registry / oidc-spa / 10.2.6

oidc-spa@10.2.6

OpenID Connect / OAuth2 solution for client-first Web Applications

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 373 file(s), 5.55 MB of source, external domains: 127.0.0.1, docs.oidc-spa.dev, docs.tsafe.dev, dummy.com, foo.com, github.com, my-mock-oidc-server.net, peculiarventures.github.io

Source & flagged code

4 flagged

esm/vendor/server/jose.mjsView file

Lines 1188-1228javascript

1188 } catch (cause) {

1189 throw new TypeError("Failed to parse the X.509 certificate", { cause });

1190 }

1191 return fromSPKI(spki, alg, options);

1192};

1193

1194// node_modules/jose/dist/browser/key/import.js

1195async function importSPKI(spki, alg, options) {

1196 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {

1197 throw new TypeError('"spki" must be SPKI formatted string');

1198 }

1199 return fromSPKI(spki, alg, options);

1200}

1201async function importX509(x509, alg, options) {

1202 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) {

1203 throw new TypeError('"x509" must be X.509 formatted string');

1204 }

1205 return fromX509(x509, alg, options);

1206}

1207async function importPKCS8(pkcs8, alg, options) {

1208 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

esm/vendor/server/jose.mjsView on unpkg · L1208

Critical

Secret Pattern

RSA private key in esm/vendor/server/jose.mjs

esm/vendor/server/jose.mjsView on unpkg · L1208

1209 throw new TypeError('"pkcs8" must be PKCS#8 formatted string');

1210 }

1211 return fromPKCS8(pkcs8, alg, options);

1212}

1213async function importJWK(jwk, alg) {

1214 if (!isObject(jwk)) {

1215 throw new TypeError("JWK must be an object");

1216 }

1217 alg || (alg = jwk.alg);

1218 switch (jwk.kty) {

1219 case "oct":

1220 if (typeof jwk.k !== "string" || !jwk.k) {

1221 throw new TypeError('missing "k" (Key Value) Parameter value');

1222 }

1223 return decode(jwk.k);

1224 case "RSA":

1225 if (jwk.oth !== void 0) {

1226 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');

1227 }

1228 case "EC":

tools/isLikelyDevServer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.getIsLikelyDevServer = getIsLikelyDevServer;

4const isBrowser_1 = require("./isBrowser");

5let isLikelyDevServer_cache = undefined;

vendor/server/jose.jsView file

Lines 1-3javascript

1/*! For license information please see index.js.LICENSE.txt */

2(()=>{"use strict";var t={4500:function(t,e,r){var n=this&&this.__createBinding||(Object.create?function(t,e,r,n){

Source & flagged code

4 flagged · loading source

esm/vendor/server/jose.mjsView file

1208patternName = private_key_rsa severity = critical line = 1208 matchedText = if (type...0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

esm/vendor/server/jose.mjsView on unpkg · L1208

1208patternName = private_key_rsa severity = critical line = 1208 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in esm/vendor/server/jose.mjs

esm/vendor/server/jose.mjsView on unpkg · L1208

tools/isLikelyDevServer.jsView file

3exports.getIsLikelyDevServer = getIsLikelyDevServer; L4: const isBrowser_1 = require("./isBrowser"); L5: let isLikelyDevServer_cache = undefined;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/isLikelyDevServer.jsView on unpkg · L3

vendor/server/jose.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = (()=>{"u...)();

Critical

Secret Pattern

RSA private key in vendor/server/jose.js

vendor/server/jose.jsView on unpkg · L2

Findings

3 Critical5 Medium4 Low

CriticalCritical Secretesm/vendor/server/jose.mjs

CriticalSecret Patternesm/vendor/server/jose.mjs

CriticalSecret Patternvendor/server/jose.js

MediumDynamic Requiretools/isLikelyDevServer.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

esm/vendor/server/jose.mjsView file

Lines 1188-1228javascript

1188 } catch (cause) {

1189 throw new TypeError("Failed to parse the X.509 certificate", { cause });

1190 }

1191 return fromSPKI(spki, alg, options);

1192};

1193

1194// node_modules/jose/dist/browser/key/import.js

1195async function importSPKI(spki, alg, options) {

1196 if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {

1197 throw new TypeError('"spki" must be SPKI formatted string');

1198 }

1199 return fromSPKI(spki, alg, options);

1200}

1201async function importX509(x509, alg, options) {

1202 if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) {

1203 throw new TypeError('"x509" must be X.509 formatted string');

1204 }

1205 return fromX509(x509, alg, options);

1206}

1207async function importPKCS8(pkcs8, alg, options) {

1208 if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

esm/vendor/server/jose.mjsView on unpkg · L1208

Critical

Secret Pattern

RSA private key in esm/vendor/server/jose.mjs

esm/vendor/server/jose.mjsView on unpkg · L1208

1209 throw new TypeError('"pkcs8" must be PKCS#8 formatted string');

1210 }

1211 return fromPKCS8(pkcs8, alg, options);

1212}

1213async function importJWK(jwk, alg) {

1214 if (!isObject(jwk)) {

1215 throw new TypeError("JWK must be an object");

1216 }

1217 alg || (alg = jwk.alg);

1218 switch (jwk.kty) {

1219 case "oct":

1220 if (typeof jwk.k !== "string" || !jwk.k) {

1221 throw new TypeError('missing "k" (Key Value) Parameter value');

1222 }

1223 return decode(jwk.k);

1224 case "RSA":

1225 if (jwk.oth !== void 0) {

1226 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');

1227 }

1228 case "EC":

tools/isLikelyDevServer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.getIsLikelyDevServer = getIsLikelyDevServer;

4const isBrowser_1 = require("./isBrowser");

5let isLikelyDevServer_cache = undefined;

vendor/server/jose.jsView file

Lines 1-3javascript

1/*! For license information please see index.js.LICENSE.txt */

2(()=>{"use strict";var t={4500:function(t,e,r){var n=this&&this.__createBinding||(Object.create?function(t,e,r,n){