registry / tencentcloud-sdk-nodejs / 4.1.266

tencentcloud-sdk-nodejs@4.1.266

腾讯云 API NODEJS SDK

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,298 file(s), 5.83 MB of source, external domains: metadata.tencentyun.com

Source & flagged code

1 flagged

tencentcloud/common/cvm_role_credential.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const tslib_1 = require("tslib");

4const fetch_1 = tslib_1.__importDefault(require("./http/fetch"));

5const META_URL = "http://metadata.tencentyun.com/latest/meta-data/";

6const ROLE_URL = META_URL + "cam/security-credentials/";

7const EXPIRE_BUFFER = 30 * 1000;

8/**

9 * Tencent Cloud Credential via CVM role

10 *

11 * Automatically generates temporary credentials when binding a service role to instance.

12 * @see {@link https://cloud.tencent.com/document/product/598/85616} for more information.

13 */

14class CvmRoleCredential {

15 // Method to fetch the role name from the metadata server

16 async getRoleName() {

17 const response = await (0, fetch_1.default)(ROLE_URL, {});

18 if (!response.ok) {

19 throw new Error("Get cvm role name failed, Please confirm whether the role is bound");

20 }

21 return await response.text();

22 }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

tencentcloud/common/cvm_role_credential.jsView on unpkg · L4

23 // Method to fetch credentials for a given role name

24 async getRoleCredential(roleName) {

Source & flagged code

1 flagged · loading source

tencentcloud/common/cvm_role_credential.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code