← back to Security Dashboard
add fleet-sweep hardcoded-credential leaks card (4 creds + dear-bubbe malware) with vscode open-at-line + provider regen links
b43759b0e1182888fce2a35647b390f2f34e6977 · 2026-05-31 17:10:39 -0700 · SteveStudio2
Files touched
A data/code-leaks.jsonM public/index.htmlM server.js
Diff
commit b43759b0e1182888fce2a35647b390f2f34e6977
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date: Sun May 31 17:10:39 2026 -0700
add fleet-sweep hardcoded-credential leaks card (4 creds + dear-bubbe malware) with vscode open-at-line + provider regen links
---
data/code-leaks.json | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++
public/index.html | 30 ++++++++++++++++++++++++++++
server.js | 8 +++++++-
3 files changed, 92 insertions(+), 1 deletion(-)
diff --git a/data/code-leaks.json b/data/code-leaks.json
new file mode 100644
index 0000000..0eed4c3
--- /dev/null
+++ b/data/code-leaks.json
@@ -0,0 +1,55 @@
+{
+ "source": "fleet static-debug sweep — 306 git projects, 2026-05-31",
+ "leaks": [
+ {
+ "severity": "critical",
+ "service": "Shopify Admin API token",
+ "last4": "75b9",
+ "project": "mfr-review-viewer",
+ "file_abs": "/Users/stevestudio2/Projects/mfr-review-viewer/server.js",
+ "line": 197,
+ "scope": "LIVE store designer-laboratory-sandbox · MUTATE+DELETE",
+ "regen_url": "https://admin.shopify.com/store/designer-laboratory-sandbox/settings/apps/development",
+ "note": "Has its own SECURITY-HOLD.md; rotate FIRST, then delete that file to un-suspend the repo."
+ },
+ {
+ "severity": "high",
+ "service": "ElevenLabs API key",
+ "last4": "1770",
+ "project": "dear-bubbe-nextjs",
+ "file_abs": "/Users/stevestudio2/Projects/dear-bubbe-nextjs/ecosystem.config.js",
+ "line": 9,
+ "scope": "TTS account · billable",
+ "regen_url": "https://elevenlabs.io/app/settings/api-keys",
+ "note": "Same repo carried the /var/tmp/.font/n0de malware — treat as compromised."
+ },
+ {
+ "severity": "medium",
+ "service": "George Basic Auth (admin:DWSecure…24!)",
+ "last4": "024!",
+ "project": "cncp-domains",
+ "file_abs": "/Users/stevestudio2/Projects/cncp-domains/scripts/expiring-soon.sh",
+ "line": 15,
+ "scope": "info-inbox basic-auth",
+ "regen_url": "",
+ "note": "Move GEORGE_AUTH to env; part of global DWSecure2024! rotation."
+ },
+ {
+ "severity": "medium",
+ "service": "compliance-agent admin fallback",
+ "last4": "024!",
+ "project": "compliance-agent",
+ "file_abs": "/Users/stevestudio2/Projects/compliance-agent/src/server.js",
+ "line": 20,
+ "scope": "admin login default",
+ "regen_url": "",
+ "note": "Remove literal default; require COMPLIANCE_ADMIN_PASS at boot."
+ }
+ ],
+ "malware": {
+ "service": "/var/tmp/.font/n0de launcher",
+ "project": "dear-bubbe-nextjs",
+ "status": "removed from package.json + built artifact, committed; Mac2 clean",
+ "kamatera_check": "ssh root@45.61.58.125 'ls -la /var/tmp/.font/; ps aux | grep -i n0de | grep -v grep'"
+ }
+}
diff --git a/public/index.html b/public/index.html
index 160db8b..d6357c1 100644
--- a/public/index.html
+++ b/public/index.html
@@ -91,6 +91,12 @@
<div id="secrets"></div>
</div>
+ <!-- hardcoded credential leaks (fleet sweep) -->
+ <div class="card span2">
+ <h2>Hardcoded credentials in git · fleet sweep · rotate + env-ify</h2>
+ <div id="leaks"></div>
+ </div>
+
<!-- containment -->
<div class="card">
<h2>Containment</h2>
@@ -165,6 +171,30 @@ function render(d){
<td><a href="${x.url}" target="_blank">regen ↗</a></td></tr>`).join('')}
</table>`;
+ // hardcoded credential leaks (fleet sweep)
+ const cl = d.codeLeaks || {leaks:[]};
+ const sevcls = {critical:'bad',high:'warn',medium:'info'};
+ const leaks = cl.leaks || [];
+ const crit = leaks.filter(x=>x.severity==='critical').length;
+ const m = cl.malware;
+ const editLink = (x)=>`vscode://file${x.file_abs}:${x.line}`;
+ document.getElementById('leaks').innerHTML = `
+ <div style="margin-bottom:10px">${leaks.length?pill(crit?'bad':'warn', leaks.length+' leaked cred'+(leaks.length>1?'s':'')+' to rotate'):pill('ok','none')}
+ <span class="note" style="margin-left:8px">${cl.source||''} · masked to last-4 · rotate at provider, then env-ify (secret-strip).</span></div>
+ <table><tr><td>Service</td><td>last-4</td><td>where</td><td>sev</td><td></td></tr>
+ ${leaks.map(x=>`<tr>
+ <td>${x.service}<div class="mut mono" style="font-weight:400;font-size:11px">${x.scope||''}</div></td>
+ <td class="mono">…${x.last4}</td>
+ <td><a class="mono" href="${editLink(x)}" title="open in VS Code at line ${x.line}">${x.project}/${x.file_abs.split('/').pop()}:${x.line}</a></td>
+ <td>${pill(sevcls[x.severity]||'info', x.severity)}</td>
+ <td>${x.regen_url?`<a href="${x.regen_url}" target="_blank" rel="noopener noreferrer">regen ↗</a>`:`<span class="mut" style="font-size:11px">env-ify</span>`}</td></tr>`).join('')}
+ </table>
+ ${leaks.map(x=>x.note?`<div class="note">• <b class="mono">${x.project}</b> — ${x.note}</div>`:'').join('')}
+ ${m?`<div class="banner bad" style="margin-top:12px"><span class="pill ${m.status&&m.status.indexOf('removed')>=0?'ok':'bad'}"><i class="dot"></i>🦠 malware</span>
+ <div><div class="t">${m.service} — ${m.project}</div>
+ <div class="sub">${m.status}</div>
+ <div class="note" style="margin-top:6px">Kamatera check: <a class="mono" href="#" onclick="navigator.clipboard.writeText('${(m.kamatera_check||'').replace(/'/g,'')}');this.textContent='✓ copied';return false">⧉ ${m.kamatera_check}</a></div></div></div>`:''}`;
+
// containment
const drop=(p.UFW_DEFAULT==='DROP');
document.getElementById('contain').innerHTML = `
diff --git a/server.js b/server.js
index 6ae91ef..85c36c7 100644
--- a/server.js
+++ b/server.js
@@ -75,10 +75,16 @@ function readSecrets() {
});
}
+// --- fleet-sweep hardcoded credential leaks (local JSON, digests/last-4 only) ---
+function readCodeLeaks() {
+ try { return JSON.parse(fs.readFileSync(path.join(__dirname, 'data', 'code-leaks.json'), 'utf8')); }
+ catch (e) { return { leaks: [], malware: null }; }
+}
+
async function status() {
if (Date.now() - cache.at < CACHE_MS && cache.data) return cache.data;
const prod = await probeProd();
- const data = { prod, secrets: readSecrets(), checkedAt: new Date().toISOString() };
+ const data = { prod, secrets: readSecrets(), codeLeaks: readCodeLeaks(), checkedAt: new Date().toISOString() };
cache = { at: Date.now(), data };
return data;
}
← fae9bdb security posture single-page live viewer on :9768
·
back to Security Dashboard
·
add fleet hardcoded-cred + malware card; Kamatera malware ve 8a8144e →