registry / lastlight / 0.18.5

lastlight@0.18.5

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 173 KB of source, external domains: 127.0.0.1, github.com, lastlight.example.com

Source & flagged code

4 flagged

dist/setup.jsView file

Lines 30-71javascript

30 * Returns the resolved absolute path or null if not found.

31 */

32function resolvePem(input) {

33 let expanded = input;

34 if (expanded.startsWith("~/")) {

35 expanded = join(process.env.HOME || "", expanded.slice(2));

36 }

37 const candidates = [

38 resolve(expanded),

39 resolve("..", expanded),

40 ];

41 for (const candidate of candidates) {

42 if (isPemFile(candidate))

43 return candidate;

44 }

45 return null;

46}

47export function isPemFile(filePath) {

48 try {

49 const content = readFileSync(filePath, "utf8");

50 return (content.startsWith("-----BEGIN RSA PRIVATE KEY-----") ||

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/setup.jsView on unpkg · L50

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L50

51 content.startsWith("-----BEGIN PRIVATE KEY-----"));

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L51

52 }

53 catch {

54 return false;

55 }

56}

57export function isSlackBotToken(s) {

58 return s.startsWith("xoxb-");

59}

60export function isSlackAppToken(s) {

61 return s.startsWith("xapp-");

62}

63// ── .env serialization (exported for unit tests) ────────────────────────────

64export function buildEnvContent(config) {

65 // `undefined` mode is treated as `app` for backward compatibility.

66 const mode = config.mode ?? "app";

67 const lines = [

68 "# ── Last Light — Environment Variables ─────────────────────",

69 "# Generated by: npx lastlight setup",

70 "",

71 "# ── Overlay (this deployment's private config + assets) ──",

dist/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * Last Light CLI — `lastlight`.

4 *

5 * A thin client for a running Last Light instance. It does NOT run agents

6 * itself; it POSTs triggers and reads the instance's admin API over HTTP.

7 *

8 * lastlight login [url] Authenticate (browser) + save the token

9 * lastlight <github-url|ref> Triage that issue (default — cheap)

10 * lastlight build <ref> Run the FULL build cycle

Source & flagged code

4 flagged · loading source

dist/setup.jsView file

50patternName = private_key_rsa severity = critical line = 50 matchedText = return (...) ||

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/setup.jsView on unpkg · L50

50patternName = private_key_rsa severity = critical line = 50 matchedText = return (...) ||

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L50

51patternName = private_key_rsa severity = critical line = 51 matchedText = content...."));

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L51

dist/cli.jsView file

17* `LASTLIGHT_URL`/`LASTLIGHT_TOKEN` env → `~/.lastlight/config.json` (written L18: * by `login`) → `http://localhost:8644`. L19: */ ... L25: import { fileURLToPath } from "node:url"; L26: import { spawn } from "node:child_process"; L27: import * as p from "@clack/prompts"; ... L101: /** L102: * This CLI's version, read from the bundled package.json. Resolves for both the L103: * compiled (`dist/cli.js` → `..` = package root) and dev (`src/cli.ts` → `..` = ... L109: const pkgPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"); L110: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L111: return pkg.version ?? "unknown";

Findings

3 Critical1 High3 Medium4 Low

CriticalCritical Secretdist/setup.js

CriticalSecret Patterndist/setup.js

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings