registry / midway-fatcms / 0.0.19

midway-fatcms@0.0.19

This is a midway component sample

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 436 file(s), 2.14 MB of source, external domains: 127.0.0.1, at.alicdn.com, cdnjsx.oss-cn-shanghai.aliyuncs.com, i.alicdn.com, img.alicdn.com

Source & flagged code

6 flagged

dist/libs/utils/AsymmetricCrypto.jsView file

Lines 180-220javascript

180 return 318; // 3072位：318字节

181 }

182 else { // 4096位

183 return 446; // 4096位：446字节

184 }

185 }

186 /**

187 * 将DER格式转换为PEM格式字符串

188 * @param {ArrayBuffer} der - DER格式的密钥数据

189 * @param {string} type - 密钥类型 ('PUBLIC' 或 'PRIVATE')

190 * @returns {string} PEM格式的密钥字符串

191 */

192 static derToPem(der, type) {

193 const base64 = this.arrayBufferToBase64(der);

194 // 将Base64字符串分割为64字符一行

195 const wrapped = base64.match(/.{1,64}/g).join('\n');

196 if (type === 'PUBLIC') {

197 return `-----BEGIN PUBLIC KEY-----\n${wrapped}\n-----END PUBLIC KEY-----`;

198 }

199 else {

200 return `-----BEGIN PRIVATE KEY-----\n${wrapped}\n-----END PRIVATE KEY-----`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

Critical

Secret Pattern

RSA private key in dist/libs/utils/AsymmetricCrypto.js

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

201 }

202 }

203 /**

204 * 将PEM格式字符串转换为DER格式

205 * @param {string} pem - PEM格式的密钥字符串

206 * @returns {ArrayBuffer} DER格式的密钥数据

207 */

208 static pemToDer(pem) {

209 // 移除PEM头部、尾部和所有空白字符

210 const base64 = pem

211 .replace(/-----BEGIN (?:PUBLIC|PRIVATE) KEY-----/, '')

212 .replace(/-----END (?:PUBLIC|PRIVATE) KEY-----/, '')

213 .replace(/\s+/g, '');

214 return this.base64ToArrayBuffer(base64);

215 }

216 /**

217 * ArrayBuffer转Base64字符串

218 * @param {ArrayBuffer} buffer

219 * @returns {string}

220 */

Lines 232-262javascript

232 * @returns {ArrayBuffer}

233 */

234 static base64ToArrayBuffer(base64) {

235 const binaryString = atob(base64);

236 const bytes = new Uint8Array(binaryString.length);

237 for (let i

dist/service/anyapi/AnyApiSandboxService.jsView file

Lines 1-37javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c <

src/libs/utils/AsymmetricCrypto.tsView file

Lines 217-257typescript

217 return 446; // 4096位：446字节

218 }

219 }

220

221 /**

222 * 将DER格式转换为PEM格式字符串

223 * @param {ArrayBuffer} der - DER格式的密钥数据

224 * @param {string} type

Source & flagged code

6 flagged · loading source

dist/libs/utils/AsymmetricCrypto.jsView file

200patternName = private_key_rsa severity = critical line = 200 matchedText = return `...--`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

200patternName = private_key_rsa severity = critical line = 200 matchedText = return `...--`;

Critical

Secret Pattern

RSA private key in dist/libs/utils/AsymmetricCrypto.js

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

252patternName = private_key_rsa severity = critical line = 252 matchedText = const pr...-$/;

Critical

Secret Pattern

RSA private key in dist/libs/utils/AsymmetricCrypto.js

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L252

dist/service/anyapi/AnyApiSandboxService.jsView file

17const CurdMixService_1 = require("../curd/CurdMixService"); L18: const axios_1 = require("axios"); L19: const _ = require("lodash"); ... L60: publicOSSService: this.getPublicOSSService(), L61: privateOSSService: this.getPrivateOSSService(), L62: returnSuccess: resolve, ... L66: versions: proc.versions, L67: env: process.env, L68: argv: process.argv, L69: cwd: process.cwd(), L70: },

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/service/anyapi/AnyApiSandboxService.jsView on unpkg · L17

src/libs/utils/AsymmetricCrypto.tsView file

237patternName = private_key_rsa severity = critical line = 237 matchedText = return `...--`;

Critical

Secret Pattern

RSA private key in src/libs/utils/AsymmetricCrypto.ts

src/libs/utils/AsymmetricCrypto.tsView on unpkg · L237

294patternName = private_key_rsa severity = critical line = 294 matchedText = const pr...-$/;

Critical

Secret Pattern

RSA private key in src/libs/utils/AsymmetricCrypto.ts

src/libs/utils/AsymmetricCrypto.tsView on unpkg · L294

Findings

5 Critical3 Medium4 Low

CriticalCritical Secretdist/libs/utils/AsymmetricCrypto.js

CriticalSecret Patterndist/libs/utils/AsymmetricCrypto.js

CriticalSecret Patternsrc/libs/utils/AsymmetricCrypto.ts

MediumUnsafe Vm Contextdist/service/anyapi/AnyApiSandboxService.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/libs/utils/AsymmetricCrypto.jsView file

Lines 180-220javascript

180 return 318; // 3072位：318字节

181 }

182 else { // 4096位

183 return 446; // 4096位：446字节

184 }

185 }

186 /**

187 * 将DER格式转换为PEM格式字符串

188 * @param {ArrayBuffer} der - DER格式的密钥数据

189 * @param {string} type - 密钥类型 ('PUBLIC' 或 'PRIVATE')

190 * @returns {string} PEM格式的密钥字符串

191 */

192 static derToPem(der, type) {

193 const base64 = this.arrayBufferToBase64(der);

194 // 将Base64字符串分割为64字符一行

195 const wrapped = base64.match(/.{1,64}/g).join('\n');

196 if (type === 'PUBLIC') {

197 return `-----BEGIN PUBLIC KEY-----\n${wrapped}\n-----END PUBLIC KEY-----`;

198 }

199 else {

200 return `-----BEGIN PRIVATE KEY-----\n${wrapped}\n-----END PRIVATE KEY-----`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

Critical

Secret Pattern

RSA private key in dist/libs/utils/AsymmetricCrypto.js

dist/libs/utils/AsymmetricCrypto.jsView on unpkg · L200

201 }

202 }

203 /**

204 * 将PEM格式字符串转换为DER格式

205 * @param {string} pem - PEM格式的密钥字符串

206 * @returns {ArrayBuffer} DER格式的密钥数据

207 */

208 static pemToDer(pem) {

209 // 移除PEM头部、尾部和所有空白字符

210 const base64 = pem

211 .replace(/-----BEGIN (?:PUBLIC|PRIVATE) KEY-----/, '')

212 .replace(/-----END (?:PUBLIC|PRIVATE) KEY-----/, '')

213 .replace(/\s+/g, '');

214 return this.base64ToArrayBuffer(base64);

215 }

216 /**

217 * ArrayBuffer转Base64字符串

218 * @param {ArrayBuffer} buffer

219 * @returns {string}

220 */

Lines 232-262javascript

232 * @returns {ArrayBuffer}

233 */

234 static base64ToArrayBuffer(base64) {

235 const binaryString = atob(base64);

236 const bytes = new Uint8Array(binaryString.length);

237 for (let i

dist/service/anyapi/AnyApiSandboxService.jsView file

Lines 1-37javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c <

src/libs/utils/AsymmetricCrypto.tsView file

Lines 217-257typescript

217 return 446; // 4096位：446字节

218 }

219 }

220

221 /**

222 * 将DER格式转换为PEM格式字符串

223 * @param {ArrayBuffer} der - DER格式的密钥数据

224 * @param {string} type