registry / 9remote / 2.3.3

9remote@2.3.3

⚠ Under review

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.33 MB of source, external domains: 127.0.0.1, android.googleapis.com, docs.9remote.cc, exp.host, fcm.googleapis.com, feross.org, flagcdn.com, github.com, mths.be, registry.npmjs.org, sheetjs.com, socket.io, www.apple.com, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node dist/install.cjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.cjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.cjsView file

2const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var f=Object.create;var l=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var h=Object.getOwnPropertyNames;var p=Object.getPrototypeOf,b=Object.prototype.hasOwnProperty...

High

Child Process

Package source references child process execution.

dist/install.cjsView on unpkg · L2

dist/ptyDaemon.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ptyDaemon.cjsView on unpkg · L2

1#!/usr/bin/env node L2: const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var Z=Object.create;var q=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ptyDaemon.cjsView on unpkg · L1

2const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var Z=Object.create;var q=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty... L4: `;try{a.default.appendFileSync(R,n)}catch{}console.error(n.trim())}function le(){return process.env.CODESPACES==="true"?process.env.CODESPACE_VSCODE_FOLDER||"/workspaces":process.e... L5: `,c+=`[ -f "${o}/.zshrc" ] && source "${o}/.zshrc" ... L8: `,a.default.writeFileSync(i,c),r.ZDOTDIR=s}else if(n){let i=r.PROMPT_COMMAND||"";r.PROMPT_COMMAND=`printf "\\e]7;file://%s\\a" "\${HOSTNAME}\${PWD}"${i?`; ${i}`:""}`}return/cmd\.ex... L9: `;for(let t of v)try{t.write(r)}catch{}}function h(e,r){try{e.write(JSON.stringify(r)+` L10: `)}ca

dist/server.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = 9remote@2.0.70 matchedIdentity = npm:OXJlbW90ZQ:2.0.70 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/server.cjs: `);return s!==-1&&(e=dR(e,i,n,s)),n+e+i};Object.defineProperties(gu.prototype,qa);oz=gu(),kme=gu({level:vR?vR.level:0}),vu=oz});var Eo={};Jr(Eo,{createRouter:()=>Ty,jsonErr:()=>De,... `).filter(Boolean).slice(-t)}catch{return[]}}function LR(){try{Kn.default.writeFileSync(wu,"")}catch{}}function Qe(t){return{debug:(...e)=>{yz&&$a(t,"debug",ph(e))},info:(...e)=>$a... `);function a(c){var l=p0(ji.join(c,"prebuilds")).map(lA),u=l.filter(uA(u0,l0)).sort(fA)[0];if(u){var f=ji.join(c,"prebuilds",u.name),h=p0(f).map(pA),d=h.filter(hA(c0,tA)),g=d.sort... `+r)}function Po(t,e,r,n,i,s){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.cap

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/server.cjsView on unpkg

89L90: `;for(let n of Jd)try{n.write(r)}catch{Jd.delete(n)}}function _e(t){$t("log",{message:`[${new Date().toLocaleTimeString(void 0,{hour12:!1})}] ${t}`})}function WP(){return es}functi... L91: ... L99: L100: `),Jd.add(e),t.on("close",()=>Jd.delete(e))}function eI(t,e){ce(e,{...es,...ri,desktopEnabled:Vr,remoteAvailable:mx,transport:yx()})}async function tI(t,e){let{parseJsonBody:r}=awa... L101: `),!0}catch(e){return console.error("[DaemonClient] Send error:",e),!1}}function $c(t,e=5e3){return new Promise((r,n)=>{let i=iZ();t.requestId=i;let s=setTimeout(()=>{Uc.delete(i),... ... L103: `);if(o!==-1){clearTimeout(i);try{let a=JSON.parse(r.slice(0,o));n(a.version||"unknown")}catch{n(null)}}}),e.on("error",()=>{clearTimeout(i),n(null)})})}async function lZ(){try{let... L104: `);Px=n.p

dist/assets/tray.ps1View file

•path = dist/assets/tray.ps1 kind = build_helper sizeBytes = 4280 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/assets/tray.ps1View on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.cjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.cjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.cjsView file

High

Child Process

Package source references child process execution.

dist/install.cjsView on unpkg · L2

Findings

1 Critical7 High7 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/server.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install.cjs

HighSame File Env Network Executiondist/ptyDaemon.cjs

HighEntrypoint Foreign Package Code Overwritedist/server.cjs

HighCommand Output Exfiltrationdist/server.cjs

HighSandbox Evasion Gated Capabilitydist/server.cjs

HighTrigger Reachable Command Output Exfiltrationdist/server.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/ptyDaemon.cjs

MediumNetwork

MediumEnvironment Vars