verdaccio-okta-oauth: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

verdaccio-okta-oauth: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = dist/cli.js matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

src/cli.tsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = src/cli.ts matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli.tsView on unpkg

11const registry = (argv.registry ?? execSync('npm config get registry').toString()) .trim() .replace(/\/?$/, '/'); if (registry.includes('registry.npmjs.org')) { throw new Error('This is incompatible with the default npm repository.'); } open(registry + 'oauth/authorize');

Low

Ai Review Evidence

The explicit CLI opens the configured private registry OAuth endpoint and sets that registry's npm auth token.

src/cli.tsView on unpkg · L11

46const { host, pathname } = new URL(registry); execSync(`npm config set --no-workspaces //${host}${pathname}:_authToken "${npm_token}"`); res.writeHead(302, { Location: `${redirect_uri}?${new URLSearchParams({ username, token: jwt_token,

Low

Ai Review Evidence

The explicit CLI opens the configured private registry OAuth endpoint and sets that registry's npm auth token.

src/cli.tsView on unpkg · L46

src/index.tsView file

190({ access_token: accessToken, refresh_token: refreshToken } = ( await axios.post( `${issuer}/oauth2/v1/token`, new URLSearchParams({ client_id: clientId, grant_type: 'authorization_code', redirect_uri: getCallbackUrl(req), code_verifier: codeVerifier, code,

Low

Ai Review Evidence

The Verdaccio plugin exchanges OAuth tokens with its configured issuer and returns the user to localhost.

src/index.tsView on unpkg · L190

228`http://localhost:8239?${new URLSearchParams({ username, jwt_token: await auth.jwtEncrypt( { name: username, groups: [...groups, ...defaultLoggedUserRoles], real_groups: groups, }, this.sign ?? {} ), npm_token: auth .aesEncrypt(Buffer.from(`${username}:${refreshToken}`)) .toString('base64'),

Low

Ai Review Evidence

The Verdaccio plugin exchanges OAuth tokens with its configured issuer and returns the user to localhost.

src/index.tsView on unpkg · L228

Source & flagged code

6 flagged

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = dist/cli.js matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

src/cli.tsView file

Lines 1-60typescript

1/* eslint-disable @typescript-eslint/naming-convention */

2import { execSync } from 'child_process';

3import http from 'http';

4import open from 'open';

5import url from 'url';

6import yargs, { Arguments } from 'yargs';

7import { hideBin } from 'yargs/helpers';

8

9const argv = yargs(hideBin(process.argv)).argv as Arguments<{ registry?: string }>;

10

11const registry = (argv.registry ?? execSync('npm config get registry').toString())

12 .trim()

13 .replace(/\/?$/, '/');

14

15if (registry.includes('registry.npmjs.org')) {

16 throw new Error('This is incompatible with the default npm repository.');

17}

18

19open(registry + 'oauth/authorize');

Low

Ai Review Evidence

The explicit CLI opens the configured private registry OAuth endpoint and sets that registry's npm auth token.

src/cli.tsView on unpkg · L11

20

21http.createServer((req, res) => {

22 if (!req.url) {

23 throw new Error('Request URL is not defined!');

24 }

25

26 const {

27 query: { username, jwt_token, npm_token, redirect_uri },

28 } = url.parse(req.url, true);

29

30 if (typeof username !== 'string') {

31 throw new Error('"username" should be a string value!');

32 }

33

34 if (typeof jwt_token !== 'string') {

35 throw new Error('"jwt_token" should be a string value!');

36 }

37

38 if (typeof npm_token !== 'string') {

39 throw new Error('"npm_token" should be a string value!');

40 }

41

42 if (typeof redirect_uri !== 'string') {

43 throw new Error('"redirect_uri" should be a string value!');

44 }

45

46 const { host, pathname } = new URL(registry);

47

48 execSync(`npm config set --no-workspaces //${host}${pathname}:_authToken "${npm_token}"`);

49

50 res.writeHead(302, {

51 Location: `${redirect_uri}?${new URLSearchParams({

52 username,

53 token: jwt_token,

Low

Ai Review Evidence

The explicit CLI opens the configured private registry OAuth endpoint and sets that registry's npm auth token.

src/cli.tsView on unpkg · L46

54 }).toString()}`,

55 });

56 res.end(() => {

57 process.exit(0);

58 });

59}).listen(8239);

60

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = src/cli.ts matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli.tsView on unpkg

src/index.tsView file

Lines 170-248typescript

170 }

171

172 if (typeof state !== 'string') {

173 this.logger.error(

174 'OktaOAuth Middleware: "/oauth/authorize" returned invalid "state"!'

175 );

176 res.