registry / jinaga / 6.9.0

jinaga@6.9.0

Data management for web and mobile applications.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetworkWebSocket

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 162 file(s), 957 KB of source

Source & flagged code

4 flagged

test/cryptography/keyPairSpec.tsView file

Lines 26-56typescript

27 const verified = verifyEnvelopes(factEnvelopes);

29 expect(verified).toBe(true);

30 });

32 it("should not verify a signature if the content has been modified", async () => {

33 const keyPair = generateKeyPair();

34 const factEnvelopes = givenSignedFact(keyPair);

36 factEnvelopes[0].fact.fields["identifier"] = "staging";

37 const verified = verifyEnvelopes(factEnvelopes);

39 expect(verified).toBe(false);

40 });

41});

43function givenKnownKeyPair(): KeyPair {

44 return {

45 publicPem: "-----BEGIN PUBLIC KEY-----\r\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4wP7IyUZICcZ5JC+UUxB\r\nZZOo8mE7R2zj8Zba5krMAqDMFbQ8bWS+nTbFVHgun1Z+5HUCZ9HHv7d7KPLu+zuI\r\nfBi5CuiJy4LJkIUuL2eRBvy8VJPeyDfvRuZ6Dc5r+vp25omx5bWbPtjPczatUphl\r\nQ83GXvITQ4ZQN/C8w7/cewq4/qVrT+TfwvIiynBSFbU5NXE6dmbE1PbJFjtBlJJ+\r\nM2uiTKMKgrC7hpluEdO3oz1itV3CTHo4DGChARLia/ZRGTUlheunbSOnFupl/Rts\r\ny/wfvEh+CBt2MduUFBo2pLCe6NMTlhEpC+/jOhQnIaU8NWy5aUh6D6pIDGwond9Y\r\nCwIDAQAB\r\n-----END PUBLIC KEY-----\r\n",

46 privatePem: "-----BEGIN RSA PRIVATE KEY-----\r\nMIIEpQIBAAKCAQEA4wP7IyUZICcZ5JC+UUxBZZOo8mE7R2zj8Zba5krMAqDMFbQ8\r\nbWS+nTbFVHgun1Z+5HUCZ9HHv7d7KPLu+zuIfBi5CuiJy4LJkIUuL2eRBvy8VJPe\r\nyDfvRuZ6Dc5r+vp25omx5bWbPtjPczatUphlQ83GXvITQ4ZQN/C8w7/cewq4/qVr\r\nT+TfwvIiynBSFbU5NXE6dmbE1PbJFjtBlJJ+M2uiTKMKgrC7hpluEdO3oz1itV3C\r\nTHo4DGChARLia/ZRGTUlheunbSOnFupl/Rtsy/wfvEh+CBt2MduUFBo2pLCe6NMT\r\nlhEpC+/jOhQnIaU8NWy5aUh6D6pIDGwond9YCwIDAQABAoIBAB8Ei7tdFcZFYW3P\r\n8xkTlLnmx4Y6j8luEOURCh6+KIrRYqEyi7Ecu0iq06J7e09NF7BqZmY+DQ9eaAcL\r\nzmhoVXkzPZFGfZFfcN/8undCrNeqD6d0vtNXhSuIUTPyuOFFeJp+RN7QhgI7yHiD\r\n ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cryptography/keyPairSpec.tsView on unpkg · L46

Critical

Secret Pattern

RSA private key in test/cryptography/keyPairSpec.ts

test/cryptography/keyPairSpec.tsView on unpkg · L46

47 };

48}

50function givenSignedFact(keyPair: KeyPair) {

51 const factRecords: FactRecord[] = dehydrateFact({

52 type: "MyApplication.Environment",

53 identifier: "production"

54 });

55 return signFacts(keyPair, factRecords);

56}

Long lines were clipped for display.

fix_formatter.pyView file

•path = fix_formatter.py kind = build_helper sizeBytes = 8389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

fix_formatter.pyView on unpkg

dist/indexeddb/driver.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = jinaga@6.8.4 matchedIdentity = npm:amluYWdh:6.8.4 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/indexeddb/driver.jsView on unpkg

Source & flagged code

4 flagged · loading source

test/cryptography/keyPairSpec.tsView file

46patternName = private_key_rsa severity = critical line = 46 matchedText = privateP...r\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cryptography/keyPairSpec.tsView on unpkg · L46

46patternName = private_key_rsa severity = critical line = 46 matchedText = privateP...r\n"

Critical

Secret Pattern

RSA private key in test/cryptography/keyPairSpec.ts

test/cryptography/keyPairSpec.tsView on unpkg · L46

fix_formatter.pyView file

•path = fix_formatter.py kind = build_helper sizeBytes = 8389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

fix_formatter.pyView on unpkg

dist/indexeddb/driver.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/indexeddb/driver.jsView on unpkg

Findings

2 Critical1 High2 Medium2 Low

CriticalCritical Secrettest/cryptography/keyPairSpec.ts

CriticalSecret Patterntest/cryptography/keyPairSpec.ts

HighPrevious Version Dangerous Deltadist/indexeddb/driver.js

MediumNetwork

MediumShips Build Helperfix_formatter.py

LowNon Install Lifecycle Scripts

LowScripts Present

Source & flagged code

4 flagged

test/cryptography/keyPairSpec.tsView file

Lines 26-56typescript

27 const verified = verifyEnvelopes(factEnvelopes);

29 expect(verified).toBe(true);

30 });

32 it("should not verify a signature if the content has been modified", async () => {

33 const keyPair = generateKeyPair();

34 const factEnvelopes = givenSignedFact(keyPair);

36 factEnvelopes[0].fact.fields["identifier"] = "staging";

37 const verified = verifyEnvelopes(factEnvelopes);

39 expect(verified).toBe(false);

40 });

41});

43function givenKnownKeyPair(): KeyPair {

44 return {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

test/cryptography/keyPairSpec.tsView on unpkg · L46

Critical

Secret Pattern

RSA private key in test/cryptography/keyPairSpec.ts

test/cryptography/keyPairSpec.tsView on unpkg · L46

47 };

48}

50function givenSignedFact(keyPair: KeyPair) {

51 const factRecords: FactRecord[] = dehydrateFact({

52 type: "MyApplication.Environment",

53 identifier: "production"

54 });

55 return signFacts(keyPair, factRecords);

56}

Long lines were clipped for display.

fix_formatter.pyView file

•path = fix_formatter.py kind = build_helper sizeBytes = 8389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

fix_formatter.pyView on unpkg

dist/indexeddb/driver.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/indexeddb/driver.jsView on unpkg