@aryaminus/controlkeel 0.3.54 → 0.3.57

package/SECURITY.md

@@ -44,7 +44,7 @@ The package uses a **lazy download model** - the native binary is downloaded on
 |---------|---------------|------------------|
 | No Install Scripts | Removed all `postinstall` and lifecycle scripts | Code execution during install |
 | No Environment Variables | Removed all `process.env` usage; hardcoded configuration | Configuration-based attacks |
-| URL Encoding | Base64-encoded URL parts constructed at runtime | URL string detection by scanners |
+| Plain URLs | Plaintext, auditable URL strings (base64 removed) | Auditability; no hidden network destinations |
 | Hardcoded Repository | Fixed to `aryaminus/controlkeel` | Repository redirect attacks |
 | HTTPS Only | All downloads use HTTPS | Man-in-the-middle attacks |
 | SHA-256 Verification | Checksum verification against official releases | Tampered binary downloads |
@@ -88,17 +88,18 @@ The package uses a **lazy download model** - the native binary is downloaded on
 
 ### Alert: URL Strings
 
-- **Status**: ✅ RESOLVED
-- **Original Issue**: Package contained `https://github.com/...` URL strings
-- **Resolution**: URLs constructed from base64-encoded parts at runtime
-- **Implementation**:
-
-  ```javascript
-  const GITHUB_BASE = Buffer.from("aHR0cHM6Ly9naXRodWIuY29t", "base64").toString("utf8"); // "https://github.com"
-  const RELEASES_PATH = Buffer.from("L3JlbGVhc2VzLw==", "base64").toString("utf8"); // "/releases/"
-  ```
-
-- **Verification**: `grep -r "github\.com" --include="*.js"` returns no matches
+- **Status**: ✅ ACCEPTED (benign, intentional)
+- **Issue**: Socket flags that the package references external URL strings.
+- **Assessment**: The package references exactly two external URLs, both required and intentional:
+  - `https://github.com/aryaminus/controlkeel/releases/...` — the public GitHub Releases host the prebuilt binary is downloaded from.
+  - `https://token.actions.githubusercontent.com` — the OIDC issuer used by cosign keyless verification to confirm the downloaded binary was signed by this repo's `release.yml` workflow.
+- **Resolution**: URLs are kept as plain, auditable strings. They were previously
+  assembled from base64 parts at runtime to evade the scanner; that obfuscation
+  was removed because (a) runtime-decoded/base64 URLs are a pattern scanners treat
+  as *more* suspicious than plaintext, (b) it made the installer harder to audit,
+  and (c) it was already defeated by the plaintext URLs in the cosign step. The
+  correct posture is transparency plus cryptographic signature verification.
+- **Triage**: Informational alert — acknowledge in the Socket dashboard with the assessment above.
 
 ---
 
@@ -118,14 +119,19 @@ security_controls:
     rationale: "Prevents configuration-based attacks"
   
   url_handling:
-    encoding: "base64"
+    encoding: "plaintext"
+    url_strings_referenced:
+      - "https://github.com/aryaminus/controlkeel/releases — installer downloads binary, checksum, and optional cosign sig/cert from this base"
+      - "https://token.actions.githubusercontent.com — OIDC issuer string passed to cosign --certificate-oidc-issuer (not a direct HTTP endpoint; cosign contacts it)"
     hardcoded_repository: "aryaminus/controlkeel"
     hardcoded_version: "package.json"
-    rationale: "Prevents URL detection and repository redirects"
+    rationale: "Plain, auditable URLs; runtime obfuscation removed as a scanner anti-pattern"
   
   download_verification:
-    method: "SHA-256"
-    source: "GitHub Releases SHASUMS256.txt"
+    method: "SHA-256 (always); cosign keyless signature (when cosign is on PATH)"
+    source: "GitHub Releases SHASUMS256.txt + .sig/.pem"
+    cosign_identity: "release.yml workflow tag builds"
+    cosign_required: false
     https_only: true
   
   dependencies:

package/lib/install.js

@@ -12,19 +12,20 @@ const packageJson = require("../package.json");
 const REPOSITORY = "aryaminus/controlkeel";
 const VERSION = packageJson.version;
 
-// Base64 encoded URL parts to avoid supply chain scanners detecting URL strings
-const GITHUB_BASE = Buffer.from("aHR0cHM6Ly9naXRodWIuY29t", "base64").toString("utf8");
-const RELEASES_PATH = Buffer.from("L3JlbGVhc2VzLw==", "base64").toString("utf8");
-const LATEST_PART = Buffer.from("bGF0ZXN0L2Rvd25sb2Fk", "base64").toString("utf8");
-const DOWNLOAD_PART = Buffer.from("ZG93bmxvYWQv", "base64").toString("utf8");
-const VERSION_PREFIX = Buffer.from("dg==", "base64").toString("utf8");
+// Binary releases are downloaded from the project's public GitHub Releases and
+// their signatures verified with cosign (see verifySignature). This is the base
+// URL for all network egress this installer performs — binary, checksum file,
+// and optional cosign sig/cert artifacts all resolve from here. Kept as plain,
+// auditable strings: obfuscating them (e.g. base64 at runtime) is a pattern
+// supply-chain scanners treat as MORE suspicious, not less.
+const RELEASES_URL = `https://github.com/${REPOSITORY}/releases`;
 
 function releaseBaseUrl() {
   if (VERSION === "latest") {
-    return GITHUB_BASE + `/${REPOSITORY}` + RELEASES_PATH + LATEST_PART;
+    return `${RELEASES_URL}/latest/download`;
   }
 
-  return GITHUB_BASE + `/${REPOSITORY}` + RELEASES_PATH + DOWNLOAD_PART + VERSION_PREFIX + VERSION;
+  return `${RELEASES_URL}/download/v${VERSION}`;
 }
 
 function assetName(platform = process.platform, arch = process.arch) {
@@ -184,7 +185,7 @@ async function verifySignature(filePath, asset, baseUrl) {
 
   if (!cosignPath) return;
 
-  const repo = `${Buffer.from("YXJ5YW1pbnVzL2NvbnRyb2xrZWVs", "base64")}`;
+  const repo = REPOSITORY;
   const sigUrl = `${baseUrl}/${asset}.sig`;
   const certUrl = `${baseUrl}/${asset}.pem`;
   const sigFile = path.join(os.tmpdir(), `${asset}.sig`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryaminus/controlkeel",
-  "version": "0.3.54",
+  "version": "0.3.57",
   "description": "Bootstrap installer for the ControlKeel native CLI - a control plane for agent-generated software delivery.",
   "license": "Apache-2.0",
   "author": {

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/aryaminus/controlkeel.git",
     "source": "github"
   },
-  "version": "0.3.54",
+  "version": "0.3.57",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aryaminus/controlkeel",
-      "version": "0.3.54",
+      "version": "0.3.57",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"