ssh

Purpose

Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to any server that has the corresponding public key in its authorized_keys. Public keys in authorized format can reveal the owner's cryptographic identity and are also worth flagging in security audits.

Features

Detects OpenSSH private key blocks (-----BEGIN OPENSSH PRIVATE KEY-----), RSA public keys (ssh-rsa AAAA…), ECDSA keys (ecdsa-sha2-nistp256 AAAA…), and Ed25519 keys (ssh-ed25519 AAAA…).
Private key blocks receive a higher confidence score (0.98) than public keys (0.92).
All four regex patterns reset lastIndex before each scan.

Usage: Basic Example

import { detect } from '@suaveplan/security-codes/patterns/ssh';

const key = '-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXkAAAA=\n-----END OPENSSH PRIVATE KEY-----';
const matches = detect(key);
// matches[0].type === 'ssh-key', confidence 0.98

Usage: Advanced Example

import { detect } from '@suaveplan/security-codes/patterns/ssh';

const config = 'authorized_key=ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ user@host';
const matches = detect(config);
// matches[0].type === 'ssh-key', confidence 0.92

API Reference

`detect(input: string): SecurityCodeMatch[]`

Scans input for SSH keys.

Parameter	Type	Description
`input`	`string`	The string to scan (may contain newlines)

Returns SecurityCodeMatch[] with type: 'ssh-key'. Private key blocks have confidence: 0.98; public key formats have confidence: 0.92.

Implementation Notes

OpenSSH private keys use PEM-like delimiters but with a specific header string that distinguishes them from generic PEM blocks detected by the pem module. Both modules may return matches for the same region — the detector deduplication layer resolves overlaps by preferring higher-confidence matches.

Public key formats (ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519) are matched with a permissive \S+ suffix to handle the variable-length base64 blob and the optional trailing comment (e.g. user@host). The lower confidence score of 0.92 for public keys reflects the fact that a standalone ssh-rsa AAAA… string in a configuration file is common and not necessarily a secret leak, whereas an OpenSSH private key block is always sensitive and receives 0.98.

2.4 KiB Raw Blame History

ssh