registry / mindoodb / 0.0.38

mindoodb@0.0.38

End-to-End Encrypted, Local-first Sync Database

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 156 file(s), 2.09 MB of source, external domains: s1.example.com, s2.example.com, server4.example.com

Source & flagged code

4 flagged

dist/core/crypto/RSAEncryption.jsView file

Lines 35-75javascript

35 const keyData = this.base64ToUint8Array(pemContents);

36 const subtle = this.cryptoAdapter.getSubtle();

37 const cryptoKey = await subtle.importKey("spki", keyData.buffer, {

38 name: "RSA-OAEP",

39 hash: "SHA-256",

40 }, false, // not extractable

41 ["encrypt"]);

42 this.logger.debug(`Successfully imported RSA public key`);

43 return cryptoKey;

44 }

45 /**

46 * Import an RSA private key from PEM format.

47 *

48 * @param pemKey The private key in PEM format (PKCS#8)

49 * @returns The imported CryptoKey for decryption

50 */

51 async importPrivateKey(pemKey) {

52 this.logger.debug(`Importing RSA private key`);

53 // Remove PEM headers and decode base64

54 const pemContents = pemKey

55 .replace(/-----BEGIN PRIVATE KEY-----/g, "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

Critical

Secret Pattern

RSA private key in dist/core/crypto/RSAEncryption.js

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

56 .replace(/-----END PRIVATE KEY-----/g, "")

57 .replace(/\s/g, "");

58 const keyData = this.base64ToUint8Array(pemContents);

59 const subtle = this.cryptoAdapter.getSubtle();

60 const cryptoKey = await subtle.importKey("pkcs8", keyData.buffer, {

61 name: "RSA-OAEP",

62 hash: "SHA-256",

63 }, false, // not extractable

64 ["decrypt"]);

65 this.logger.debug(`Successfully imported RSA private key`);

66 return cryptoKey;

67 }

68 /**

69 * Encrypt data with an RSA public key.

70 *

71 * Note: RSA-OAEP with 3072-bit keys and SHA-256 can only encrypt

72 * up to 318 bytes directly. For larger payloads, this method uses

73 * hybrid encryption: generates a random AES key, encrypts the data

74 * with AES-GCM, then encrypts the AES key with RSA.

75 *

dist/__mocks__/expo-standard-web-crypto.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * Mock for expo-standard-web-crypto

4 * Uses Node.js crypto for getRandomValues in tests

5 */

6var __importDefault = (this && this.__importDefault) || function (mod) {

7 return (mod &&

dist/reactnative/crypto/KeyFormatConverter.jsView file

Lines 20-60javascript

20 // Decode base64

21 const binary = atob(pemContents);

22 const bytes = new Uint8Array(binary.length);

23 for (let i = 0; i <

Source & flagged code

4 flagged · loading source

dist/core/crypto/RSAEncryption.jsView file

55patternName = private_key_rsa severity = critical line = 55 matchedText = .replace... "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

55patternName = private_key_rsa severity = critical line = 55 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in dist/core/crypto/RSAEncryption.js

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

dist/__mocks__/expo-standard-web-crypto.jsView file

10exports.getRandomValues = getRandomValues; L11: const crypto_1 = __importDefault(require("crypto")); L12: // Export getRandomValues directly for CommonJS compatibility

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/__mocks__/expo-standard-web-crypto.jsView on unpkg · L10

dist/reactnative/crypto/KeyFormatConverter.jsView file

40patternName = private_key_rsa severity = critical line = 40 matchedText = : "-----...--";

Critical

Secret Pattern

RSA private key in dist/reactnative/crypto/KeyFormatConverter.js

dist/reactnative/crypto/KeyFormatConverter.jsView on unpkg · L40

Findings

3 Critical3 Medium4 Low

CriticalCritical Secretdist/core/crypto/RSAEncryption.js

CriticalSecret Patterndist/core/crypto/RSAEncryption.js

CriticalSecret Patterndist/reactnative/crypto/KeyFormatConverter.js

MediumDynamic Requiredist/__mocks__/expo-standard-web-crypto.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/core/crypto/RSAEncryption.jsView file

Lines 35-75javascript

35 const keyData = this.base64ToUint8Array(pemContents);

36 const subtle = this.cryptoAdapter.getSubtle();

37 const cryptoKey = await subtle.importKey("spki", keyData.buffer, {

38 name: "RSA-OAEP",

39 hash: "SHA-256",

40 }, false, // not extractable

41 ["encrypt"]);

42 this.logger.debug(`Successfully imported RSA public key`);

43 return cryptoKey;

44 }

45 /**

46 * Import an RSA private key from PEM format.

47 *

48 * @param pemKey The private key in PEM format (PKCS#8)

49 * @returns The imported CryptoKey for decryption

50 */

51 async importPrivateKey(pemKey) {

52 this.logger.debug(`Importing RSA private key`);

53 // Remove PEM headers and decode base64

54 const pemContents = pemKey

55 .replace(/-----BEGIN PRIVATE KEY-----/g, "")

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

Critical

Secret Pattern

RSA private key in dist/core/crypto/RSAEncryption.js

dist/core/crypto/RSAEncryption.jsView on unpkg · L55

56 .replace(/-----END PRIVATE KEY-----/g, "")

57 .replace(/\s/g, "");

58 const keyData = this.base64ToUint8Array(pemContents);

59 const subtle = this.cryptoAdapter.getSubtle();

60 const cryptoKey = await subtle.importKey("pkcs8", keyData.buffer, {

61 name: "RSA-OAEP",

62 hash: "SHA-256",

63 }, false, // not extractable

64 ["decrypt"]);

65 this.logger.debug(`Successfully imported RSA private key`);

66 return cryptoKey;

67 }

68 /**

69 * Encrypt data with an RSA public key.

70 *

71 * Note: RSA-OAEP with 3072-bit keys and SHA-256 can only encrypt

72 * up to 318 bytes directly. For larger payloads, this method uses

73 * hybrid encryption: generates a random AES key, encrypts the data

74 * with AES-GCM, then encrypts the AES key with RSA.

75 *

dist/__mocks__/expo-standard-web-crypto.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * Mock for expo-standard-web-crypto

4 * Uses Node.js crypto for getRandomValues in tests

5 */

6var __importDefault = (this && this.__importDefault) || function (mod) {

7 return (mod &&

dist/reactnative/crypto/KeyFormatConverter.jsView file

Lines 20-60javascript

20 // Decode base64

21 const binary = atob(pemContents);

22 const bytes = new Uint8Array(binary.length);

23 for (let i = 0; i <