@mnemonik/shared 7.131.0 → 7.131.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/secretPatterns.d.ts
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAGzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAoDjD,CAAC;AA4HF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWjD"}
|
package/dist/secretPatterns.js
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -83,6 +84,15 @@ export const SECRET_PATTERNS = [
|
|
|
83
84
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
84
85
|
// destroy the instruction without hiding a secret.
|
|
85
86
|
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
87
|
+
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
88
|
+
// password word is consumed, so the command stays readable. A shell
|
|
89
|
+
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|
|
90
|
+
// and quoted punctuation are left, and so is prose about the flag: a bare all-lower-case
|
|
91
|
+
// word counts only when the command sshpass runs (ssh, scp, ...) follows it.
|
|
92
|
+
// Eleven scanned chunks in production carried a root password this way
|
|
93
|
+
// (2026-10-12); the server's memory redactor (src/core/redactCredentials.ts)
|
|
94
|
+
// has the same rule.
|
|
95
|
+
/(?<=\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(?:'(?![$<]|\[REDACTED\])(?=[^'\n]*[A-Za-z0-9])[^'\n]+'|"(?![$<]|\[REDACTED\])(?=[^"\n]*[A-Za-z0-9])[^"\n]+"|(?![$<'"`(),[{\\]|\[REDACTED\]|[a-z]+[.,:;!?)]*(?![^\s'"`])(?![ \t]+(?:ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*)(?![\w-])))[^\s'"`;|&]+)/g,
|
|
86
96
|
];
|
|
87
97
|
/**
|
|
88
98
|
* Replace recognized secret shapes in `text` with the redaction
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qHAAqH;IACrH,yDAAyD;IACzD,0EAA0E;IAC1E,mEAAmE;IACnE,uBAAuB;IACvB,uBAAuB;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,yDAAyD;IACzD,yEAAyE;IACzE,oCAAoC;IACpC,mEAAmE;IACnE,mCAAmC;IACnC,4BAA4B;IAC5B,gCAAgC;IAChC,qCAAqC;IACrC,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,sCAAsC;IACtC,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,qDAAqD;IACrD,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,yFAAyF;IACzF,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,qBAAqB;IACrB,kTAAkT;CACnT,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEA0CwE;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC5F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,8BAA8B,CAAC,EACjF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtF,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM;aAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
|
package/package.json
CHANGED
package/src/secretPatterns.ts
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -85,6 +86,15 @@ export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
|
|
|
85
86
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
86
87
|
// destroy the instruction without hiding a secret.
|
|
87
88
|
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
89
|
+
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
90
|
+
// password word is consumed, so the command stays readable. A shell
|
|
91
|
+
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|
|
92
|
+
// and quoted punctuation are left, and so is prose about the flag: a bare all-lower-case
|
|
93
|
+
// word counts only when the command sshpass runs (ssh, scp, ...) follows it.
|
|
94
|
+
// Eleven scanned chunks in production carried a root password this way
|
|
95
|
+
// (2026-10-12); the server's memory redactor (src/core/redactCredentials.ts)
|
|
96
|
+
// has the same rule.
|
|
97
|
+
/(?<=\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(?:'(?![$<]|\[REDACTED\])(?=[^'\n]*[A-Za-z0-9])[^'\n]+'|"(?![$<]|\[REDACTED\])(?=[^"\n]*[A-Za-z0-9])[^"\n]+"|(?![$<'"`(),[{\\]|\[REDACTED\]|[a-z]+[.,:;!?)]*(?![^\s'"`])(?![ \t]+(?:ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*)(?![\w-])))[^\s'"`;|&]+)/g,
|
|
88
98
|
];
|
|
89
99
|
|
|
90
100
|
/**
|