verdaccio-okta-oauth@38.3.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

verdaccio-okta-oauth@38.3.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = dist/cli.js matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

src/cli.tsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = src/cli.ts matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli.tsView on unpkg

11const registry = (argv.registry ?? execSync('npm config get registry').toString()) .trim() .replace(/\/?$/, '/'); if (registry.includes('registry.npmjs.org')) { throw new Error('This is incompatible with the default npm repository.'); } open(registry + 'oauth/authorize');

Low

Ai Review Evidence

The CLI opens the configured private registry OAuth route and saves its returned registry token.

src/cli.tsView on unpkg · L11

46const { host, pathname } = new URL(registry); execSync(`npm config set --no-workspaces //${host}${pathname}:_authToken "${npm_token}"`); res.writeHead(302, { Location: `${redirect_uri}?${new URLSearchParams({ username, token: jwt_token, }).toString()}`,

Low

Ai Review Evidence

The CLI opens the configured private registry OAuth route and saves its returned registry token.

src/cli.tsView on unpkg · L46

src/index.tsView file

136app.use('/oauth/authorize', (req, res) => { const state = uuid(); const codeVerifier = uuid() + uuid(); secrets.set(state, codeVerifier); res.redirect( `${issuer}/oauth2/v1/authorize?${new URLSearchParams({ state, client_id: clientId, response_type: 'code', scope: 'openid profile email offline_access', redirect_uri: getCallbackUrl(req), code_challenge_method: 'S256', code_challenge:

Medium

Stripped Provenance Metadata

Plugin network calls are OAuth authorization, token, and userinfo operations against configured issuer.

src/index.tsView on unpkg · L136

src/secrets.tsView file

14this.storage = path.join(cwd, '.secrets'); if (!fs.existsSync(this.storage)) { fs.mkdirSync(this.storage); } const storage = this.storage; setTimeout(function cleanup() { for (const file of fs.readdirSync(storage)) { const { ctimeMs } = fs.statSync(path.join(storage, file)); if (Date.now() > ctimeMs + ttl) { fs.rmSync(path.join(storage, file)); } } setTimeout(cleanup, checkperiod);

Low

Ai Review Evidence

Temporary OAuth verifier storage is scoped to the configured storage directory and expires.

src/secrets.tsView on unpkg · L14

Source & flagged code

6 flagged

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = dist/cli.js matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

src/cli.tsView file

Lines 1-60typescript

1/* eslint-disable @typescript-eslint/naming-convention */

2import { execSync } from 'child_process';

3import http from 'http';

4import open from 'open';

5import url from 'url';

6import yargs, { Arguments } from 'yargs';

7import { hideBin } from 'yargs/helpers';

8

9const argv = yargs(hideBin(process.argv)).argv as Arguments<{ registry?: string }>;

10

11const registry = (argv.registry ?? execSync('npm config get registry').toString())

12 .trim()

13 .replace(/\/?$/, '/');

14

15if (registry.includes('registry.npmjs.org')) {

16 throw new Error('This is incompatible with the default npm repository.');

17}

18

19open(registry + 'oauth/authorize');

Low

Ai Review Evidence

The CLI opens the configured private registry OAuth route and saves its returned registry token.

src/cli.tsView on unpkg · L11

20

21http.createServer((req, res) => {

22 if (!req.url) {

23 throw new Error('Request URL is not defined!');

24 }

25

26 const {

27 query: { username, jwt_token, npm_token, redirect_uri },

28 } = url.parse(req.url, true);

29

30 if (typeof username !== 'string') {

31 throw new Error('"username" should be a string value!');

32 }

33

34 if (typeof jwt_token !== 'string') {

35 throw new Error('"jwt_token" should be a string value!');

36 }

37

38 if (typeof npm_token !== 'string') {

39 throw new Error('"npm_token" should be a string value!');

40 }

41

42 if (typeof redirect_uri !== 'string') {

43 throw new Error('"redirect_uri" should be a string value!');

44 }

45

46 const { host, pathname } = new URL(registry);

47

48 execSync(`npm config set --no-workspaces //${host}${pathname}:_authToken "${npm_token}"`);

49

50 res.writeHead(302, {

51 Location: `${redirect_uri}?${new URLSearchParams({

52 username,

53 token: jwt_token,

54 }).toString()}`,

Low

Ai Review Evidence

The CLI opens the configured private registry OAuth route and saves its returned registry token.

src/cli.tsView on unpkg · L46

55 });

56 res.end(() => {

57 process.exit(0);

58 });

59}).listen(8239);

60

•matchType = normalized_sha256 matchedPackage = verdaccio-okta-oauth@38.1.6 matchedPath = src/cli.ts matchedIdentity = npm:dmVyZGFjY2lvLW9rdGEtb2F1dGg:38.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli.tsView on unpkg

src/index.tsView file

Lines 116-156typescript

116 `<script>`,

117 `const keys = ['username', 'token'];`,

118 `const searchParams = new URLSearchParams(window.location.search);`,

119 `if (keys.every(key => searchParams.has(key))) {`,

120 ` for (const key of keys) {`,

121 ` window.localStorage.setItem(key, searchParams.get(key));`,

src/secrets.tsView file

Lines 1-34typescript

1import fs from 'fs';

2import path from 'path';

3

4export interface SecretsOptions {

5 cwd: string;