registry / website-api / 1.2.1

website-api@1.2.1

CLI and library to query website private APIs with your real logged-in Chrome session

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 264 KB of source, external domains: api.census.gov, api.e-zpassny.com, claude.ai, clients6.google.com, cursor.com, gemini.google.com, mysmartenergy.nj.pseg.com, ollama.com, raw.githubusercontent.com, secure.chase.com, tigerweb.geo.census.gov, voice.google.com, website-api-list.lgnat.com, www.e-zpassny.com, www.google.com, www.perplexity.ai, www.zillow.com

Source & flagged code

7 flagged

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

Lines 1-32javascript

1import { createHash } from "node:crypto";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */

10export const VOICE_API_BASE = "https://clients6.google.com/voice/v1/voiceclient";

11/** Public web-client API key embedded in voice.google.com's JS (not a secret). */

12export const VOICE_API_KEY = "AIzaSyDTYc1N4xiODyrQYK0Kl6g_y279LjYkrBg"; // secret-scan: allow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

13/** Origin the SAPISIDHASH is bound to (the app's real origin). */

14export const VOICE_ORIGIN = "https://voice.google.com";

15/** Host that actually serves the API (and that XD3 wants the Origin to match). */

16export const CLIENTS6_ORIGIN = "https://clients6.google.com";

17/** Full request URL for a voiceclient method. */

18export function voiceUrl(method) {

19 return `${VOICE_API_BASE}/${method}?alt=protojson&key=${VOICE_API_KEY}`;

20}

21/** Substring identifying the send-SMS response (used when driving the browser). */

22export const SEND_SMS_PATH = "/voiceclient/api2thread/sendsms";

23/**

24 * `sendsms` is gated by reCAPTCHA Enterprise (this site key) + a BotGuard token,

25 * both minted only by Google's in-browser anti-bot JS — so `send` can't go over

26 * pure HTTP and must drive the authenticated page instead.

27 */

28export const RECAPTCHA_SITE_KEY = "6Lfv4cYpAAAAABTKDTZu0jpcgdQ5Ak4XxeUBqA7B";

29export const RECAPTCHA_ACTION = "SEND_SMS";

30/** Builds the in-app conversation URL for a given target. */

31export function threadUrl(target, authUser = 0) {

32 return `https://voice.google.com/u/${authUser}/messages?itemId=${encodeURIComponent(toThreadId(target))}`;

dist/src/core/context.jsView file

Lines 114-154javascript

114 }

115 throw err;

116 });

117 }

118 return pagePromise;

119 };

120 const outDir = options.outDir ? resolve(providers.cwd ?? process.cwd(), options.outDir) :

dist/src/core/registry.jsView file

Lines 288-328javascript

288 const target = join(dir, name);

289 mkdirSync(dirname(target), { recursive: true });

290 writeFileSync(target, buf);

291 }

292 // Validate it loads as a site whose id matches the catalog.

293 await assertLoadsAsSite(join

dist/src/capabilities/login/login-helper.jsView file

Lines 134-174javascript

134 if (debug)

135 console.log(`[LoginHelper] Already logged in. Skipping login flow.`);

136 return false;

137 }

138 // Resolve credentials lazily, only now that login is confirmed necessary.

139 let emailValue = options.emailValue;

140 let passwordValue

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

Lines 1-32typescript

1import type { CookieEntry } from "chrome-tools";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */

Source & flagged code

7 flagged · loading source

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = export c...llow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

12patternName = google_api_key severity = high line = 12 matchedText = export c...llow

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

2/** L3: * Google Voice's web app fetches data from a private JSON+protobuf API: L4: * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY> L5: * ... L96: "x-javascript-user-agent": "google-api-javascript-client/1.1.0", L97: "x-goog-encode-response-if-executable": "base64", L98: Cookie: cookieHeader,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

dist/src/core/context.jsView file

134browser, L135: async eval(fn, arg) { L136: const page = await browser();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/context.jsView on unpkg · L134

dist/src/core/registry.jsView file

308try { L309: mod = await import(pathToFileURL(filePath).href); L310: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/registry.jsView on unpkg · L308

dist/src/capabilities/login/login-helper.jsView file

154patternName = generic_password severity = medium line = 154 matchedText = console....'`);

Medium

Secret Pattern

Hardcoded password in dist/src/capabilities/login/login-helper.js

dist/src/capabilities/login/login-helper.jsView on unpkg · L154

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

12patternName = google_api_key severity = high line = 12 matchedText = export d...Bg";

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.d.ts

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView on unpkg · L12

Findings

3 High4 Medium6 Low

HighHigh Secretdist/src/sites/voice.google.com/api/voice-helpers.js

HighSecret Patterndist/src/sites/voice.google.com/api/voice-helpers.js

HighSecret Patterndist/src/sites/voice.google.com/api/voice-helpers.d.ts

MediumDynamic Requiredist/src/core/registry.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/src/capabilities/login/login-helper.js

LowScripts Present

LowEvaldist/src/core/context.js

LowWeak Cryptodist/src/sites/voice.google.com/api/voice-helpers.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

Lines 1-32javascript

1import { createHash } from "node:crypto";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */

10export const VOICE_API_BASE = "https://clients6.google.com/voice/v1/voiceclient";

11/** Public web-client API key embedded in voice.google.com's JS (not a secret). */

12export const VOICE_API_KEY = "AIzaSyDTYc1N4xiODyrQYK0Kl6g_y279LjYkrBg"; // secret-scan: allow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

13/** Origin the SAPISIDHASH is bound to (the app's real origin). */

14export const VOICE_ORIGIN = "https://voice.google.com";

15/** Host that actually serves the API (and that XD3 wants the Origin to match). */

16export const CLIENTS6_ORIGIN = "https://clients6.google.com";

17/** Full request URL for a voiceclient method. */

18export function voiceUrl(method) {

19 return `${VOICE_API_BASE}/${method}?alt=protojson&key=${VOICE_API_KEY}`;

20}

21/** Substring identifying the send-SMS response (used when driving the browser). */

22export const SEND_SMS_PATH = "/voiceclient/api2thread/sendsms";

23/**

24 * `sendsms` is gated by reCAPTCHA Enterprise (this site key) + a BotGuard token,

25 * both minted only by Google's in-browser anti-bot JS — so `send` can't go over

26 * pure HTTP and must drive the authenticated page instead.

27 */

28export const RECAPTCHA_SITE_KEY = "6Lfv4cYpAAAAABTKDTZu0jpcgdQ5Ak4XxeUBqA7B";

29export const RECAPTCHA_ACTION = "SEND_SMS";

30/** Builds the in-app conversation URL for a given target. */

31export function threadUrl(target, authUser = 0) {

32 return `https://voice.google.com/u/${authUser}/messages?itemId=${encodeURIComponent(toThreadId(target))}`;

dist/src/core/context.jsView file

Lines 114-154javascript

114 }

115 throw err;

116 });

117 }

118 return pagePromise;

119 };

120 const outDir = options.outDir ? resolve(providers.cwd ?? process.cwd(), options.outDir) :

dist/src/core/registry.jsView file

Lines 288-328javascript

288 const target = join(dir, name);

289 mkdirSync(dirname(target), { recursive: true });

290 writeFileSync(target, buf);

291 }

292 // Validate it loads as a site whose id matches the catalog.

293 await assertLoadsAsSite(join

dist/src/capabilities/login/login-helper.jsView file

Lines 134-174javascript

134 if (debug)

135 console.log(`[LoginHelper] Already logged in. Skipping login flow.`);

136 return false;

137 }

138 // Resolve credentials lazily, only now that login is confirmed necessary.

139 let emailValue = options.emailValue;

140 let passwordValue

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

Lines 1-32typescript

1import type { CookieEntry } from "chrome-tools";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */