registry / orbitchat / 3.11.3

orbitchat@3.11.3

A standalone chat application for ORBIT that can be installed as an npm package and run as a CLI tool. All API communication is routed through a built-in Express proxy that maps adapter names to backend API keys, so **no secrets ever reach the browser**.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 72 file(s), 6.22 MB of source, external domains: 169.254.169.254, auth0.com, bit.ly, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, login.microsoftonline.com, openjsf.org, paulrosen.github.io, react.dev, redux-toolkit.js.org, redux.js.org, schemas.microsoft.com, schemas.openxmlformats.org, stuk.github.io, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

9 flagged

dist/assets/vendor-auth-aD_bwYde.jsView file

Lines 1-6javascript

1import{r as L,R as Sl}from"./vendor-react-BbEy7z12.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(t,n){for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(t[o]=n[o])},gs(r,e)};function tp(r,e){if(typeof e!="function"&&e!==null)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");gs(r,e);function t(){this.constructor=r}r.prototype=e===null?Object.create(e):(t.prototype=e.prototype,new t)}var le=function(){return le=Object.assign||function(e){for(var t,n=1,o=arguments.length; ...

2In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function op(r){return function(){return new Sr(r.apply(this,arguments))}}function Sr(r){var e,t;function n(i,s){try{var a=r[i](s),c=a.value,l=c instanceof El;Promise.resolve(l?c.v:c).then(function(h){if(l){var d=i==="return"&&c.k?i:"next";if(!c.k||h.done)return n(d,h);h=r[d](h).value}o(!!a.done,h)},function(h){n("throw",h)})}catch(h){o(2,h)}}function o(i,s){i===2?e.reject(s):e.resolve({value:s,done:i}),(e=e.next)?n(e.key,e.arg):t=null}this._invoke=function(i,s){return new Promise(function(a,c){var l={key:i ...

3`,10)+1,s=o.substring(i)+(n?"//# sourceMappingURL="+n:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}var zc,Wc,Jc,Li,Up=(zc="Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJd ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L3

4 auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.

5 `)})(),this.lockManager=(Ui||(Ui=up()),Ui),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||Dc,!Gc(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=Gc(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:ms,this.cookieStorage=e.legacySameSiteCookie===!1?Mn:Np,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieNam ...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L1

Long lines were clipped for display.

dist/assets/docx-preview-DehBmhog.jsView file

Lines 1-31javascript

1import{c as Rt,g as _e}from"./vendor-react-BbEy7z12.js";function Mt(c){throw new Error('Could not dynamically require "'+c+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}var Lt={exports:{}};/*!

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

dist/assets/vendor-syntax-INF7-xC_.jsView file

12* @public L13: */var a=(function(r){var n=/(?:^|\s)lang(?:uage)?-([\w-]+)(?=\s|$)/i,i=0,o={},s={manual:r.Prism&&r.Prism.manual,disableWorkerMessageHandler:r.Prism&&r.Prism.disableWorkerMessageHan... L14: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-syntax-INF7-xC_.jsView on unpkg · L12

bin/orbitchat.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * ORBIT Chat CLI

4 *

5 * Serves the orbitchat as a standalone application with runtime configuration.

6 * Configuration is read from orbitchat.yaml.

7 * Secrets come from VITE_ADAPTER_KEYS / ORBIT_ADAPTER_KEYS env var.

8 */

10import express from 'express';

11import fs from

orbitchat.shView file

•path = orbitchat.sh kind = build_helper sizeBytes = 11860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

orbitchat.shView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

Lines 1-37json

2 "name": "orbitchat",

3 "private": false,

4 "version": "3.11.3",

5 "type": "module",

6 "bin": {

7 "orbitchat": "./bin/orbitchat.js",

Source & flagged code

9 flagged · loading source

dist/assets/vendor-auth-aD_bwYde.jsView file

3patternName = private_key_rsa severity = critical line = 3 matchedText = `,10)+1,...or(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L3

3patternName = private_key_rsa severity = critical line = 3 matchedText = `,10)+1,...or(`

Critical

Secret Pattern

RSA private key in dist/assets/vendor-auth-aD_bwYde.js

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L3

1import{r as L,R as Sl}from"./vendor-react-BbEy7z12.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(... L2: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function op(r){return function(){return new Sr(r.apply(this,arguments))}}function Sr(r){var... L3: `,10)+1,s=o.substring(i)+(n?"//# sourceMappingURL="+n:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}var zc,Wc,Jc,Li,Up=(zc="Lyogcm9sbHVwLXBsdWdp... L4: auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information. L5: `)})(),this.lockManager=(Ui||(Ui=up()),Ui),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ig...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L1

dist/assets/docx-preview-DehBmhog.jsView file

11*/var qt;function we(){return qt||(qt=1,(function(c,e){(function(t){c.exports=t()})(function(){return(function t(r,n,a){function o(y,w){if(!n[y]){if(!r[y]){var _=typeof Mt=="functi... L12: \0`,q+=a(R,2),q+=D.magic,q+=a(x,2),q+=a(A,2),q+=a(tt.crc32,4),q+=a(tt.compressedSize,4),q+=a(tt.uncompressedSize,4),q+=a(W.length,2),q+=a(L.length,2),{fileRecord:_.LOCAL_FILE_HEADE... L13: * @license

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/docx-preview-DehBmhog.jsView on unpkg · L11

dist/assets/vendor-syntax-INF7-xC_.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-syntax-INF7-xC_.jsView on unpkg · L12

bin/orbitchat.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: import path from 'path'; L13: import { execFileSync } from 'child_process'; L14: import { fileURLToPath } from 'url'; L15: import { dirname } from 'path'; L16: import { createProxyMiddleware } from 'http-proxy-middleware'; L17: import yaml from 'js-yaml'; ... L20: const __filename = fileURLToPath(import.meta.url); L21: const __dirname = dirname(__filename); L22: ... L24: try { L25: const pkgPath = path.join(__dirname, '..', 'package.json'); L26: const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/orbitchat.jsView on unpkg · L12

orbitchat.shView file

•path = orbitchat.sh kind = build_helper sizeBytes = 11860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

orbitchat.shView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

2 Critical4 High6 Medium9 Low

CriticalCritical Secretdist/assets/vendor-auth-aD_bwYde.js

CriticalSecret Patterndist/assets/vendor-auth-aD_bwYde.js

HighEntrypoint Build Divergencebin/orbitchat.js

HighCloud Metadata Accessdist/assets/vendor-auth-aD_bwYde.js

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requiredist/assets/vendor-syntax-INF7-xC_.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperorbitchat.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/docx-preview-DehBmhog.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

dist/assets/vendor-auth-aD_bwYde.jsView file

Lines 1-6javascript

1import{r as L,R as Sl}from"./vendor-react-BbEy7z12.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(t,n){for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(t[o]=n[o])},gs(r,e)};function tp(r,e){if(typeof e!="function"&&e!==null)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");gs(r,e);function t(){this.constructor=r}r.prototype=e===null?Object.create(e):(t.prototype=e.prototype,new t)}var le=function(){return le=Object.assign||function(e){for(var t,n=1,o=arguments.length; ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L3

4 auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L1

Long lines were clipped for display.

dist/assets/docx-preview-DehBmhog.jsView file

Lines 1-31javascript

3JSZip v3.10.1 - A JavaScript class for generating and reading zip files

dist/assets/vendor-syntax-INF7-xC_.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-syntax-INF7-xC_.jsView on unpkg · L12

bin/orbitchat.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * ORBIT Chat CLI

4 *

5 * Serves the orbitchat as a standalone application with runtime configuration.

6 * Configuration is read from orbitchat.yaml.

7 * Secrets come from VITE_ADAPTER_KEYS / ORBIT_ADAPTER_KEYS env var.

8 */

10import express from 'express';

11import fs from

orbitchat.shView file

•path = orbitchat.sh kind = build_helper sizeBytes = 11860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

orbitchat.shView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

Lines 1-37json

2 "name": "orbitchat",

3 "private": false,

4 "version": "3.11.3",

5 "type": "module",

6 "bin": {

7 "orbitchat": "./bin/orbitchat.js",