Exposed Stripe credentials in stripe-webhook-validator

The npm package stripe-webhook-validator versions 1.4.7 through 1.4.9 contained a live Stripe secret key (sk_live_…) and a webhook signing secret (whsec_…) hardcoded in plain text inside scripts/setup.js. Both tokens were present in the published tarball, accessible to anyone who installed or audited the package.

The package presented itself as a utility for validating Stripe webhook payloads. The embedded credentials belonged to the package author's account and were active at the time of publication. codelake detected the finding via high-entropy secret scanning within seconds of the package appearing in the npm feed.

The package was removed from the registry 4 hours and 22 minutes after publication. codelake captured and archived the tarball before removal. The author has since rotated the credentials and published a clean version 1.5.0.

The embedding occurred in a postinstall script (scripts/setup.js), executed automatically on npm install. The credentials were left in from a local development environment.

Both tokens were in plain text, no obfuscation. The prefix sk_live_ confirms a production key (test keys begin with sk_test_).

Shannon entropy for the extracted literals measured 4.92 and 4.88 bits/character, well above the 3.80 threshold, and both matched named Stripe key regex signatures — a double confirmation with no dependence on a single signal.