registry / querysub / 0.492.0

querysub@0.492.0

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 335 file(s), 3.22 MB of source, external domains: 127.0.0.1, api.backblazeb2.com, api.cloudflare.com, api.github.com, api.postmarkapp.com, api.sendgrid.com, deb.nodesource.com, docs.fish.audio, github.com, notdevtools.com, openrouter.ai, unpkg.com, www.w3.org

Source & flagged code

9 flagged

src/-a-auth/ed25519.tsView file

Lines 11-75typescript

11 data: object | string | number | boolean;

12}): Promise<Buffer> {

13 let { pem, data } = config;

14 let inputMessageStr = JSON.stringify(data);

15 let inputMessage = Buffer.from(inputMessageStr);

16 function isED25519(key: string | Buffer) {

17 return key.length < 256;

18 }

19 if (isED25519(pem)) {

20 let key = extractRawED25519PrivateKey(pem);

21 let signature = await signED25519(key, inputMessage);

22 return signature;

23 } else {

24 let key = await globalThis.crypto.subtle.importKey("spki", Buffer.from(pem as any), { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["sign"]);

25 let signatureBuffer = await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, inputMessage);

26 return Buffer.from(signatureBuffer);

27 }

28}

30export function extractRawED25519PrivateKey(pem: string | Buffer) {

31 let keyPart = pem.toString().replaceAll("-----BEGIN PRIVATE KEY-----", "").replaceAll("-----END PRIVATE KEY-----", "").replaceAll("\n", "").replaceAll("\r", "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/-a-auth/ed25519.tsView on unpkg · L31

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L31

32 let forgeParsed = berTagParser(Buffer.from(keyPart, "base64"));

33 return forgeParsed[0].children![2].data.slice(2, 2 + 32);

34}

35function wrapWithPEM(rawED25519Key: Buffer) {

36 let forgeBase = encodeBerTags([

37 { type: tagLookup.OCTET_STRING, data: rawED25519Key, }

38 ]);

39 let forgeValue = encodeBerTags([

40 {

41 type: tagLookup.SEQUENCE,

42 children: [

43 { type: tagLookup.INTEGER, data: [0], },

44 {

45 type: tagLookup.SEQUENCE,

46 children: [

47 { type: tagLookup.OBJECT_IDENTIFIER, data: [43, 101, 112], }

48 ]

49 },

50 { type: tagLookup.OCTET_STRING, data: forgeBase, }

51 ],

52 }

53 ]);

55 return "-----BEGIN PRIVATE KEY-----\n" + forgeValue.toString("base64") + "\n-----END PRIVATE KEY-----";

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L55

56}

58export async function signED25519(privateKey: Buffer, inputMessage: Buffer): Promise<Buffer> {

59 if (privateKey.length !== 32) {

60 throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}`);

61 }

62 var pk = Buffer.alloc(32);

63 var sk = Buffer.alloc(64);

64 privateKey.copy(sk);

65 await crypto_sign_keypair(pk, sk);

67 let signedOutput = Buffer.alloc(64 + inputMessage.length);

68 await crypto_sign(signedOutput, inputMessage, sk);

69 return signedOutput.slice(0, 64);

70}

71export async function extractPublicKey(privateKey: Buffer): Promise<Buffer> {

72 if (privateKey.length !== 32) throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}. Only ED25519 is presently supported`);

73 var pk = Buffer.alloc(32);

74 var sk = Buffer.alloc(64);

75 privateKey.copy(sk);

src/4-querysub/Querysub.tsView file

Lines 878-918typescript

878 if (!moduleContents) {

879 throw new Error(`ed25519 module was missing moduleContents`);

880 }

881 moduleContents = moduleContents.replace(/\/\/# sourceMappingURL=.*\n/g, "");

882

bin/movelogs.jsView file

Lines 1-8javascript

1#!/usr/bin/env node

3process.argv.push("--nobreak");

4process.argv.push("--public");

6require("typenode");

7require("../src/diagnostics/logs/IndexedLogs/moveLogsEntry");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/movelogs.jsView on unpkg · L5

src/deployManager/setupMachineMain.tsView file

Lines 6-46typescript

6import os from "os";

7import readline from "readline";

8import open from "open";

9import { fsExistsAsync } from "../fs";

10// Import querysub, to fix missing dependencies

11Querysub;

src/misc/lz4_wasm_nodejs_bg.wasmView file

•path = src/misc/lz4_wasm_nodejs_bg.wasm kind = wasm_module sizeBytes = 65293 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/misc/lz4_wasm_nodejs_bg.wasmView on unpkg

src/deployManager/machine.shView file

•path = src/deployManager/machine.sh kind = build_helper sizeBytes = 389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/deployManager/machine.shView on unpkg

Source & flagged code

9 flagged · loading source

src/-a-auth/ed25519.tsView file

31patternName = private_key_rsa severity = critical line = 31 matchedText = let keyP..."");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/-a-auth/ed25519.tsView on unpkg · L31

31patternName = private_key_rsa severity = critical line = 31 matchedText = let keyP..."");

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L31

55patternName = private_key_rsa severity = critical line = 55 matchedText = return "...--";

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L55

src/4-querysub/Querysub.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = querysub@0.491.0 matchedIdentity = npm:cXVlcnlzdWI:0.491.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/4-querysub/Querysub.tsView on unpkg

898let fnc = `(function ed25519(exports, require, module, __filename, __dirname, importDynamic) {${moduleContents}\n })`; L899: eval(fnc)(exports, require, module, "inlined", "inlined", require); L900:

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/4-querysub/Querysub.tsView on unpkg · L898

bin/movelogs.jsView file

5L6: require("typenode"); L7: require("../[redacted]");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/movelogs.jsView on unpkg · L5

src/deployManager/setupMachineMain.tsView file

26} L27: return os.homedir() + `/githubkey_${repoOwner}_${repoName}.json`; L28: } ... L30: async function verifyGitHubApiKey(apiKey: string): Promise<boolean> { L31: const response = await fetch("https://api.github.com/user", { L32: headers: { ... L62: try { L63: const cached = JSON.parse(fs.readFileSync(cacheFile, "utf8")); L64: if (cached.apiKey) { ... L76: // Need to get a new API key from user L77: console.log("\n🔑 GitHub API key required for private repository access"); L78: console.log("Opening GitHub token creation page...");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/deployManager/setupMachineMain.tsView on unpkg · L26

src/misc/lz4_wasm_nodejs_bg.wasmView file

•path = src/misc/lz4_wasm_nodejs_bg.wasm kind = wasm_module sizeBytes = 65293 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/misc/lz4_wasm_nodejs_bg.wasmView on unpkg

src/deployManager/machine.shView file

•path = src/deployManager/machine.sh kind = build_helper sizeBytes = 389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/deployManager/machine.shView on unpkg

Findings

3 Critical1 High7 Medium5 Low

CriticalCritical Secretsrc/-a-auth/ed25519.ts

CriticalSecret Patternsrc/-a-auth/ed25519.ts

HighPrevious Version Dangerous Deltasrc/4-querysub/Querysub.ts

MediumDynamic Requirebin/movelogs.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/deployManager/setupMachineMain.ts

MediumShips Wasm Modulesrc/misc/lz4_wasm_nodejs_bg.wasm

MediumShips Build Helpersrc/deployManager/machine.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/4-querysub/Querysub.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

src/-a-auth/ed25519.tsView file

Lines 11-75typescript

11 data: object | string | number | boolean;

12}): Promise<Buffer> {

13 let { pem, data } = config;

14 let inputMessageStr = JSON.stringify(data);

15 let inputMessage = Buffer.from(inputMessageStr);

16 function isED25519(key: string | Buffer) {

17 return key.length < 256;

18 }

19 if (isED25519(pem)) {

20 let key = extractRawED25519PrivateKey(pem);

21 let signature = await signED25519(key, inputMessage);

22 return signature;

23 } else {

24 let key = await globalThis.crypto.subtle.importKey("spki", Buffer.from(pem as any), { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["sign"]);

25 let signatureBuffer = await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, inputMessage);

26 return Buffer.from(signatureBuffer);

27 }

28}

30export function extractRawED25519PrivateKey(pem: string | Buffer) {

31 let keyPart = pem.toString().replaceAll("-----BEGIN PRIVATE KEY-----", "").replaceAll("-----END PRIVATE KEY-----", "").replaceAll("\n", "").replaceAll("\r", "");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/-a-auth/ed25519.tsView on unpkg · L31

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L31

32 let forgeParsed = berTagParser(Buffer.from(keyPart, "base64"));

33 return forgeParsed[0].children![2].data.slice(2, 2 + 32);

34}

35function wrapWithPEM(rawED25519Key: Buffer) {

36 let forgeBase = encodeBerTags([

37 { type: tagLookup.OCTET_STRING, data: rawED25519Key, }

38 ]);

39 let forgeValue = encodeBerTags([

40 {

41 type: tagLookup.SEQUENCE,

42 children: [

43 { type: tagLookup.INTEGER, data: [0], },

44 {

45 type: tagLookup.SEQUENCE,

46 children: [

47 { type: tagLookup.OBJECT_IDENTIFIER, data: [43, 101, 112], }

48 ]

49 },

50 { type: tagLookup.OCTET_STRING, data: forgeBase, }

51 ],

52 }

53 ]);

55 return "-----BEGIN PRIVATE KEY-----\n" + forgeValue.toString("base64") + "\n-----END PRIVATE KEY-----";

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L55

56}

58export async function signED25519(privateKey: Buffer, inputMessage: Buffer): Promise<Buffer> {

59 if (privateKey.length !== 32) {

60 throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}`);

61 }

62 var pk = Buffer.alloc(32);

63 var sk = Buffer.alloc(64);

64 privateKey.copy(sk);

65 await crypto_sign_keypair(pk, sk);

67 let signedOutput = Buffer.alloc(64 + inputMessage.length);

68 await crypto_sign(signedOutput, inputMessage, sk);

69 return signedOutput.slice(0, 64);

70}

71export async function extractPublicKey(privateKey: Buffer): Promise<Buffer> {

72 if (privateKey.length !== 32) throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}. Only ED25519 is presently supported`);

73 var pk = Buffer.alloc(32);

74 var sk = Buffer.alloc(64);

75 privateKey.copy(sk);

src/4-querysub/Querysub.tsView file

Lines 878-918typescript

878 if (!moduleContents) {

879 throw new Error(`ed25519 module was missing moduleContents`);

880 }

881 moduleContents = moduleContents.replace(/\/\/# sourceMappingURL=.*\n/g, "");

882

bin/movelogs.jsView file

Lines 1-8javascript

1#!/usr/bin/env node

3process.argv.push("--nobreak");

4process.argv.push("--public");

6require("typenode");

7require("../src/diagnostics/logs/IndexedLogs/moveLogsEntry");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/movelogs.jsView on unpkg · L5

src/deployManager/setupMachineMain.tsView file

Lines 6-46typescript

6import os from "os";

7import readline from "readline";

8import open from "open";

9import { fsExistsAsync } from "../fs";

10// Import querysub, to fix missing dependencies

11Querysub;

src/misc/lz4_wasm_nodejs_bg.wasmView file

•path = src/misc/lz4_wasm_nodejs_bg.wasm kind = wasm_module sizeBytes = 65293 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/misc/lz4_wasm_nodejs_bg.wasmView on unpkg

src/deployManager/machine.shView file

•path = src/deployManager/machine.sh kind = build_helper sizeBytes = 389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/deployManager/machine.shView on unpkg