registry / querysub / 0.550.0

querysub@0.550.0

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 355 file(s), 3.51 MB of source, external domains: 127.0.0.1, 65-109-93-113.querysubtest.com, 99-250-124-91.querysubtest.com, api.github.com, api.postmarkapp.com, api.sendgrid.com, cdnjs.cloudflare.com, deb.nodesource.com, docs.fish.audio, f002.backblazeb2.com, github.com, notdevtools.com, openrouter.ai, unpkg.com, www.w3.org

Source & flagged code

8 flagged

src/-a-auth/ed25519.tsView file

Lines 11-75typescript

11 data: object | string | number | boolean;

12}): Promise<Buffer> {

13 let { pem, data } = config;

14 let inputMessageStr = JSON.stringify(data);

15 let inputMessage = Buffer.from(inputMessageStr);

16 function isED25519(key: string | Buffer) {

17 return key.length < 256;

18 }

19 if (isED25519(pem)) {

20 let key = extractRawED25519PrivateKey(pem);

21 let signature = await signED25519(key, inputMessage);

22 return signature;

23 } else {

24 let key = await globalThis.crypto.subtle.importKey("spki", Buffer.from(pem as any), { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["sign"]);

25 let signatureBuffer = await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, inputMessage);

26 return Buffer.from(signatureBuffer);

27 }

28}

30export function extractRawED25519PrivateKey(pem: string | Buffer) {

31 let keyPart = pem.toString().replaceAll("-----BEGIN PRIVATE KEY-----", "").replaceAll("-----END PRIVATE KEY-----", "").replaceAll("\n", "").replaceAll("\r", "");

32 let forgeParsed = berTagParser(Buffer.from(keyPart, "base64"));

33 return forgeParsed[0].children![2].data.slice(2, 2 + 32);

34}

35function wrapWithPEM(rawED25519Key: Buffer) {

36 let forgeBase = encodeBerTags([

37 { type: tagLookup.OCTET_STRING, data: rawED25519Key, }

38 ]);

39 let forgeValue = encodeBerTags([

40 {

41 type: tagLookup.SEQUENCE,

42 children: [

43 { type: tagLookup.INTEGER, data: [0], },

44 {

45 type: tagLookup.SEQUENCE,

46 children: [

47 { type: tagLookup.OBJECT_IDENTIFIER, data: [43, 101, 112], }

48 ]

49 },

50 { type: tagLookup.OCTET_STRING, data: forgeBase, }

51 ],

52 }

53 ]);

55 return "-----BEGIN PRIVATE KEY-----\n" + forgeValue.toString("base64") + "\n-----END PRIVATE KEY-----";

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L55

56}

58export async function signED25519(privateKey: Buffer, inputMessage: Buffer): Promise<Buffer> {

59 if (privateKey.length !== 32) {

60 throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}`);

61 }

62 var pk = Buffer.alloc(32);

63 var sk = Buffer.alloc(64);

64 privateKey.copy(sk);

65 await crypto_sign_keypair(pk, sk);

67 let signedOutput = Buffer.alloc(64 + inputMessage.length);

68 await crypto_sign(signedOutput, inputMessage, sk);

69 return signedOutput.slice(0, 64);

70}

71export async function extractPublicKey(privateKey: Buffer): Promise<Buffer> {

72 if (privateKey.length !== 32) throw new Error(`Invalid private key length, expected 32, got ${privateKey.length}. Only ED25519 is presently supported`);

73 var pk = Buffer.alloc(32);

74 var sk = Buffer.alloc(64);

75 privateKey.copy(sk);

src/4-querysub/Querysub.tsView file

Lines 889-929typescript

889 if (!moduleContents) {

890 throw new Error(`ed25519 module was missing moduleContents`);

891 }

892 moduleContents = moduleContents.replace(/\/\/# sourceMappingURL=

bin/movelogs.jsView file

Lines 1-8javascript

1#!/usr/bin/env node

3process.argv.push("--nobreak");

4process.argv.push("--public");

6require("typenode");

7require("../src/diagnostics/logs/IndexedLogs/moveLogsEntry");

src/deployManager/setupMachineMain.tsView file

Lines 6-46typescript

6import os from "os";

7import readline from "readline";

8import open from "open";

9import { fsExistsAsync } from "../fs";

src/misc/lz4_wasm_nodejs_bg.wasmView file

•path = src/misc/lz4_wasm_nodejs_bg.wasm kind = wasm_module sizeBytes = 65293 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

src/misc/lz4_wasm_nodejs_bg.wasmView on unpkg

src/deployManager/machine.shView file

•path = src/deployManager/machine.sh kind = build_helper sizeBytes = 389 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/deployManager/machine.shView on unpkg

Source & flagged code

8 flagged · loading source

src/-a-auth/ed25519.tsView file

31patternName = private_key_rsa severity = critical line = 31 matchedText = let keyP..."");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/-a-auth/ed25519.tsView on unpkg · L31

31patternName = private_key_rsa severity = critical line = 31 matchedText = let keyP..."");

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L31

55patternName = private_key_rsa severity = critical line = 55 matchedText = return "...--";

Critical

Secret Pattern

RSA private key in src/-a-auth/ed25519.ts

src/-a-auth/ed25519.tsView on unpkg · L55

src/4-querysub/Querysub.tsView file

Findings

3 Critical7 Medium5 Low

CriticalCritical Secretsrc/-a-auth/ed25519.ts

CriticalSecret Patternsrc/-a-auth/ed25519.ts

MediumDynamic Requirebin/movelogs.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/deployManager/setupMachineMain.ts

MediumShips Wasm Modulesrc/misc/lz4_wasm_nodejs_bg.wasm

MediumShips Build Helpersrc/deployManager/machine.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/4-querysub/Querysub.ts

LowFilesystem

LowHigh Entropy Strings