registry / natureco-sdk / 1.1.0

natureco-sdk@1.1.0

Official JavaScript SDK for NatureCo API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 14.9 KB of source, external domains: api.natureco.me, mxnlehflfkesasclcldy.supabase.co

Source & flagged code

2 flagged

index.jsView file

Lines 325-365javascript

325 if (position) data.position = position;

326 if (welcomeMessage) data.welcome_message = welcomeMessage;

327 if (primaryColor) data.primary_color = primaryColor;

328

329 return this.client.request('PATCH', `/bots/${botId}/widget`, data);

330 }

331

332 async getSettings(botId) {

333 return this.client.request('GET', `/bots/${botId}/widget`);

334 }

335}

336

337// ════════════════════════════════════════════════════════════════════════════

338// NatureCoAuth — tek NatureCo hesabı (SSO). natureco.me Supabase Auth üstünde,

339// bağımlılıksız (Supabase REST + global fetch). CLI/terminal/portal aynı hesabı

340// paylaşır. Oturum ~/.natureco/auth.json'da saklanır (Node); tarayıcıda bellekte.

341// ════════════════════════════════════════════════════════════════════════════

342

343// natureco.me kimlik projesi — anon key PUBLIC (client'lara gömülür, gizli değil)

344const NC_SUPABASE_URL = 'https://mxnlehflfkesasclcldy.supabase.co';

345const NC_SUPABASE_ANON = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im14bmxlaGZsZmtlc2FzY2xjbGR5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzY2NDA5MzEsImV4cCI6MjA5MjIxNjkzMX0.93aPOg6bVmgFaJvsM5jVZwiX2TTuFIyAzhP6BlhBkGU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

index.jsView on unpkg · L345

Critical

Secret Pattern

Supabase service role key (JWT) in index.js

index.jsView on unpkg · L345

346

347class NatureCoAuth {

348 /**

349 * @param {object} [options]

350 * @param {string} [options.url] Supabase URL (varsayılan natureco.me)

351 * @param {string} [options.anonKey] public anon key

352 * @param {object} [options.store] { load(): session|null, save(session), clear() } — özel oturum deposu

353 */

354 constructor(options = {}) {

355 this.url = options.url || NC_SUPABASE_URL;

356 this.anonKey = options.anonKey || NC_SUPABASE_ANON;

357 this.authBase = `${this.url}/auth/v1`;

358 this.store = options.store || _defaultStore();

359 this._session = this.store.load();

360 }

361

362 async _post(path, body, accessToken) {

363 const headers = { 'apikey': this.anonKey, 'Content-Type': 'application/json' };

364 if (accessToken) headers['Authorization'] = `Bearer ${accessToken}`;

365 const res = await fetch(`${this.authBase}${path}`, { method: 'POST', headers, body: JSON.stringify(body) });

Source & flagged code

2 flagged · loading source

index.jsView file

345patternName = supabase_service_key severity = critical line = 345 matchedText = const NC...GU';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

index.jsView on unpkg · L345

345patternName = supabase_service_key severity = critical line = 345 matchedText = const NC...GU';

Critical

Secret Pattern

Supabase service role key (JWT) in index.js

index.jsView on unpkg · L345

Findings

2 Critical1 Medium4 Low

CriticalCritical Secretindex.js

CriticalSecret Patternindex.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

index.jsView file

Lines 325-365javascript

325 if (position) data.position = position;

326 if (welcomeMessage) data.welcome_message = welcomeMessage;

327 if (primaryColor) data.primary_color = primaryColor;

328

329 return this.client.request('PATCH', `/bots/${botId}/widget`, data);

330 }

331

332 async getSettings(botId) {

333 return this.client.request('GET', `/bots/${botId}/widget`);

334 }

335}

336

338// NatureCoAuth — tek NatureCo hesabı (SSO). natureco.me Supabase Auth üstünde,

339// bağımlılıksız (Supabase REST + global fetch). CLI/terminal/portal aynı hesabı

340// paylaşır. Oturum ~/.natureco/auth.json'da saklanır (Node); tarayıcıda bellekte.

342

343// natureco.me kimlik projesi — anon key PUBLIC (client'lara gömülür, gizli değil)

344const NC_SUPABASE_URL = 'https://mxnlehflfkesasclcldy.supabase.co';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

index.jsView on unpkg · L345

Critical

Secret Pattern

Supabase service role key (JWT) in index.js

index.jsView on unpkg · L345

346

347class NatureCoAuth {

348 /**

349 * @param {object} [options]

350 * @param {string} [options.url] Supabase URL (varsayılan natureco.me)

351 * @param {string} [options.anonKey] public anon key

352 * @param {object} [options.store] { load(): session|null, save(session), clear() } — özel oturum deposu

353 */

354 constructor(options = {}) {

355 this.url = options.url || NC_SUPABASE_URL;

356 this.anonKey = options.anonKey || NC_SUPABASE_ANON;

357 this.authBase = `${this.url}/auth/v1`;

358 this.store = options.store || _defaultStore();

359 this._session = this.store.load();

360 }

361

362 async _post(path, body, accessToken) {

363 const headers = { 'apikey': this.anonKey, 'Content-Type': 'application/json' };

364 if (accessToken) headers['Authorization'] = `Bearer ${accessToken}`;

365 const res = await fetch(`${this.authBase}${path}`, { method: 'POST', headers, body: JSON.stringify(body) });