Lines 1-70javascript
2"use strict";var yD=Object.create;var bc=Object.defineProperty;var SD=Object.getOwnPropertyDescriptor;var wD=Object.getOwnPropertyNames;var ED=Object.getPrototypeOf,xD=Object.prototype.hasOwnProperty;var p=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Se=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},we=(t,e)=>{for(var r in e)bc(t,r,{get:e[r],enumerable:!0})},Rw=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of wD(e))!xD.call(t,o)&&o!==r&&bc(t,o,{get:()=>e[o],enumerable:!(n=SD(e,o))||n.enume ...
3versions published after the first week of January 2027
4will require node >=${r}. You are running node ${t}.
6To continue receiving updates to AWS services, bug fixes,
7and security updates please upgrade to node >=${r}.
9More information can be found at: https://a.co/c895JFp`))}}});var WD,GD,Xw,Yw=p(()=>{WD=()=>(t,e)=>async r=>(e.__retryLongPoll=!0,t(r)),GD={name:"longPollMiddleware",tags:["RETRY"],step:"initialize",override:!0},Xw=t=>({applyToStack:e=>{e.add(WD(),GD)}})});function fn(t,e,r){return t.$source||(t.$source={}),t.$source[e]=r,t}var Zw=p(()=>{});var Qw,cp,eE=p(()=>{Qw=require("node:stream"),cp=t=>t?.body instanceof Qw.Readable||typeof ReadableStream<"u"&&t?.body instanceof ReadableStream});var so,pn,mn,tE,rE,Cc=p(()=>{so=(t,e)=>{let r=[];if(t&&r.push(t),e)for(let n of e)r.push(n);return r},pn=(t,e) ...
10 `+f}catch{!r.logger||r.logger?.constructor?.name==="NoOpLogger"?console.warn(f):r.logger?.warn?.(f)}typeof d.$responseBodyText<"u"&&d.$response&&(d.$response.body=d.$responseBodyText);try{if(Ee.isInstance(o)){let{headers:m={},statusCode:h}=o,g=Object.entries(m);d.$metadata={httpStatusCode:h,requestId:xp(/^x-[\w-]+-request-?id$/,g),extendedRequestId:xp(/^x-[\w-]+-id-2$/,g),cfId:xp(/^x-[\w-]+-cf-id$/,g)}}}catch{}}throw d}},xp=(t,e)=>(e.find(([r])=>r.match(t))||[void 0,void 0])[1]});var vE,CE=p(()=>{M();Pc();vE=t=>(e,r)=>async n=>{let{operationSchema:o}=X(r),[,s,i,a,c,u]=o??[],l=r.endpointV2?as ...
11`).slice(0,5).filter(e=>!e.includes("stackTraceWarning")).join(`
12`),Xo={warn:console.warn}});function ct(t){let e=t.getUTCFullYear(),r=t.getUTCMonth(),n=t.getUTCDay(),o=t.getUTCDate(),s=t.getUTCHours(),i=t.getUTCMinutes
13 `+a}catch{!n.logger||n.logger?.constructor?.name==="NoOpLogger"?console.warn(a):n.logger?.warn?.(a)}typeof i.$responseBodyText<"u"&&i.$response&&(i.$response.body=i.$responseBodyText);try{if(Ee.isInstance(s)){let{headers:c={}}=s,u=Object.entries(c);i.$metadata={httpStatusCode:s.statusCode,requestId:Yp(/^x-[\w-]+-request-?id$/,u),extendedRequestId:Yp(/^x-[\w-]+-id-2$/,u),cfId:Yp(/^x-[\w-]+-cf-id$/,u)}}}catch{}}throw i}},Yp=(t,e)=>(e.find(([r])=>r.match(t))||[void 0,void 0])[1]});var ut,Pi=p(()=>{ut=class t extends Error{name="ProviderError";tryNextLink;constructor(e,r=!0){let n,o=!0;typeof r= ...
14`),a){let m=r(await c);l.enqueue(`${s}:${m}\r
16`)}l.close()}else l.enqueue(`${(n(d)||0).toString(16)}\r
18`)}})}});function W_(t,e){let r=t,n=t;if(ye(n))return H_(n,e);let{base64Encoder:o,bodyLengthChecker:s,checksumAlgorithmFn:i,checksumLocationName:a,streamHasher
19`),d.push(f),d.push(`\r
20`))}),r.on("end",async()=>{if(d.push(`0\r
21`),u){let f=o(await l);d.push(`${a}:${f}\r
23`)}d.push(null)}),d}var V_,G_=p(()=>{V_=require("node:stream");z_();Vt()});async function j_(t,e){let r=0,n=[],o=t.getReader(),s=!1;for(;!s;){let{done:c,value:u}=await o.read();if(u&&(n.push(u),r+=u?.byteLength??0),r>=e)break;s=c}o.releaseLock();let i=new Uint8Array(Math.min(e,r)),a=0;for(let c of n){if(c.byteLength>i.byteLength-a){i.set(c.subarray(0,i.byteLength-a),a);break}else i.set(c,a);a+=c.length}return i}var q_=p(()=>{});var K_,J_,rh,X_=p(()=>{K_=require("node:stream");ki();q_();Vt();J_=(t,e)=>ye(t)?j_(t,e):new Promise((r,n)=>{let o=new rh;o.limit=e,t.pipe(o),t.on("error",s=>{o.end(),n( ...
24If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body`);return o.stream()};return Object.assign(t,{transformToByteArray:r,transformToString:async o=>{let s=await r();if(o==="base64")return $u(s);if(o
25`));return r(o)}});var Ad,Kt,U0=p(()=>{bd();Ad={step:"serialize",tags:["HTTP_AUTH_SCHEME"],name:"httpAuthSchemeMiddleware",override:!0,relation:"before",toMiddleware:"endpointV2Middleware"},Kt=(t,{httpAuthSchemeParametersProvider:e,identityProviderConfigProvider:r})=>({applyToStack:n=>{n.addRelativeTo(Eo(t,{httpAuthSchemeParametersProvider:e,identityProviderConfigProvider:r}),Ad)}})});var _d,ug,B0=p(()=>{bd();_d={step:"serialize",tags:["HTTP_AUTH_SCHEME"],name:"httpAuthSchemeMiddleware",override:!0,relation:"before",toMiddleware:"serializerMiddleware"},ug=(t,{httpAuthSchemeParametersProvider:e ...
26${this.getCanonicalPath(e)}
28${o.map(s=>`${s}:${r[s]}`).join(`
32${n}`}async createStringToSign(e,r,n,o){let s=new this.sha256;s.update(ua(n));let i=await s.digest();return`${o}
35${xo(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let r=[];for(let s of e.split("/"))s?.length!==0&&s!=="."&&(s===".."
36`);return this.signString(g,{signingDate:n,signingRegion:c,signingService:i,eventStreamCredentials:a})}async signMessage(e,{signingDate:r=new Date,signingRegion:n,signingService:o,eventStreamCredentials:s}){return this.signEvent({headers:this.headerFormatter.format(e.message.headers),payload:e.message.body},{signingDate:r,signingRegion:n,signingService:o,priorSignature:e.priorSignature,eventStreamCredentials:s}).then(a=>({message:e.message,signature:a}))}async signString(e,{signingDate:r=new Date,signingRegion:n,signingService:o,eventStreamCredentials:s}={}){let i=s??await this.credentialProvi ...
37For more information, please visit: `+I$);let o=t.originalExpiration??t.expiration;return{...t,...o?{originalExpiration:o}:{},expiration:n}},k$=(t,e={})=>{let r=e?.logger||console,n;return async
38See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html
39or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return r}constructor(e){this.configProvider=new Promise((r,n)=>{typeof e=="function"?e().then(o=>{r(this.resolveDefaultConfig(o))}).catch(n):r(this.resolveDefaultConfig(e))})}destroy(){this.config?.httpAgent?.destroy(),this.config?.httpsAgent?.destroy()}async handle(e,{abortSignal:r,requestTimeout:n}={}){this.config||(this.config=await this.configProvider);let o=this.config,s=o.logger,i=e.protocol==="https:";return!i&&!this.config.httpAgent&&(this.config.httpAgent=await this.config.httpAgentProvide ...
40 - loopback CIDR 127.0.0.0/8 or [::1/128]
41 - ECS container host 169.254.170.2
42 - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:e})}};function oL(t){return new Y$({protocol:t.protocol,hostname:t.hostname,port:Number(t.port),path:t.pathname,query:Array.from(t.searchParams.entries()).reduce((e,[r,n])=>(e[r]=n,e),{}),fragment:t.hash})}
43Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:t.logger});let a=new URL(e);nL(a,t.logger);let c=J$.create({connectionTimeout:t.timeout??1e3}),u=t.timeout??1e3,l=iL(async()=>{let d=oL(a);s?d.headers.Authorization=Yv((await X$.readFile(s)).toString()):o&&(d.headers.Authorization=Yv(o));try{let f=await c.handle(d,{requestTimeout:u});return sL(f.response).then(m=>K$(m,"CREDENTIALS_HTTP","z"))}catch(f){throw new Ao(String(f),{logger:t.logger})}},t.maxRetries??3,t.timeout??1e3);return async()=>{try{return await l()}finally{c.destroy?.()}}},Yv=t=>{if(t.incl ...
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
out/cli.jsView on unpkg · L1 44`))throw new Ao("Authorization token contains invalid \\r\\n sequence.");return t};Zv.fromHttp=fL});function pL(t){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sso-oauth",region:t.region},propertiesExtractor:(e,r
45`),this.z=this.x.length}parse(){let e=this,{z:r}=e;for(;e.i<r&&(e.trim(),!(e.i>=r));)if(e.isNext("<?"))e.readTo("?>"),e.trim();else if(e.isNext("<!--"))e.readTo("-->"),e.trim();else if(e.isNext("<!DOCTYPE",!1))e.skipDoctype(),e.trim();else if(e.x[e.i]==="<"){let n=e.parseTag();return{[n.tag]:n.value}}else throw new Error("@aws-sdk XML parse error: unexpected content.");throw new Error("@aws-sdk XML parse error: no root element.")}isNext(e,r=!0){let n=this;return r?n.x.startsWith(e,n.i):n.x.toLowerCase().startsWith(e.toLowerCase(),n.i)}readTo(e){let r=this,n=r.x.indexOf(e,r.i);if(n===-1)throw n ...
46`.includes(e.x[e.i]);)++e.i}readAttrValue(){let e=this,r=e.x[e.i];++e.i;let n="";for(;e.i<e.z&&e.x[e.i]!==r;)n+=e.x[e.i++];return++e.i,e.decodeEntities(n)}parseTag(){let e=
47>/`.includes(e.x[e.i]);)r+=e.x[e.i++];let n=!1,o={};for(;e.i<e.z&&(e.trim(),!">/".includes(e.x[e.i]));){let l="";for(;e.i<e.z&&!`= \r
48>/?`.includes(e.x[e.i]);)l+=e.x[e.i++];if(e.trim(),e.x[e.i]!=="=")break;++e.i,e.trim(),l==="__proto__"&&Vy(o),o[l]=e.readAttrValue(),n=!0}if(e.i>=e.z)throw new Error("@aws-sdk XML parse error: unexpected end of input.");if(e.x[e.i]==="/"){if(++e.i,e.i>=e.z||e.x[e.i]
49`)?{tag:r,value:""}:{tag:r,value:l}}let u={};for(let l of s)l.trim()===""&&l.includes(`
50`)||(u["#text"]="#text"in u?u["#text"]+l:l);for(let l of i)l.tag==="__proto__"&&Vy(u),l.tag in u?Array.isArray(u[l.tag])?u[l.tag].push(l.value):u[l.tag]=[u[l.tag],l.value]:u[l.tag]=l.
51Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:e});return t},H2=(t={})=>async({callerClientConfig:e}={})=>{t.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");let{ssoStartUrl:r,ssoAccountId:n,ssoRegion:o,ssoRoleName:s,ssoSession:i}=t,{ssoClient:a}=t,c=$2({profile:t.profile??e?.profile});if(!r&&!n&&!o&&!s&&!i){let l=(await L2(t))[c];if(!l)throw new sr(`Profile ${c} was not found.`,{logger:t.logger});if(!Lk(l))throw new sr(`Profile
52 Multiple credential sources detected:
CriticalCommand Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
out/cli.jsView on unpkg · L35 CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
out/cli.jsView on unpkg · L35 HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
out/cli.jsView on unpkg · L35 HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
out/cli.jsView on unpkg · L35 53 Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
54 This SDK will proceed with the AWS_PROFILE value.
56 However, a future version may change this behavior to prefer the ENV static credentials.
57 Please ensure that your environment only sets either the AWS_PROFILE or the
58 AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
59`),gN=!0)),new _f("AWS_PROFILE is set, skipping fromEnv provider.",{logger:t.logger,tryNextLink:!0});return t.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv"),pH(t)()},async e=>{t.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");let{ssoStartUrl:r,ssoAccountId:n,ssoRegion:o,ssoRoleName:s,ssoSession:i}=t;if(!r&&!n&&!o&&!s&&!i)throw new _f("Skipping SSO provider in default chain (inputs do not include SSO fields).",{logger:t.logger});let{fromSSO:a}=SS();return a(t)(e)},async e=>{t.logger?.debug("@aws-sdk/credential-provider-node - defaultP ...
60`),process.exit(2));var xc=require("fs"),rp=J(require("path"));var Vo=require("fs"),ln=J(require("path")),Ow=require("crypto");var $t=[/EXAMPLE/i,/^(?:x{6,}|X{6,}|0{6,}|1{6,}|a{6,}|A{6,})$/,/YOUR[_-]?(?:API|SECRET|ACCESS|PRIVATE)?[_-]?(?:KEY|TOKEN|SECRET)/i,/\b(?:sample|dummy|placeholder|redacted|changeme|notreal|fakekey)
61`).filter(o=>o.trim().length>0):Fw(t,t)).filter(o=>!_c(o,e))}function Fw(t,e,r=[]){let n;try{n=(0,no.readdirSync)(t)}catch{return r}for(let o of n){if(o===".git"||o==="node_modules")continue;let s=oo.join(t,o),i;try{i=(0,no.statSync)(s)}catch{continue}i.isDirectory()?Fw(s,e,r):r.push(oo.relative(e,s).split(oo.sep).join("/"))}return r}function $w(t,e,r){let n=oo.join(t,e);try{let o=(0,no.statSync)(n);if(!o.isFile()||o.size>r.maxFileSizeBytes)return null;let s=(0,no.readFileSync)(n);return s.subarray(0,8e3).includes(0)?null:s.toString("utf8")}catch{return null}}function Lw(t){let e=(0,Rc.spawnSy ...
62`).filter(r=>r.trim().length>0)}function Uw(t){let e=(0,Rc.spawnSync)("git",["rev-parse","--show-toplevel"],{cwd:t,encoding:"utf8"});return e.status===
64`,e);return[r,n===-1?t.length:n]}function DD(t,e,r){let n=(o,s)=>{o.fingerprint=op({filePath:r,ruleId:o.ruleId,strategy:o.fingerprintStrategy??"value",value:o.value,context:s})};for(let o of t){if((o.fingerprintStrategy??"value")!=="context"){n(o);continue}let s=o.matchStart??o.startIndex,i=o.matchEnd??o.endIndex;n(o,ap(e,s,i,t))}Vw(t,e,r,o=>{let[s,i]=zw(e,o.startIndex);return ap(e,s,i,t)}),Vw(t,e,r,(o,s)=>{let[i,a]=zw(e,o.startIndex);return`${ap(e,i,a,t)}#${s}`})}function Vw(t,e,r,n){let o=new Map;for(let s of t){if((s.fingerprintStrategy??"value")!=="context"||!s.fingerprint)continue;let i=o ...
65`);for(let n=0;n<r.length;n++)HD.test(r[n])&&(e.add(n+1),e.add(n+2));return e}function VD(t){let
66`);l=y.pop()??"";for(let S of y)i.push(S)}catch(y){h(y)}}),a.stderr.setEncoding("utf8"),a.stderr.on("data",g=>{d
67`+r:this.buffer={text:r,firstLine:this.addedLine},this.addedLine++;return}this.flush()}finish(){return this.flush(),this.findings}};var tD={critical:0,high:1,medium:2,low:3},fi={network:{label:"could not reach the provider",remedy:
68`)}function nW(t){let e=new Map;for(let r of t){let n=r.verifyReason??"no-verifier",o=e.get(n);o?o.push(r):e.set(n,[r])}return Object.keys(fi).filter(r=>e.has(r)).map(r=>[r,e.get(r)])}function bw(t,e,r=" "){let n=t.commit?`${t.file}:${t.line} (commit ${t.commit.slice(0,8)})`:`${t.file??"<text>"}:${t.line}`,o=[`${r}[${t.severity}] ${t.description} (${t.ruleId})`,`${r} ${n}`,`${r} value: ${_w(t,e.redact)}`];return t.verifyDetail&&o.push(`${r} ${t.verifyDetail}`),t.fingerprint&&o.push(`${r} fingerprint: ${t.fingerprint}`),o}function oW(t,e){return JSON.stringify({tool:"secretloop",summary:{t ...
69and rotate or remediate them. A GPY Analytics product.
Long lines were clipped for display.