUEST_TIMEOUT = 15000; // 15 seconds

34/**

35 * Return a shallow copy of headers with the Authorization value masked, for safe logging

36 *

37 * @param {object} headers - Headers to redact

38 * @returns {object} - Redacted copy of headers

39 */

40function redactAuthorizationHeader(headers) {

41 if (!headers || !Object.prototype.hasOwnProperty.call(headers, 'Authorization')) {

42 return headers;

43 }

44 return { ...headers, Authorization: '***REDACTED***' };

45}

47/**