registry / unjwt / 0.7.3

unjwt@0.7.3

Low-level JWT utilities

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 193 KB of source

Source & flagged code

3 flagged

dist/core/jwk.d.mtsView file

Lines 265-305typescript

265*

266* // Explicit override.

267* const jwk2 = await importPEM(pemString, "RS256", { pemType: "x509" });

268* ```

269*/

270declare function importPEM<T extends JWK>(pem: string, alg: JWKPEMAlgorithm, options?: {

271 /** PEM type. Inferred from the PEM label when omitted. */pemType?: "pkcs8" | "spki" | "x509"; /** Additional JWK properties merged into the exported key (e.g. `kid`). */

272 jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;

273}): Promise<T>;

274/**

275* @deprecated Use {@link importPEM} instead. `pemType` has moved into the options object and

276* is now inferred from the PEM label by default.

277*/

278declare function importFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, options?: {

279 jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;

280}): Promise<T>;

281/**

282* Exports a JWK to a PEM-encoded string.

283*

284* The PEM format is inferred from the JWK shape:

285* - JWK with `d` (private component) → PKCS#8 (`-----BEGIN PRIVATE KEY-----`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/jwk.d.mtsView on unpkg · L285

Critical

Secret Pattern

RSA private key in dist/core/jwk.d.mts

dist/core/jwk.d.mtsView on unpkg · L285

286* - JWK without `d` → SubjectPublicKeyInfo (`-----BEGIN PUBLIC KEY-----`)

287*

288* X.509 certificate export is intentionally not supported: a certificate carries metadata

289* (subject/issuer DNs, validity window, extensions) and a CA signature that a JWK cannot provide.

290* Producing a cert is a CA operation, not a key-format conversion.

291*

292* Symmetric `oct` JWKs cannot be exported to PEM — PKCS#8/SPKI are asymmetric-key formats.

293*

294* @param jwk The JWK to export. Must not be `kty: "oct"`.

295* @param options

296* - `pemFormat?` — force the output format. Inferred from the JWK shape when omitted.

297* - `alg?` — algorithm hint used only when `jwk.alg` is absent (both `kty: "RSA"` / `"EC"` /

298* `"OKP"` JWKs need an algorithm to be round-tripped through `crypto.subtle.importKey`).

299* @throws `JWTError("ERR_JWK_UNSUPPORTED")` for `oct` JWKs, or an unrecognised `pemFormat`.

300* @throws `JWTError("ERR_JWK_INVALID")` if the JWK requires an `alg` hint that was not supplied,

301* or if `pemFormat` is forced to a value incompatible with the JWK's public/private shape.

302*

303* @example

304* ```ts

305* // Inferred — private JWKs become PKCS#8, public JWKs become SPKI.

dist/_chunks/jwk.mjsView file

Lines 1367-1407javascript

1367 });

1368 if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");

1369 const cryptoKey = cryptoKeyCandidate;

1370 switch (pemFormat) {

1371 case

Source & flagged code

3 flagged · loading source

dist/core/jwk.d.mtsView file

285patternName = private_key_rsa severity = critical line = 285 matchedText = * - JWK ...--`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/jwk.d.mtsView on unpkg · L285

285patternName = private_key_rsa severity = critical line = 285 matchedText = * - JWK ...--`)

Critical

Secret Pattern

RSA private key in dist/core/jwk.d.mts

dist/core/jwk.d.mtsView on unpkg · L285

dist/_chunks/jwk.mjsView file

1387patternName = private_key_rsa severity = critical line = 1387 matchedText = if (pem....s8";

Critical

Secret Pattern

RSA private key in dist/_chunks/jwk.mjs

dist/_chunks/jwk.mjsView on unpkg · L1387

Findings

3 Critical3 Low

CriticalCritical Secretdist/core/jwk.d.mts

CriticalSecret Patterndist/core/jwk.d.mts

CriticalSecret Patterndist/_chunks/jwk.mjs

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/core/jwk.d.mtsView file

Lines 265-305typescript

265*

266* // Explicit override.

267* const jwk2 = await importPEM(pemString, "RS256", { pemType: "x509" });

268* ```

269*/

270declare function importPEM<T extends JWK>(pem: string, alg: JWKPEMAlgorithm, options?: {

271 /** PEM type. Inferred from the PEM label when omitted. */pemType?: "pkcs8" | "spki" | "x509"; /** Additional JWK properties merged into the exported key (e.g. `kid`). */

272 jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;

273}): Promise<T>;

274/**

275* @deprecated Use {@link importPEM} instead. `pemType` has moved into the options object and

276* is now inferred from the PEM label by default.

277*/

278declare function importFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, options?: {

279 jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;

280}): Promise<T>;

281/**

282* Exports a JWK to a PEM-encoded string.

283*

284* The PEM format is inferred from the JWK shape:

285* - JWK with `d` (private component) → PKCS#8 (`-----BEGIN PRIVATE KEY-----`)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/core/jwk.d.mtsView on unpkg · L285

Critical

Secret Pattern

RSA private key in dist/core/jwk.d.mts

dist/core/jwk.d.mtsView on unpkg · L285

286* - JWK without `d` → SubjectPublicKeyInfo (`-----BEGIN PUBLIC KEY-----`)

287*

288* X.509 certificate export is intentionally not supported: a certificate carries metadata

289* (subject/issuer DNs, validity window, extensions) and a CA signature that a JWK cannot provide.

290* Producing a cert is a CA operation, not a key-format conversion.

291*

292* Symmetric `oct` JWKs cannot be exported to PEM — PKCS#8/SPKI are asymmetric-key formats.

293*

294* @param jwk The JWK to export. Must not be `kty: "oct"`.

295* @param options

296* - `pemFormat?` — force the output format. Inferred from the JWK shape when omitted.

297* - `alg?` — algorithm hint used only when `jwk.alg` is absent (both `kty: "RSA"` / `"EC"` /

298* `"OKP"` JWKs need an algorithm to be round-tripped through `crypto.subtle.importKey`).

299* @throws `JWTError("ERR_JWK_UNSUPPORTED")` for `oct` JWKs, or an unrecognised `pemFormat`.

300* @throws `JWTError("ERR_JWK_INVALID")` if the JWK requires an `alg` hint that was not supplied,

301* or if `pemFormat` is forced to a value incompatible with the JWK's public/private shape.

302*

303* @example

304* ```ts

305* // Inferred — private JWKs become PKCS#8, public JWKs become SPKI.

dist/_chunks/jwk.mjsView file

Lines 1367-1407javascript

1367 });

1368 if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");

1369 const cryptoKey = cryptoKeyCandidate;

1370 switch (pemFormat) {

1371 case