registry / y9plugin-sso-l / 4.3.1

y9plugin-sso-l@4.3.1

# y9plugin-sso 插件使用说明

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 128 KB of source

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 1938-1978javascript

1938 array: [

1939 new c.asn1.DERInteger({ bigint: this.n }),

1940 new c.asn1.DERInteger({ int: this.e })

1941 ]

1942 }), i = new c.asn1.DERBitString({

1943 hex: "00" + r.getEncodedHex()

1944 }), s = new c.asn1.DERSequence({

1945 array: [e, i]

1946 });

1947 return s.getEncodedHex();

1948 }, t.prototype.getPublicBaseKeyB64 = function() {

1949 return at(this.getPublicBaseKey());

1950 }, t.wordwrap = function(e, r) {

1951 if (r = r || 64, !e)

1952 return e;

1953 var i = "(.{1," + r + `})( +|$

1954?)|(.{1,` + r + "})";

1955 return e.match(RegExp(i, "g")).join(`

1956`);

1957 }, t.prototype.getPrivateKey = function() {

1958 var e = `-----BEGIN RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.mjsView on unpkg · L1958

Critical

Secret Pattern

RSA private key in dist/index.mjs

dist/index.mjsView on unpkg · L1958

1959`;

1960 return e += t.wordwrap(this.getPrivateBaseKeyB64()) + `

1961`, e += "-----END RSA PRIVATE KEY-----", e;

1962 }, t.prototype.getPublicKey = function() {

1963 var e = `-----BEGIN PUBLIC KEY-----

1964`;

1965 return e += t.wordwrap(this.getPublicBaseKeyB64()) + `

1966`, e += "-----END PUBLIC KEY-----", e;

1967 }, t.hasPublicKeyProperty = function(e) {

1968 return e = e || {}, e.hasOwnProperty("n") && e.hasOwnProperty("e");

1969 }, t.hasPrivateKeyProperty = function(e) {

1970 return e = e || {}, e.hasOwnProperty("n") && e.hasOwnProperty("e") && e.hasOwnProperty("d") && e.hasOwnProperty("p") && e.hasOwnProperty("q") && e.hasOwnProperty("dmp1") && e.hasOwnProperty("dmq1") && e.

1971 }, t.prototype.parsePropertiesFrom = function(e) {

1972 this.n = e.n, this.e = e.e, e.hasOwnProperty("d") && (this.d = e.d, this.p = e.p, this.q = e.q, this.dmp1 = e.dmp1, this.dmq1 = e.dmq1, this.coeff = e.coeff);

1973 }, t;

1974 }(Lr)

1975), Dt, kr = typeof process < "u" ? (Dt = process.env) === null || Dt === void 0 ? void 0 : Dt.npm_package_version : void 0, qr = (

1976 /** @class */

1977 function() {

1978 function n(t) {

Source & flagged code

2 flagged · loading source

dist/index.mjsView file

1958patternName = private_key_rsa severity = critical line = 1958 matchedText = var e = ...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.mjsView on unpkg · L1958

1958patternName = private_key_rsa severity = critical line = 1958 matchedText = var e = ...----

Critical

Secret Pattern

RSA private key in dist/index.mjs

dist/index.mjsView on unpkg · L1958

Findings

2 Critical2 Medium2 Low

CriticalCritical Secretdist/index.mjs

CriticalSecret Patterndist/index.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 1938-1978javascript

1938 array: [

1939 new c.asn1.DERInteger({ bigint: this.n }),

1940 new c.asn1.DERInteger({ int: this.e })

1941 ]

1942 }), i = new c.asn1.DERBitString({

1943 hex: "00" + r.getEncodedHex()

1944 }), s = new c.asn1.DERSequence({

1945 array: [e, i]

1946 });

1947 return s.getEncodedHex();

1948 }, t.prototype.getPublicBaseKeyB64 = function() {

1949 return at(this.getPublicBaseKey());

1950 }, t.wordwrap = function(e, r) {

1951 if (r = r || 64, !e)

1952 return e;

1953 var i = "(.{1," + r + `})( +|$

1954?)|(.{1,` + r + "})";

1955 return e.match(RegExp(i, "g")).join(`

1956`);

1957 }, t.prototype.getPrivateKey = function() {

1958 var e = `-----BEGIN RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.mjsView on unpkg · L1958

Critical

Secret Pattern

RSA private key in dist/index.mjs

dist/index.mjsView on unpkg · L1958

1959`;

1960 return e += t.wordwrap(this.getPrivateBaseKeyB64()) + `

1961`, e += "-----END RSA PRIVATE KEY-----", e;

1962 }, t.prototype.getPublicKey = function() {

1963 var e = `-----BEGIN PUBLIC KEY-----

1964`;

1965 return e += t.wordwrap(this.getPublicBaseKeyB64()) + `

1966`, e += "-----END PUBLIC KEY-----", e;

1967 }, t.hasPublicKeyProperty = function(e) {

1968 return e = e || {}, e.hasOwnProperty("n") && e.hasOwnProperty("e");

1969 }, t.hasPrivateKeyProperty = function(e) {

1971 }, t.prototype.parsePropertiesFrom = function(e) {

1972 this.n = e.n, this.e = e.e, e.hasOwnProperty("d") && (this.d = e.d, this.p = e.p, this.q = e.q, this.dmp1 = e.dmp1, this.dmq1 = e.dmq1, this.coeff = e.coeff);

1973 }, t;

1974 }(Lr)

1975), Dt, kr = typeof process < "u" ? (Dt = process.env) === null || Dt === void 0 ? void 0 : Dt.npm_package_version : void 0, qr = (

1976 /** @class */

1977 function() {

1978 function n(t) {