registry / tango-app-api-trax / 3.9.63

tango-app-api-trax@3.9.63

Trax

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 1.23 MB of source, external domains: central.pos.lenskart.com, d1r0hc2sskgmri.cloudfront.net, f65azvtljclaxp6l7rnx65cdmm0lcgvp.lambda-url.ap-south-1.on.aws, pbxdm4nstcpbaz6gf6c53ofeee0zvmfy.lambda-url.ap-south-1.on.aws, webservice.pos.lenskart.com

Source & flagged code

8 flagged

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView file

Lines 1-14json

2 "type": "service_account",

3 "project_id": "tango-trax",

4 "private_key_id": "ab5f0323dc6b9ea8aa912aadd631d03305cb194e",

5 "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDFxYgl89aDMT6O\nwOeUTgzY1lYYwmg3GOLhNYTB5hGrkGobn8sEtr8YPV5ADTZCWbhQbF2f9AC6xUtu\nXkWvx2zGtKKqH9kMd4ek3rALVgOI0VtAlFKa8wNqiWISXx6YR9Ff9+z47Gb8H3fP\nrWTTCIgndR/aM5/wL66FNx4MnlEUUn0K0GwQJFAa0ts+N4FIF584VsKjoPDUxvFh\nx29F6HoizlD585pycyfx1J8mVSBPNSwns2b0SqNwY9vkmzpGbeuz2pS6NWB+tA76\nYw8cMujRBUEu2Q6vgsZsDeB9SP08U190C6NpInrJdh9XjTXAcxSxfj6r0BDP24sn\n9UNCFjAnAgMBAAECggEAHcGyJykLC5jrNVtnp0l0ZrkedyyOYEve8c0K+TRT+vZd\noLkS44CuO/LFLZSkp1MMh707plzLh06MIkJjmyZsWBwcUBs+ncDrqIOBBWj0Wy+f\nhUChNS3UmRZWqouj9NGez8u5M ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

Critical

Secret Pattern

RSA private key in fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

6 "client_email": "firebase-adminsdk-k7lom@tango-trax.iam.gserviceaccount.com",

7 "client_id": "112026772051782321525",

8 "auth_uri": "https://accounts.google.com/o/oauth2/auth",

9 "token_uri": "https://oauth2.googleapis.com/token",

10 "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

11 "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-k7lom%40tango-trax.iam.gserviceaccount.com",

12 "universe_domain": "googleapis.com"

13}

Long lines were clipped for display.

package.jsonView file

Lines 1-27json

2 "name": "tango-app-api-trax",

3 "version": "3.9.63",

4 "description": "Trax",

5 "main": "index.js",

6 "type": "module",

7 "scripts": {

src/controllers/internalTrax.controller.jsView file

Lines 389-429javascript

389 );

390 let allQuestion = await CLassign.aggregate( getquestionQuery );

391 if ( allQuestion.length && getCLconfig.checkListType == 'custom' ) {

392 let assignList = [];

393 if

src/controllers/trax.controller.jsView file

Lines 716-756javascript

716 if ( !zoneList.length ) {

717 return res.sendError( 'no data found', 204 );

718 }

719

720 return res.sendSuccess( zoneList );

721 }

722 } catch ( e ) {

Source & flagged code

8 flagged · loading source

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView file

5patternName = private_key_rsa severity = critical line = 5 matchedText = "private...\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

5patternName = private_key_rsa severity = critical line = 5 matchedText = "private...\n",

Critical

Secret Pattern

RSA private key in fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

package.jsonView file

•Runtime dependency names matching Node built-ins: fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

src/controllers/internalTrax.controller.jsView file

409patternName = generic_password severity = medium line = 409 matchedText = password...==',

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L409

990patternName = generic_password severity = medium line = 990 matchedText = password...==',

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L990

1579patternName = generic_password severity = medium line = 1579 matchedText = body: JS...} ),

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L1579

1653patternName = generic_password severity = medium line = 1653 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L1653

src/controllers/trax.controller.jsView file

736patternName = generic_password severity = medium line = 736 matchedText = password...==',

Medium

Secret Pattern

Hardcoded password in src/controllers/trax.controller.js

src/controllers/trax.controller.jsView on unpkg · L736

Findings

2 Critical1 High7 Medium4 Low

CriticalCritical Secretfir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json

CriticalSecret Patternfir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json

HighNode Builtin Dependency Squatpackage.json

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/controllers/internalTrax.controller.js

MediumSecret Patternsrc/controllers/trax.controller.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView file

Lines 1-14json

2 "type": "service_account",

3 "project_id": "tango-trax",

4 "private_key_id": "ab5f0323dc6b9ea8aa912aadd631d03305cb194e",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

Critical

Secret Pattern

RSA private key in fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json

fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.jsonView on unpkg · L5

6 "client_email": "firebase-adminsdk-k7lom@tango-trax.iam.gserviceaccount.com",

7 "client_id": "112026772051782321525",

8 "auth_uri": "https://accounts.google.com/o/oauth2/auth",

9 "token_uri": "https://oauth2.googleapis.com/token",

10 "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

11 "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-k7lom%40tango-trax.iam.gserviceaccount.com",

12 "universe_domain": "googleapis.com"

13}

Long lines were clipped for display.

package.jsonView file

Lines 1-27json

2 "name": "tango-app-api-trax",

3 "version": "3.9.63",

4 "description": "Trax",

5 "main": "index.js",

6 "type": "module",

7 "scripts": {

src/controllers/internalTrax.controller.jsView file

Lines 389-429javascript

389 );

390 let allQuestion = await CLassign.aggregate( getquestionQuery );

391 if ( allQuestion.length && getCLconfig.checkListType == 'custom' ) {

392 let assignList = [];

393 if

src/controllers/trax.controller.jsView file

Lines 716-756javascript

716 if ( !zoneList.length ) {

717 return res.sendError( 'no data found', 204 );

718 }

719

720 return res.sendSuccess( zoneList );

721 }

722 } catch ( e ) {

Lines 970-1010javascript

970 } );

971 let allQuestion = await CLassign.aggregate( getquestionQuery );

972 if ( allQuestion.length && getCLconfig.checkListType == 'custom' ) {

973 let assignList = [];

974 if ( getCLconfig.coverage == 'store' ) {

975 let clusterList = allQuestion.filter( ( ele ) => ele?.clusterName ).map( ( item ) => item.assignId );

976 if ( clusterList.length ) {

977 let clusterDetails = await clusterServices.findcluster( { _id: { $in: clusterList } } );

978 if ( clusterDetails.length ) {

979 let idList = clusterDetails.flatMap( ( item ) => item.stores.map( ( ele ) => ele.store ) );

980 let getStoreDetails = await storeService.find( { _id: { $in: idList } } );

981 if ( getStoreDetails.length ) {

982 assignList = await Promise.all( getStoreDetails.map( async ( store ) => {

983 let userDetails = await userService.findOne( { email: store?.spocDetails?.[0]?.email, clientId: store.clientId } );

984 if ( !userDetails ) {

985 let data = {

986 clientId: store.clientId,

987 userName: store.spocDetails?.[0]?.name,

988 mobileNumber: store.spocDetails?.[0]?.phone || '',

989 email: store.spocDetails[0].email,

990 password: '5dqFKAJj29PsV6P+kL+3Dw==',

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L990

991 role: 'user',

992 userType: 'client',

993 rolespermission: [

994 {

995 featureName: 'Global',

996 modules: [

997 {

998 name: 'Store',

999 isAdd: false,

1000 isEdit: false,

1001

1002 },

1003 {

1004 name: 'User',

1005 isAdd: false,

1006 isEdit: false,

1007

1008 },

1009 {

1010 name: 'Camera',

Lines 1559-1599javascript

1559 return res.sendSuccess( { data: employeeDetails[0].data, count: employeeDetails[0].count.length ? employeeDetails[0].count[0].total : 0 } );

1560 } catch ( error ) {

1561 logger.error( { function: 'LensKart Employee Mapping List', error: error } );

1562 if ( error.name === 'ValidationError' ) res.sendError( error, 400 );

1563 else res.sendError( error, 500 );

1564 }

1565}

1566

1567export async function aomupdateCollection( req, res ) {

1568 try {

1569 let url = 'https://webservice.pos.lenskart.com/v1/auth';

1570 let authOptions = {

1571 method: 'POST',

1572 headers: {

1573 'Content-Type': 'application/json',

1574 'Accept': 'application/json',

1575 'X-Lenskart-App-Id': 'connect',

1576 'X-Lenskart-API-Key': 'valyoo123',

1577 'Cookie': '__cf_bm=Pbosu4MHkZsUH02XQVJ7rPP5kN6BGYZsvydcFUR6wnk-1727068950-1.0.1.1-0c_G2gw0yUGhwOsrhnDJUBzRyUaXrbeQpw8hNcxLwdOXVeRradjFTnwm.PimMADZ2ctZPc793LMQArnsz6UIqw; __cfruid=3a09251544865452d64b8fe4c8ccabafbe765f53-1727068950',

1578 },

1579 body: JSON.stringify( { isEncodingRequired: true, password: '55eyetango123', userName: 'tango.eye' } ),

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L1579

1580 };

1581 const authResponse = await fetch( url, authOptions );

1582

1583 if ( !authResponse.ok ) {

1584 res.sendError( 'Token not found', 400 );

1585 }

1586

1587 let response = await authResponse.json();

1588 url = 'https://central.pos.lenskart.com/v1/user/api/storeAmMappings?pageNumber=1&pageSize=100';

1589 let mappingOptions = {

1590 method: 'GET',

1591 headers: {

1592 'accept': '*/*',

1593 'X-Lenskart-API-Key': 'valyoo123',

1594 'X-Lenskart-App-Id': 'connect',

1595 'X-Lenskart-Session-Token': `${response.sessionToken}`,

1596 'X-Api-Client': 'tango',

1597 'Cookie': '__cf_bm=wZmE1A4v745PfwlA92BGxPH2R5kHh3R9MdM_BEyjl1k-1726754172-1.0.1.1-yfUjGhyOedlNlQIZMKnOAIO1HBm336bjsnynmcCXCDOlnZfAz5eUq7nfOff4ZUfFCNwri_T08aeJsj8J1jo79w; __cf_bm=10uJnkQI0Ou_knGdtgd4lxAFzlPbIKYFj3pyt3epj9w-1727069223-1.0.1.1-AiAGvsODGksNcDRNbwy1o9kNEEfGJdcPh_se9d1HPjFPz3cogtSTfrEBbGCTRyoOTi.2YaC0pvAggs_IqMz7aQ; __cfruid=3a09251544865452d64b8fe4c8ccabafbe765f53-1727068950',

1598 },

1599 };

Lines 1633-1673javascript

1633 } catch ( error ) {

1634 logger.error( { function: 'aomupdateCollection', error: error } );

1635 res.sendError( error, 500 );

1636 }

1637};

1638

1639export async function saleUpdateCollection( req, res ) {

1640 try {

1641 let url = 'https://webservice.pos.lenskart.com/v1/auth';

1642 const authOptions = {

1643 method: 'POST',

1644 headers: {

1645 'Content-Type': 'application/json',

1646 'Accept': 'application/json',

1647 'X-Lenskart-App-Id': 'connect',

1648 'X-Lenskart-API-Key': 'valyoo123',

1649 'Cookie': '__cf_bm=Pbosu4MHkZsUH02XQVJ7rPP5kN6BGYZsvydcFUR6wnk-1727068950-1.0.1.1-0c_G2gw0yUGhwOsrhnDJUBzRyUaXrbeQpw8hNcxLwdOXVeRradjFTnwm.PimMADZ2ctZPc793LMQArnsz6UIqw; __cfruid=3a09251544865452d64b8fe4c8ccabafbe765f53-1727068950',

1650 },

1651 body: JSON.stringify( {

1652 isEncodingRequired: true,

1653 password: '55eyetango123',

Medium

Secret Pattern

Hardcoded password in src/controllers/internalTrax.controller.js

src/controllers/internalTrax.controller.jsView on unpkg · L1653

1654 userName: 'tango.eye',

1655 } ),

1656 };

1657 let authResponse = await fetch( url, authOptions );

1658

1659 if ( !authResponse.ok ) {

1660 res.sendError( 'Token not found', 400 );

1661 }

1662

1663 authResponse = await authResponse.json();

1664

1665 url='https://central.pos.lenskart.com/v1/user/api/storeSalesmanDetails?pageNumber=1&pageSize=100';

1666 const salesmanDetailsOptions = {

1667 method: 'GET',

1668 headers: {

1669 'accept': '*/*',

1670 'X-Lenskart-API-Key': 'valyoo123',

1671 'X-Lenskart-App-Id': 'connect',

1672 'X-Lenskart-Session-Token': `${authResponse.sessionToken}`,

1673 'X-Api-Client': 'tango',