취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c14d60a97b056e00cb3055bd07605c2f16482794e5860fee68cab46f308893d)

The package tarball includes a Google Cloud service-account JSON file (fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json) containing a live RSA private key for the service account firebase-adminsdk-k7lom@tango-trax.iam.gserviceaccount.com in the tango-trax Firebase/GCP project. Any installer receives admin credentials in their node_modules and can authenticate against the project's Firestore, Realtime Database, FCM, Auth, and Storage with full Admin SDK privileges — meaning end-users of the Tango/Trax service can be read or modified by anyone who installs this package. This is third-party credential redistribution, distinct from author self-harm: the credentials grant access to a production system holding other users' data, not just to the author's personal accounts. The package additionally hardcodes an AWS Lambda function URL (https://f65azvtljclaxp6l7rnx65cdmm0lcgvp.lambda-url.ap-south-1.on.aws) referenced from POST/fetch calls in src/controllers/teaxFlag.controller.js, indicating the package is an internal backend that should never have been published to a public registry.