registry / latitudesh-typescript-sdk / 0.7.3

latitudesh-typescript-sdk@0.7.3

## Summary

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1,885 file(s), 6.64 MB of source, external domains: api.latitude.sh, docs.latitude.sh, get.docker.com, ipmi.example.com, latitude.sh, openvpn.net

Oversized source lightweight scan

bin/mcp-server.js3.10 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStrings

Source & flagged code

4 flagged

tests/integration/helpers/mock-data.tsView file

Lines 97-137typescript

97export const mockServerDeployConfig = {

98 id: 'deploy_config_test123',

99 type: 'deploy_config',

100 attributes: {

101 ssh_keys: ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtest'],

102 user_data: '#!/bin/bash\necho "Hello World"',

103 raid: 'raid1',

104 },

105};

106

107export const mockActionResponse = {

108 id: 'action_test123',

109 type: 'reboot',

110 status: 'pending',

111 created_at: '2024-01-01T00:00:00Z',

112};

113

114export const mockIPMISession = {

115 url: 'https://ipmi.example.com/session/test123',

116 username: 'admin',

117 password: 'test-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/integration/helpers/mock-data.tsView on unpkg · L117

118 expires_at: '2024-01-01T01:00:00Z',

119};

120

121export const mockOutOfBandConnection = {

122 url: 'wss://console.example.com/test123',

123 token: 'test-token-123',

124 expires_at: '2024-01-01T01:00:00Z',

125};

126

127// Projects - JSON:API format

128export const mockProject = {

129 id: 'proj_test123',

130 type: 'projects',

131 attributes: {

132 name: 'Test Project',

133 slug: 'test-project',

134 description: 'A test project for integration tests',

135 billing_type: 'Monthly',

136 billing_method: 'Normal',

137 cost: '0.00',

bin/mcp-server.jsView file

•path = bin/mcp-server.js kind = oversized_source_file sizeBytes = 3253414 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/mcp-server.jsView on unpkg

•path = bin/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3253414 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/mcp-server.jsView on unpkg

tests/integration/servers-advanced.test.tsView file

Lines 139-179typescript

139 userData: '#!/bin/bash\necho "Updated"',

140 },

141 },

142 });

143

144 expect(result.data?.attributes?.raid).toBe('raid5');

145 });

146 });

147

Source & flagged code

4 flagged · loading source

tests/integration/helpers/mock-data.tsView file

117patternName = generic_password severity = medium line = 117 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/integration/helpers/mock-data.tsView on unpkg · L117

bin/mcp-server.jsView file

•path = bin/mcp-server.js kind = oversized_source_file sizeBytes = 3253414 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/mcp-server.jsView on unpkg

•path = bin/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3253414 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/mcp-server.jsView on unpkg

tests/integration/servers-advanced.test.tsView file

159patternName = generic_password severity = medium line = 159 matchedText = ipmi_pas...rd',

Medium

Secret Pattern

Hardcoded password in tests/integration/servers-advanced.test.ts

tests/integration/servers-advanced.test.tsView on unpkg · L159

Findings

1 High6 Medium5 Low

HighOversized Source Filebin/mcp-server.js

MediumSecret Patterntests/integration/helpers/mock-data.ts

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointbin/mcp-server.js

MediumStructural Risk Force Deep Review

MediumSecret Patterntests/integration/servers-advanced.test.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

tests/integration/helpers/mock-data.tsView file

Lines 97-137typescript

97export const mockServerDeployConfig = {

98 id: 'deploy_config_test123',

99 type: 'deploy_config',

100 attributes: {

101 ssh_keys: ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtest'],

102 user_data: '#!/bin/bash\necho "Hello World"',

103 raid: 'raid1',

104 },

105};

106

107export const mockActionResponse = {

108 id: 'action_test123',

109 type: 'reboot',

110 status: 'pending',

111 created_at: '2024-01-01T00:00:00Z',

112};

113

114export const mockIPMISession = {

115 url: 'https://ipmi.example.com/session/test123',

116 username: 'admin',

117 password: 'test-password',

Medium

Secret Pattern

Package contains a possible secret pattern.

tests/integration/helpers/mock-data.tsView on unpkg · L117

118 expires_at: '2024-01-01T01:00:00Z',

119};

120

121export const mockOutOfBandConnection = {

122 url: 'wss://console.example.com/test123',

123 token: 'test-token-123',

124 expires_at: '2024-01-01T01:00:00Z',

125};

126

127// Projects - JSON:API format

128export const mockProject = {

129 id: 'proj_test123',

130 type: 'projects',

131 attributes: {

132 name: 'Test Project',

133 slug: 'test-project',

134 description: 'A test project for integration tests',

135 billing_type: 'Monthly',

136 billing_method: 'Normal',

137 cost: '0.00',

bin/mcp-server.jsView file

•path = bin/mcp-server.js kind = oversized_source_file sizeBytes = 3253414 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/mcp-server.jsView on unpkg

•path = bin/mcp-server.js kind = oversized_cli_entrypoint sizeBytes = 3253414 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/mcp-server.jsView on unpkg

tests/integration/servers-advanced.test.tsView file

Lines 139-179typescript

139 userData: '#!/bin/bash\necho "Updated"',

140 },

141 },

142 });

143

144 expect(result.data?.attributes?.raid).toBe('raid5');

145 });

146 });

147