orstrum: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

4 flagged

dist/lib/cloud.jsView file

Lines 1-26javascript

1import crypto from "node:crypto";

2// Public Supabase project values — safe to ship (anon key is intentionally public; RLS protects data).

3// Override with env vars to point at a local / staging Supabase instance.

4export const SUPABASE_URL = process.env.ORSTRUM_SUPABASE_URL ?? "https://dvjgftxnnppvieivoaig.supabase.co";

5export const SUPABASE_ANON_KEY = process.env.ORSTRUM_SUPABASE_ANON_KEY ??

6 "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImR2amdmdHhubnBwdmllaXZvYWlnIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzk3NDMzMDMsImV4cCI6MjA5NTMxOTMwM30.bh-kUtwDxTwEZ_JJVkgSM6Mq1sVlUmbh_D58RR5aBLo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/cloud.jsView on unpkg · L6

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lib/cloud.js

dist/lib/cloud.jsView on unpkg · L6

7// The deployed web app. Auth flows redirect here (never to localhost) so the

8// browser-visible login pages are branded and the Supabase redirect-URL

9// allow-list only ever needs our own domain. Override for local/staging web.

10export const ORSTRUM_WEB_URL = process.env.ORSTRUM_WEB_URL ?? "https://www.orstrum.com";

11// Hosted page that OAuth redirects to after GitHub auth. It reads the `?code`

12// Supabase appends and displays it for the user to paste back into `orstrum

13// login`. The PKCE verifier never leaves the CLI, so a displayed code alone

14// cannot be exchanged by anyone else.

15export const CLI_AUTH_REDIRECT = `${ORSTRUM_WEB_URL}/cli-auth`;

16export function generatePkce() {

17 const verifier = crypto.randomBytes(32).toString("base64url");

18 const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");

19 return { verifier, challenge };

20}

21export function buildOAuthUrl(redirectTo, codeChallenge) {

22 const params = new URLSearchParams({

23 provider: "github",

24 redirect_to: redirectTo,

25 code_challenge: codeChallenge,

26 code_challenge_method: "S256",

dist/config.jsView file

Lines 9-49javascript

9 return p;

10}

11const CONFIG_FILENAMES = ["orstrum.config.ts", "orstrum.config.js", "orstrum.config.json"];

12export function findConfig(cwd) {

dist/parsers/tree-sitter-python.wasmView file

•path = dist/parsers/tree-sitter-python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parsers/tree-sitter-python.wasmView on unpkg

Source & flagged code

4 flagged · loading source

dist/lib/cloud.jsView file

6patternName = supabase_service_key severity = critical line = 6 matchedText = "eyJhbGc...Lo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/cloud.jsView on unpkg · L6

6patternName = supabase_service_key severity = critical line = 6 matchedText = "eyJhbGc...Lo";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lib/cloud.js

dist/lib/cloud.jsView on unpkg · L6

dist/config.jsView file

29if (ext === ".json") { L30: const { readFile } = await import("node:fs/promises"); L31: raw = JSON.parse(await readFile(configPath, "utf8"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L29

orstrum: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

dist/lib/cloud.jsView file

Lines 1-26javascript

1import crypto from "node:crypto";

2// Public Supabase project values — safe to ship (anon key is intentionally public; RLS protects data).

3// Override with env vars to point at a local / staging Supabase instance.

4export const SUPABASE_URL = process.env.ORSTRUM_SUPABASE_URL ?? "https://dvjgftxnnppvieivoaig.supabase.co";

5export const SUPABASE_ANON_KEY = process.env.ORSTRUM_SUPABASE_ANON_KEY ??

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib/cloud.jsView on unpkg · L6

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lib/cloud.js

dist/lib/cloud.jsView on unpkg · L6

7// The deployed web app. Auth flows redirect here (never to localhost) so the

8// browser-visible login pages are branded and the Supabase redirect-URL

9// allow-list only ever needs our own domain. Override for local/staging web.

10export const ORSTRUM_WEB_URL = process.env.ORSTRUM_WEB_URL ?? "https://www.orstrum.com";

11// Hosted page that OAuth redirects to after GitHub auth. It reads the `?code`

12// Supabase appends and displays it for the user to paste back into `orstrum

13// login`. The PKCE verifier never leaves the CLI, so a displayed code alone

14// cannot be exchanged by anyone else.

15export const CLI_AUTH_REDIRECT = `${ORSTRUM_WEB_URL}/cli-auth`;

16export function generatePkce() {

17 const verifier = crypto.randomBytes(32).toString("base64url");

18 const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");

19 return { verifier, challenge };

20}

21export function buildOAuthUrl(redirectTo, codeChallenge) {

22 const params = new URLSearchParams({

23 provider: "github",

24 redirect_to: redirectTo,

25 code_challenge: codeChallenge,

26 code_challenge_method: "S256",

dist/config.jsView file

Lines 9-49javascript

9 return p;

10}

11const CONFIG_FILENAMES = ["orstrum.config.ts", "orstrum.config.js", "orstrum.config.json"];

12export function findConfig(cwd) {

dist/parsers/tree-sitter-python.wasmView file

•path = dist/parsers/tree-sitter-python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parsers/tree-sitter-python.wasmView on unpkg

orstrum@0.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code