scope-kanban: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

scope-kanban: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

src/realtime/bus.jsView file

20* Postgres backend ships it as the NOTIFY payload. The canonical payload for L21: * Scope is a pointer — `{ tenant, cursor }` — NOT the event body: the receiving L22: * node reads the missed rows by cursor (pullEvents) so we never push large ... L91: let env; L92: try { env = JSON.parse(msg.payload); } L93: catch { env = { topic: null, payload: msg.payload }; } ... L182: export function makeBus(deps = {}) { L183: const backend = process.env.SCOPE_RT_BACKEND || 'pg'; L184: switch (backend) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/realtime/bus.jsView on unpkg · L20

src/auth_hosted/oidc.jsView file

6* Env: L7: * SCOPE_OIDC_ISSUER e.g. https://accounts.google.com L8: * SCOPE_OIDC_CLIENT_ID ... L30: function env(name, fallback = undefined) { L31: const v = process.env[name]; L32: return v == null || v === '' ? fallback : v; ... L41: * loopback, RFC-1918, link-local). We require http(s) and BLOCK hosts that are L42: * IP literals in private/loopback/link-local ranges, plus the well-known L43: * `localhost` / `metadata.google.internal` names. Hostname-based DNS-rebinding ... L95: function b64url(buf) { L96: return Buffer.from(buf).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); L97: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/auth_hosted/oidc.jsView on unpkg · L6

src/hub.jsView file

212package = scope-kanban; repositoryIdentity = scope; dependency = open L212: if (openBrowser) { L213: try { (await import('open')).default(existing.url); } catch {} L214: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/hub.jsView on unpkg · L212

skills/install.shView file

•path = skills/install.sh kind = build_helper sizeBytes = 3952 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/install.shView on unpkg

Source & flagged code

4 flagged

src/realtime/bus.jsView file

Lines 1-40javascript

1/**

2 * Pluggable fan-out bus (SCP-146).

3 *

4 * The hosted relay runs many stateless Node nodes behind a load balancer; an

5 * SSE client may be connected to any of them. When a write lands (uploadEvents,

6 * src/pg/store.js returns the NEWLY-APPLIED events), every node that holds SSE

7 * subscribers for that tenant must learn about it — not just the node that

8 * accepted the write. That cross-node fan-out is what this bus provides.

9 *

10 * Interface (intentionally thin, so a NATS / Redis backend can swap in later):

11 *

12 * const bus = makeBus(); // pick a backend from env

13 * await bus.publish(topic, payload); // notify all nodes on `topic`

14 * const off = await bus.subscribe(topic, cb); // cb(payload) per message

15 * await off(); // unsubscribe one callback

16 * await bus.close(); // tear the backend down

17 *

18 * `topic` is an opaque string the caller derives (see topics.js for the

19 * tenant/project scheme). `payload` is any JSON-serializable value; the

20 * Postgres backend ships it as the NOTIFY payload. The canonical payload for

21 * Scope is a pointer — `{ tenant, cursor }` — NOT the event body: the receiving

22 * node reads the missed rows by cursor (pullEvents) so we never push large

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/realtime/bus.jsView on unpkg · L20

23 * bodies through NOTIFY's 8 KB limit and never trust a body that crossed a

24 * channel the receiver didn't write.

25 *

26 * --- Postgres LISTEN/NOTIFY backend ---------------------------------------

27 *

28 * One dedicated long-lived pg client per node holds every LISTEN (a pooled

29 * client can't — LISTEN is connection-scoped and the pool would hand the

30 * connection to someone else). publish() borrows a pool client briefly to issue

31 * NOTIFY. Postgres channel identifiers are restricted (and case-folded unless

32 * quoted), so we hash the topic to a stable, safe channel name and keep the

33 * real topic inside the JSON payload for the receiver to match on.

34 */

35

36import crypto from 'node:crypto';

37import { EventEmitter } from 'node:events';

38

39/**

40 * Postgres limits a NOTIFY channel name to NAMEDATALEN-1 (63) bytes and folds

src/auth_hosted/oidc.jsView file

Lines 1-26javascript

1/**

2 * OIDC authorization-code login (SCP-129) — GitHub / Google / Apple, driven by

3 * env. No external dependency: discovery + token exchange use global `fetch`

4 * (Node >= 18). PKCE + a signed `state` defend the redirect.

5 *

6 * Env:

7 * SCOPE_OIDC_ISSUER e.g. https://accounts.google.com

8 * SCOPE_OIDC_CLIENT_ID

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/auth_hosted/oidc.jsView on unpkg · L6

src/hub.jsView file

Lines 192-232javascript

192 *

193 * Returns:

194 * { url, port, weAreHub, server?, workspaces? }

195 *

196 * - `weAreHub: true` → we started the hub in this process;

skills/install.shView file

•path = skills/install.sh kind = build_helper sizeBytes = 3952 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/install.shView on unpkg