registry / sip-lab / 1.45.0

sip-lab@1.45.0

## Overview

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 309 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-30json

2 "name": "sip-lab",

3 "version": "1.45.0",

4 "description": "",

5 "main": "index.js",

6 "engines": {

7 "node": ">=15.0.0"

8 },

9 "scripts": {

10 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "./runtests -a 3"

12 },

13 "repository": {

14 "type": "git",

15 "url": "https://github.com/MayamaTakeshi/sip-lab"

16 },

17 "author": "",

18 "license": "ISC",

19 "homepage": "https://github.com/MayamaTakeshi/sip-lab",

20 "dependencies": {

21 "@mayama/zeq": "^4.23.0",

22 "data-matching": "^1.48.0",

23 "mrcp": "^1.4.0",

24 "mrcp-matching": "^1.3.0",

25 "sdp-matching": "^1.5.0",

26 "sip-matching": "^1.9.0",

27 "sipjs-lab": "^1.4.0"

28 },

29 "files": [

30 "index.js",

samples/artifacts/tls/cakey.pemView file

Lines 1-21text

1-----BEGIN PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

samples/artifacts/tls/cakey.pemView on unpkg · L1

Critical

Secret Pattern

RSA private key in samples/artifacts/tls/cakey.pem

samples/artifacts/tls/cakey.pemView on unpkg · L1

2MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC3bgM2R+PCYF1r

3fL1oFQnyqKhhpp9sUBLwcpytXcOJ6ESk2z+jj01pp0e+cRA1Tssq7V63W9E+es8t

40SHvw0aVcAudFhgFZV8UZQDtVqYy8jHxDJi6HIBob99H7YpHXmwndKsurYuFAVX0

5AxFybqm0U1lsYKqc6nRujr5E9KWs7RYV5i7PdvXGhcMTtHsD/PeRlGUWOSbGgeFv

6HpIIDtqVgxnXp4w7Y06FafgCnWPCrj+n6lGH+TRiscHGfXgGPXYefDp+sJNX/6/b

7X5s7NuTvD3dFXRn1n4kWVWYeh11b5g1kyfdLx4VahtznHovSWSjh7s8KQ6HzZ66F

samples/call_with_authentication.jsView file

Lines 1-21javascript

1// This test creates 2 UDP SIP endpoints, makes a call between them and disconeects.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

samples/call_with_authentication.jsView on unpkg · L1

3const sip = require ('../index.js')

4const Zeq = require

sip_lab_serverView file

•path = sip_lab_server kind = native_binary sizeBytes = 42409392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

sip_lab_serverView on unpkg

samples/artifacts/marielle_presente.tiffView file

•path = samples/artifacts/marielle_presente.tiff kind = high_entropy_blob sizeBytes = 173165 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

samples/artifacts/marielle_presente.tiffView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

samples/artifacts/tls/cakey.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

samples/artifacts/tls/cakey.pemView on unpkg · L1

Findings

2 Critical2 High4 Medium3 Low

CriticalCritical Secretsamples/artifacts/tls/cakey.pem

CriticalSecret Patternsamples/artifacts/tls/cakey.pem

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobsamples/artifacts/marielle_presente.tiff

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binarysip_lab_server

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosamples/call_with_authentication.js

LowFilesystem