@contrast/core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): Test file exercising the agent's own eval-detection instrumentation. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Test asserting cloud metadata endpoint URL, not live exfil. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test fixture for sensitive-data-masking, not real file access. | ai | |
| phantom-deps | phantom-dep:@contrast/fn-inspect | AI (phantom-deps): Same-org scoped dep; likely used transitively or conditionally within the Contrast agent ecosystem. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @contrast/core is a long-established Contrast Security agent package, not a typosquat of cors. | ai | |
| phantom-deps | phantom-dep:@contrast/patcher | AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for transitive/re-exported deps within a monorepo. | ai | |
| phantom-deps | phantom-dep:@contrast/logger | AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for transitive/re-exported deps within a monorepo. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads a package.json file path resolved from env/filesystem, not arbitrary user input. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 1.66.0 | 10 / 0 | |
| 1.65.0 | 10 / 0 | |
| 1.64.0 | 10 / 0 | |
| 1.63.3 | 10 / 0 | |
| 1.63.2 | 10 / 0 | |
| 1.61.0 | 11 / 0 | |
| 1.60.1 | 11 / 0 | |
| 1.60.0 | 11 / 0 | |
| 1.59.1 | 11 / 0 | |
| 1.59.0 | 11 / 0 | |
| 1.58.0 | 11 / 0 | |
| 1.57.1 | 11 / 0 | |
| 1.57.0 | 11 / 0 | |
| 1.56.0 | 11 / 0 | |
| 1.55.0 | 10 / 0 | |
| 1.54.2 | 10 / 0 | |
| 1.54.1 | 10 / 0 | |
| 1.54.0 | 10 / 0 | |
| 1.53.0 | 10 / 0 | |
| 1.52.0 | 10 / 0 | |
| 1.51.0 | 10 / 0 | |
| 1.45.1 | 9 / 0 | |
| 1.45.0 | 9 / 0 | |
| 1.44.0 | 9 / 0 | |
| 1.43.0 | 8 / 0 | |
| 1.42.0 | 8 / 0 | |
| 1.41.1 | 8 / 0 | |
| 1.41.0 | 8 / 0 | |
| 1.40.0 | 8 / 0 | |
| 1.39.0 | 8 / 0 | |
| 1.38.0 | 8 / 0 | |
| 1.37.0 | 7 / 0 | |
| 1.36.0 | 7 / 0 | |
| 1.35.1 | 7 / 0 | |
| 1.35.0 | 4 / 0 | |
| 1.34.1 | 4 / 0 | |
| 1.34.0 | 4 / 0 | |
| 1.33.0 | 4 / 0 | |
| 1.32.3 | 3 / 0 | |
| 1.32.2 | 3 / 0 | |
| 1.32.1 | 3 / 0 | |
| 1.32.0 | 3 / 0 | |
| 1.31.2 | 3 / 0 |
v1.66.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.1
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.44.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.43.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.1
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.38.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.1
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.34.1
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.34.0
11 findingseval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 43 | 44 | it('handles `eval`', function () { > 45 | const snapshot = eval('core.createSnapshot()'); 46 | const result = snapshot(); 47 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 34 | parsedParams = { cvv }; 35 | parsedCookies = { ssn }; > 36 | parsedBody = { ssn, input: '../../etc/passwd' }; 37 | 38 | trackRequest = true;
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(protect.parsedBody).to.deep.equal({ 153 | ssn: 'contrast-redacted-government-id', > 154 | input: '../../etc/passwd' 155 | }); 156 | expect(
HTTP request to raw IP address — legitimate packages use domain names 30 | expect(axios).to.have.been.calledWithMatch({ 31 | method: 'PUT', > 32 | url: 'http://169.254.169.254/latest/api/token', 33 | headers: { 34 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 37 | expect(axios).to.have.been.calledWithMatch({ 38 | method: 'GET', > 39 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 40 | headers: { 41 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 56 | expect(axios).to.have.been.calledWithMatch({ 57 | method: 'PUT', > 58 | url: 'http://169.254.169.254/latest/api/token', 59 | headers: { 60 | 'X-aws-ec2-metadata-token-ttl-seconds': '300'
HTTP request to raw IP address — legitimate packages use domain names 64 | expect(axios).to.have.been.calledWithMatch({ 65 | method: 'GET', > 66 | url: 'http://169.254.169.254/latest/dynamic/instance-identity/document', 67 | headers: { 68 | 'X-aws-ec2-metadata-token': 'foo'
HTTP request to raw IP address — legitimate packages use domain names 84 | expect(axios).to.have.been.calledWithMatch({ 85 | method: 'GET', > 86 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 87 | headers: { 88 | Metadata: 'true'
HTTP request to raw IP address — legitimate packages use domain names 110 | expect(axios).to.have.been.calledWithMatch({ 111 | method: 'GET', > 112 | url: 'http://169.254.169.254/computeMetadata/v1/instance/id?alt=text', 113 | headers: { 114 | 'Metadata-Flavor': 'Google'
HTTP request to raw IP address — legitimate packages use domain names 150 | it('handles a single valid response', async function () { 151 | axios.withArgs(sinon.match({ > 152 | url: 'http://169.254.169.254/metadata/instance/compute/resourceId?api-version=2021-02-01&format=text', 153 | })).resolves({ data: 'azure-resource-identifier' }); 154 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.