Documentation
¶
Overview ¶
Package npm provides a verifier for npm authentication tokens. It uses the npm registry GET /-/npm/v1/user endpoint to check token validity.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether an npm token is active by calling the npm registry. It NEVER logs or persists raw token values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected npm token is valid/active. Raw contains the token value.
This calls GET /-/npm/v1/user, matching docs/architecture/05-VERIFIER-ANALYSIS.md and docs/guides/secret-verification.md (the code previously called the lighter, undocumented /-/whoami endpoint, which is real and functionally equivalent, but disagreed with the documented egress target).
Source Files
Click to show internal directories.
Click to hide internal directories.