session-orchestrator@3.16.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

session-orchestrator@3.16.0: Suspicious npm security report | LPM Firewall

Lines 63-160javascript

63

64// ---------------------------------------------------------------------------

65// Forbidden patterns (with hints)

66// ---------------------------------------------------------------------------

67

68/** @type {Array<{name: string, regex: RegExp, hint: string}>} */

69const PATTERNS = [

70 {

71 name: 'F1 (Stripe sk_live_)',

72 regex: /sk_live_[A-Za-z0-9]{24,}/,

73 hint: 'use sk_test_ prefix + PLACEHOLDER suffix (e.g. sk_test_PLACEHOLDER_AAAAAAAAAAAAAAAAAAAA)',

74 },

75 {

76 name: 'F2 (Slack xoxb-<digits>)',

77 regex: /xoxb-\d{6,}/,

78 hint: 'use xoxb-PLACEHOLDER segments (e.g. xoxb-PLACEHOLDER-PLACEHOLDER-PLACEHOLDER)',

79 },

80 {

81 name: 'F3 (AWS AKIA…)',

82 regex: /AKIA[A-Z0-9]{16}/,

83 hint: 'use AKIAIOSFODNN7EXAMPLE (AWS docs canonical example — already allowlisted here)',

Critical

Secret Pattern

AWS access key ID in scripts/lib/validate/check-test-fixture-shapes.mjs

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L83

84 },

85 {

86 name: 'F4 (Google AIzaSy…)',

87 regex: /AIzaSy[A-Za-z0-9_-]{33}/,

88 hint: 'use AIzaSy-PLACEHOLDER (canonical placeholder shape)',

89 },

90 {

91 name: 'F5 (Anthropic sk-ant-)',

92 regex: /sk-ant-[A-Za-z0-9_-]{30,}/,

93 hint: 'use sk-ant-<PLACEHOLDER>-<padding to ≥30 chars after the prefix>',

94 },

95 {

96 name: 'F6 (GitHub PAT classic ghp_)',

97 regex: /ghp_[A-Za-z0-9]{36,}/,

98 hint: 'use ghp_PLACEHOLDER<padding> (must be ≥36 chars after the underscore)',

99 },

100 {

101 name: 'F7 (GitHub PAT fine-grained github_pat_)',

102 regex: /github_pat_[A-Za-z0-9_]{30,}/,

103 hint: 'use github_pat_PLACEHOLDER<padding> (must be ≥30 chars after the prefix)',

105 {

106 name: 'F8 (GitLab PAT glpat-)',

107 regex: /glpat-[A-Za-z0-9_-]{20,}/,

108 hint: 'use glpat-PLACEHOLDER<padding> (must be ≥20 chars after the prefix)',

109 },

110 {

111 name: 'F9 (Slack webhook URL)',

112 regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,

113 hint: 'use slack.com/services/T<X>/B<X>/<X> with placeholder segments — not a real webhook URL shape',

114 },

115 {

116 name: 'F10 (Discord webhook URL)',

117 regex: /https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,

118 hint: 'use discord.com/api/webhooks/<id>/<token> with placeholder ID + token — not a real URL shape',

119 },

120];

121

122// ---------------------------------------------------------------------------

123// Allowlist substrings — if a regex hit overlaps any of these, it's skipped.

124//

125// AKIAIOSFODNN7EXAMPLE is the AWS-published canonical-docs example used by

Critical

Secret Pattern

AWS access key ID in scripts/lib/validate/check-test-fixture-shapes.mjs

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L125

126// real-world secret scanners (gitleaks, trufflehog) as a known-safe fixture.

127// It MUST stay allowlisted — tests/unit/quality-gate-diagnostics.test.mjs

128// uses AKIAIOSFODNN7EXAMPLE23 (canonical + 2-char suffix) to exercise the

Critical

Secret Pattern

AWS access key ID in scripts/lib/validate/check-test-fixture-shapes.mjs

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L128

129// AKIA redaction path of redactDiagnosticsBundle.

130//

131// sk_test_ is Stripe's official test-mode prefix — the recommended drop-in

132// replacement for sk_live_ in tests. Allowlisting the prefix means any

133// sk_test_<...> string is exempt.

134//

135// xoxb-PLACEHOLDER and AIzaSy-PLACEHOLDER are the canonical placeholder

136// forms recommended in the hint messages above. Allowlisting them as

137// substrings ensures the recommended replacement is never blocked.

138// ---------------------------------------------------------------------------

139const ALLOWLIST_SUBSTRINGS = [

140 'AKIAIOSFODNN7EXAMPLE', // AWS docs canonical (covers AKIAIOSFODNN7EXAMPLE + any suffix)

Critical

Secret Pattern

AWS access key ID in scripts/lib/validate/check-test-fixture-shapes.mjs

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L140

141 'sk_test_', // Stripe test-mode prefix (covers any sk_test_<...>)

142 'xoxb-PLACEHOLDER', // canonical Slack placeholder

143 'AIzaSy-PLACEHOLDER', // canonical Google API placeholder

144];

145

146const MAGIC_COMMENT = '// @secret-shape-allowed';

147const MAGIC_COMMENT_SCAN_LINES = 5;

148

149// ---------------------------------------------------------------------------

150// File enumeration: git ls-files | filter tests/**/*.{mjs,ts,js}

151// Excludes snapshot files (.snap).

152// ---------------------------------------------------------------------------

153

154function getTrackedTestFiles() {

155 let output;

156 try {

157 output = execFileSync('git', ['ls-files'], { cwd: pluginRoot, encoding: 'utf8' });

158 } catch {

159 // Not a git repo or git unavailable — return empty (caller treats as pass)

160 return [];