registry / website-api / 1.2.10

website-api@1.2.10

CLI and library to query website private APIs with your real logged-in Chrome session

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 375 KB of source, external domains: 127.0.0.1, api.census.gov, api.e-zpassny.com, claude.ai, clients6.google.com, cursor.com, example.com, gemini.google.com, mysmartenergy.nj.pseg.com, ollama.com, raw.githubusercontent.com, secure.chase.com, tigerweb.geo.census.gov, voice.google.com, website-api-list.lgnat.com, www.e-zpassny.com, www.google.com, www.perplexity.ai, www.zillow.com

Source & flagged code

9 flagged

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

Lines 1-32javascript

1import { createHash } from "node:crypto";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */

10export const VOICE_API_BASE = "https://clients6.google.com/voice/v1/voiceclient";

11/** Public web-client API key embedded in voice.google.com's JS (not a secret). */

12export const VOICE_API_KEY = "AIzaSyDTYc1N4xiODyrQYK0Kl6g_y279LjYkrBg"; // secret-scan: allow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

13/** Origin the SAPISIDHASH is bound to (the app's real origin). */

14export const VOICE_ORIGIN = "https://voice.google.com";

15/** Host that actually serves the API (and that XD3 wants the Origin to match). */

16export const CLIENTS6_ORIGIN = "https://clients6.google.com";

17/** Full request URL for a voiceclient method. */

18export function voiceUrl(method) {

19 return `${VOICE_API_BASE}/${method}?alt=protojson&key=${VOICE_API_KEY}`;

20}

21/** Substring identifying the send-SMS response (used when driving the browser). */

22export const SEND_SMS_PATH = "/voiceclient/api2thread/sendsms";

23/**

24 * `sendsms` is gated by reCAPTCHA Enterprise (this site key) + a BotGuard token,

25 * both minted only by Google's in-browser anti-bot JS — so `send` can't go over

26 * pure HTTP and must drive the authenticated page instead.

27 */

28export const RECAPTCHA_SITE_KEY = "6Lfv4cYpAAAAABTKDTZu0jpcgdQ5Ak4XxeUBqA7B";

29export const RECAPTCHA_ACTION = "SEND_SMS";

30/** Builds the in-app conversation URL for a given target. */

31export function threadUrl(target, authUser = 0) {

32 return `https://voice.google.com/u/${authUser}/messages?itemId=${encodeURIComponent(toThreadId(target))}`;

dist/src/core/context.jsView file

Lines 168-208javascript

168 const outDir = options.outDir ? resolve(providers.cwd ?? process.cwd(), options.outDir) : null;

169 const save = createSaver(options.outDir ?? null, providers.cwd);

170 const saveFile

dist/src/core/registry.jsView file

Lines 440-480javascript

440 renameSync(stagingDir, dir);

441 if (backedUp)

442 removeTree(backupDir);

443 }

444 catch (err) {

445 removeTree(stagingDir);

446 if (backedUp && !existsSync(dir) &&

dist/src/capabilities/proxy.jsView file

Lines 1-32javascript

1import { ProxyAgent } from "undici";

2// mark: Constants

3const DEFAULT_PROXY_SCHEME = "socks5";

4const DEFAULT_PROXY_HOST = "127.0.0.1";

5const DEFAULT_PROXY_PORT = 1080;

dist/src/capabilities/browser.jsView file

Lines 1-29javascript

1/** Idle seconds before a managed headless browser auto-quits ("time to close"). */

2const IDLE_CLOSE_SECONDS = 10;

3function safeProxyLabel(value) {

4 const text = String(value);

5 try {

6 const

dist/src/capabilities/login/login-helper.jsView file

Lines 138-178javascript

138 if (debug)

139 console.log(`[LoginHelper] Already logged in. Skipping login flow.`);

140 return false;

141 }

142 // Resolve credentials lazily, only now that login is confirmed necessary.

143 let emailValue = options.emailValue;

144 let passwordValue

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

12patternName = google_api_key severity = high line = 12 matchedText = export d...Bg";

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.d.ts

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView on unpkg · L12

Source & flagged code

9 flagged · loading source

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = export c...llow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

12patternName = google_api_key severity = high line = 12 matchedText = export c...llow

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

2/** L3: * Google Voice's web app fetches data from a private JSON+protobuf API: L4: * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY> L5: * ... L96: "x-javascript-user-agent": "google-api-javascript-client/1.1.0", L97: "x-goog-encode-response-if-executable": "base64", L98: Cookie: cookieHeader,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

dist/src/core/context.jsView file

188browser, L189: async eval(fn, arg) { L190: const page = await browser();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/context.jsView on unpkg · L188

dist/src/core/registry.jsView file

460try { L461: mod = await import(pathToFileURL(filePath).href); L462: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/registry.jsView on unpkg · L460

dist/src/capabilities/proxy.jsView file

12patternName = generic_password severity = medium line = 12 matchedText = url.pass...d>";

Medium

Secret Pattern

Hardcoded password in dist/src/capabilities/proxy.js

dist/src/capabilities/proxy.jsView on unpkg · L12

dist/src/capabilities/browser.jsView file

9patternName = generic_password severity = medium line = 9 matchedText = url.pass...d>";

Medium

Secret Pattern

Hardcoded password in dist/src/capabilities/browser.js

dist/src/capabilities/browser.jsView on unpkg · L9

dist/src/capabilities/login/login-helper.jsView file

158patternName = generic_password severity = medium line = 158 matchedText = console....'`);

Medium

Secret Pattern

Hardcoded password in dist/src/capabilities/login/login-helper.js

dist/src/capabilities/login/login-helper.jsView on unpkg · L158

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

12patternName = google_api_key severity = high line = 12 matchedText = export d...Bg";

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.d.ts

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView on unpkg · L12

Findings

3 High6 Medium6 Low

HighHigh Secretdist/src/sites/voice.google.com/api/voice-helpers.js

HighSecret Patterndist/src/sites/voice.google.com/api/voice-helpers.js

HighSecret Patterndist/src/sites/voice.google.com/api/voice-helpers.d.ts

MediumDynamic Requiredist/src/core/registry.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/src/capabilities/proxy.js

MediumSecret Patterndist/src/capabilities/browser.js

MediumSecret Patterndist/src/capabilities/login/login-helper.js

LowScripts Present

LowEvaldist/src/core/context.js

LowWeak Cryptodist/src/sites/voice.google.com/api/voice-helpers.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/src/sites/voice.google.com/api/voice-helpers.jsView file

Lines 1-32javascript

1import { createHash } from "node:crypto";

2/**

3 * Google Voice's web app fetches data from a private JSON+protobuf API:

4 * POST https://clients6.google.com/voice/v1/voiceclient/<method>?alt=protojson&key=<API_KEY>

5 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L2

6 * It can be replayed over plain HTTP (no browser) once you mirror the exact

7 * cross-domain handshake the gapi client uses — see the long note in

8 * `voiceHeaders()`.

9 */

10export const VOICE_API_BASE = "https://clients6.google.com/voice/v1/voiceclient";

11/** Public web-client API key embedded in voice.google.com's JS (not a secret). */

12export const VOICE_API_KEY = "AIzaSyDTYc1N4xiODyrQYK0Kl6g_y279LjYkrBg"; // secret-scan: allow

High

High Secret

Package contains a high-severity secret pattern.

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.js

dist/src/sites/voice.google.com/api/voice-helpers.jsView on unpkg · L12

13/** Origin the SAPISIDHASH is bound to (the app's real origin). */

14export const VOICE_ORIGIN = "https://voice.google.com";

15/** Host that actually serves the API (and that XD3 wants the Origin to match). */

16export const CLIENTS6_ORIGIN = "https://clients6.google.com";

17/** Full request URL for a voiceclient method. */

18export function voiceUrl(method) {

19 return `${VOICE_API_BASE}/${method}?alt=protojson&key=${VOICE_API_KEY}`;

20}

21/** Substring identifying the send-SMS response (used when driving the browser). */

22export const SEND_SMS_PATH = "/voiceclient/api2thread/sendsms";

23/**

24 * `sendsms` is gated by reCAPTCHA Enterprise (this site key) + a BotGuard token,

25 * both minted only by Google's in-browser anti-bot JS — so `send` can't go over

26 * pure HTTP and must drive the authenticated page instead.

27 */

28export const RECAPTCHA_SITE_KEY = "6Lfv4cYpAAAAABTKDTZu0jpcgdQ5Ak4XxeUBqA7B";

29export const RECAPTCHA_ACTION = "SEND_SMS";

30/** Builds the in-app conversation URL for a given target. */

31export function threadUrl(target, authUser = 0) {

32 return `https://voice.google.com/u/${authUser}/messages?itemId=${encodeURIComponent(toThreadId(target))}`;

dist/src/core/context.jsView file

Lines 168-208javascript

168 const outDir = options.outDir ? resolve(providers.cwd ?? process.cwd(), options.outDir) : null;

169 const save = createSaver(options.outDir ?? null, providers.cwd);

170 const saveFile

dist/src/core/registry.jsView file

Lines 440-480javascript

440 renameSync(stagingDir, dir);

441 if (backedUp)

442 removeTree(backupDir);

443 }

444 catch (err) {

445 removeTree(stagingDir);

446 if (backedUp && !existsSync(dir) &&

dist/src/capabilities/proxy.jsView file

Lines 1-32javascript

1import { ProxyAgent } from "undici";

2// mark: Constants

3const DEFAULT_PROXY_SCHEME = "socks5";

4const DEFAULT_PROXY_HOST = "127.0.0.1";

5const DEFAULT_PROXY_PORT = 1080;

dist/src/capabilities/browser.jsView file

Lines 1-29javascript

1/** Idle seconds before a managed headless browser auto-quits ("time to close"). */

2const IDLE_CLOSE_SECONDS = 10;

3function safeProxyLabel(value) {

4 const text = String(value);

5 try {

6 const

dist/src/capabilities/login/login-helper.jsView file

Lines 138-178javascript

138 if (debug)

139 console.log(`[LoginHelper] Already logged in. Skipping login flow.`);

140 return false;

141 }

142 // Resolve credentials lazily, only now that login is confirmed necessary.

143 let emailValue = options.emailValue;

144 let passwordValue

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView file

12patternName = google_api_key severity = high line = 12 matchedText = export d...Bg";

High

Secret Pattern

Google API key in dist/src/sites/voice.google.com/api/voice-helpers.d.ts

dist/src/sites/voice.google.com/api/voice-helpers.d.tsView on unpkg · L12