registry / screwdriver-api / 8.0.161

screwdriver-api@8.0.161

API server for the Screwdriver.cd service

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 191 file(s), 657 KB of source

Source & flagged code

8 flagged

config/default.yamlView file

Lines 1-27yaml

1---

2auth:

3 # A private key used for signing jwt tokens

4 # Easily generate one by running

5 # $ openssl genrsa -out jwt.pem 2048

6 jwtPrivateKey: |

7 -----BEGIN RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/default.yamlView on unpkg · L7

Critical

Secret Pattern

RSA private key in config/default.yaml

config/default.yamlView on unpkg · L7

8 YOUR-KEY-HERE

9 -----END RSA PRIVATE KEY-----

10 # The public key used for verifying the signature

11 # Generate one by running

12 # $ openssl rsa -in jwt.pem -pubout -out jwt.pub

13 jwtPublicKey: |

14 -----BEGIN PUBLIC KEY-----

15 YOUR-KEY-HERE

16 -----END PUBLIC KEY-----

17 jwtQueueServicePublicKey: |

18 -----BEGIN PUBLIC KEY-----

19 YOUR-KEY-HERE

20 -----END PUBLIC KEY-----

21 # A password used for encrypting session data.

22 # **Needs to be minimum 32 characters**

23 cookiePassword: WOW-ANOTHER-INSECURE-PASSWORD!!!

24 # A password used for encrypting stored pipeline secrets and user Oauth token.

25 # **Needs to be minimum 32 characters**

26 encryptionPassword: WOW-ANOTHER-MORE-INSECURE-PASSWORD!!!

27 # A password used for hashing user/pipeline access tokens.

Lines 180-235yaml

180 low: 2

181 high: 12

182 # Default build timeout for all builds in this cluster (in minutes)

183 buildTimeout: 90

184 # Default max build timeout (in minutes)

185 maxBuildTimeout: 120

186 # k8s node selectors for appropriate pod scheduling

187 nodeSelectors: {}

188

Lines 446-475yaml

446 # set true to enable redis lock

447 enabled: false

448 options:

449 # maximum retry limit to obtain lock

450 retryCount: 200

451 # the expected clock drift

452 driftFactor: 0.01

453 # the time in milliseconds between retry attempts

454 retryDelay: 500

plugins/ratelimit.jsView file

Lines 1-22javascript

1'use strict';

3const rateLimit = require('hapi-rate-limit');

4const config = require('config');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/ratelimit.jsView on unpkg · L2

5const rateLimitConfig

package.jsonView file

Lines 1-26json

2 "name": "screwdriver-api",

3 "version": "8.0.161",

4 "description": "API server for the Screwdriver.cd service",

5 "main": "index.js",

6 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L6

Source & flagged code

8 flagged · loading source

config/default.yamlView file

7patternName = private_key_rsa severity = critical line = 7 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/default.yamlView on unpkg · L7

7patternName = private_key_rsa severity = critical line = 7 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in config/default.yaml

config/default.yamlView on unpkg · L7

200patternName = generic_password severity = medium line = 200 matchedText = # ...!!!"

Medium

Secret Pattern

Hardcoded password in config/default.yaml

config/default.yamlView on unpkg · L200

215patternName = generic_password severity = medium line = 215 matchedText = password...ORD"

Medium

Secret Pattern

Hardcoded password in config/default.yaml

config/default.yamlView on unpkg · L215

466patternName = generic_password severity = medium line = 466 matchedText = password...ORD"

Medium

Secret Pattern

Hardcoded password in config/default.yaml

config/default.yamlView on unpkg · L466

472patternName = generic_password severity = medium line = 472 matchedText = password...ORD"

Medium

Secret Pattern

Hardcoded password in config/default.yaml

config/default.yamlView on unpkg · L472

plugins/ratelimit.jsView file

2L3: const rateLimit = require('hapi-rate-limit'); L4: const config = require('config');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/ratelimit.jsView on unpkg · L2

package.jsonView file

•Runtime dependency names matching Node built-ins: stream

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

2 Critical1 High7 Medium3 Low

CriticalCritical Secretconfig/default.yaml

CriticalSecret Patternconfig/default.yaml

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requireplugins/ratelimit.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternconfig/default.yaml

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

8 flagged

config/default.yamlView file

Lines 1-27yaml

1---

2auth:

3 # A private key used for signing jwt tokens

4 # Easily generate one by running

5 # $ openssl genrsa -out jwt.pem 2048

6 jwtPrivateKey: |

7 -----BEGIN RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

config/default.yamlView on unpkg · L7

Critical

Secret Pattern

RSA private key in config/default.yaml

config/default.yamlView on unpkg · L7

8 YOUR-KEY-HERE

9 -----END RSA PRIVATE KEY-----

10 # The public key used for verifying the signature

11 # Generate one by running

12 # $ openssl rsa -in jwt.pem -pubout -out jwt.pub

13 jwtPublicKey: |

14 -----BEGIN PUBLIC KEY-----

15 YOUR-KEY-HERE

16 -----END PUBLIC KEY-----

17 jwtQueueServicePublicKey: |

18 -----BEGIN PUBLIC KEY-----

19 YOUR-KEY-HERE

20 -----END PUBLIC KEY-----

21 # A password used for encrypting session data.

22 # **Needs to be minimum 32 characters**

23 cookiePassword: WOW-ANOTHER-INSECURE-PASSWORD!!!

24 # A password used for encrypting stored pipeline secrets and user Oauth token.

25 # **Needs to be minimum 32 characters**

26 encryptionPassword: WOW-ANOTHER-MORE-INSECURE-PASSWORD!!!

27 # A password used for hashing user/pipeline access tokens.

Lines 180-235yaml

180 low: 2

181 high: 12

182 # Default build timeout for all builds in this cluster (in minutes)

183 buildTimeout: 90

184 # Default max build timeout (in minutes)

185 maxBuildTimeout: 120

186 # k8s node selectors for appropriate pod scheduling

187 nodeSelectors: {}

188

Lines 446-475yaml

446 # set true to enable redis lock

447 enabled: false

448 options:

449 # maximum retry limit to obtain lock

450 retryCount: 200

451 # the expected clock drift

452 driftFactor: 0.01

453 # the time in milliseconds between retry attempts

454 retryDelay: 500

plugins/ratelimit.jsView file

Lines 1-22javascript

1'use strict';

3const rateLimit = require('hapi-rate-limit');

4const config = require('config');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/ratelimit.jsView on unpkg · L2

5const rateLimitConfig

package.jsonView file

Lines 1-26json

2 "name": "screwdriver-api",

3 "version": "8.0.161",

4 "description": "API server for the Screwdriver.cd service",

5 "main": "index.js",

6 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L6