soajs.controller@4.3.18
soajs multi tenant API gateway
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe active awareness path supplies a registry cluster token to the Kubernetes driver, whose CA branch directs authenticated API requests to a fixed unrelated endpoint. This is concrete credential exposure without recipient-specific consent, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
Run the service in high-availability Kubernetes mode with CA settings whose request options do not already specify authentication.
Impact
The fixed recipient can receive a cluster credential and potentially use it to access the cluster.
Mechanism
The driver creates the CA-backed client from a package-fixed cluster address and adds the supplied token as bearer authentication before Kubernetes API requests.
Attack narrative
In high-availability Kubernetes mode, the service loads a cluster token and configured URL from registry settings. With CA settings and no authentication already set in the CA request options, the driver instead builds its client for http://server.com and attaches that token as bearer authentication. The awareness workflow then makes Kubernetes API requests through the client, exposing the credential to a package-selected recipient.
AI rationale
The active awareness path supplies a registry cluster token to the Kubernetes driver, whose CA branch directs authenticated API requests to a fixed unrelated endpoint. This is concrete credential exposure without recipient-specific consent, so the package should be blocked.
Evidence
mw/awareness/index.jsmw/awareness/ha.jsmodules/driver/kubernetes/model/lib.jsmodules/driver/kubernetes/model/index.jsmodules/driver/kubernetes/bl/get.js
Network endpoints1
server.com
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- In high-availability mode, awareness initializes the Kubernetes driver and loads configuration selected for Kubernetes from the registry.
- That configuration supplies the cluster token and intended URL, and the awareness workflow invokes Kubernetes API operations with it.
- When CA settings are present, the driver builds its backend using the fixed address http://server.com instead of the supplied URL.
- If the CA request options lack authentication, the driver inserts the supplied token as bearer authentication.
- The awareness workflow uses this client for Kubernetes API requests, so the fixed recipient can receive the cluster credential.
- The helper requires a namespace, token, and URL, then copies the token and supplied URL into the driver configuration.
Evidence against
- The exposure is conditional on the high-availability Kubernetes path, CA settings, and request options without existing authentication; the manifest has no install lifecycle hook.
Behavioral surface
CryptoDynamicRequireEnvironmentVars
Source & flagged code
6 flagged · loading sourcetest/unit/mw/key/index.jsView file
17patternName = generic_password
severity = medium
line = 17
Medium
Secret Pattern
Package contains a possible secret pattern.
test/unit/mw/key/index.jsView on unpkg · L17178patternName = generic_password
severity = medium
line = 178
Medium
Secret Pattern
Hardcoded password in test/unit/mw/key/index.js
test/unit/mw/key/index.jsView on unpkg · L178Gruntfile.jsView file
10L11: const fs = require('fs');
L12: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Gruntfile.jsView on unpkg · L10Findings
1 High6 Medium5 Low
HighAi Review Evidencemw/awareness/index.js
MediumSecret Patterntest/unit/mw/key/index.js
MediumDynamic RequireGruntfile.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterntest/unit/mw/key/index.js
MediumSecret Patterntest/data/provision/urac/users/owner.js
LowScripts Present
LowWeak Cryptomw/cache/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to soajs.controller@4.3.18.
See all versions of soajs.controller for other recorded verdicts.
- Avoid installing soajs.controller@4.3.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.