registry / @adithyasak/t3 / 0.0.42-adi.5
@adithyasak/t3@0.0.42-adi.5
⚠ Under reviewStatic Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
dist/bin.mjs8.02 MB file, sampled 256 KB
FilesystemNetworkChildProcess
Source & flagged code
15 flaggeddist/claudeHistoryWorker-DyFmK0Hb.mjsView file
3import { createRequire } from "node:module";
L4: import * as xw from "node:child_process";
L5: import { execFile } from "node:child_process";
...
L16: import { EventEmitter, once, setMaxListeners } from "events";
L17: import Bbe from "https";
L18: import Hbe from "http";
...
L459: *
L460: * Each memoized wrapper owns a private `WeakMap` keyed by object identity.
L461: *
...
L568: *
L569: * const data: unknown = "hi"
L570: *
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-DyFmK0Hb.mjsView on unpkg · L33import { createRequire } from "node:module";
L4: import * as xw from "node:child_process";
L5: import { execFile } from "node:child_process";
...
L16: import { EventEmitter, once, setMaxListeners } from "events";
L17: import Bbe from "https";
L18: import Hbe from "http";
...
L459: *
L460: * Each memoized wrapper owns a private `WeakMap` keyed by object identity.
L461: *
...
L568: *
L569: * const data: unknown = "hi"
L570: *
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-DyFmK0Hb.mjsView on unpkg · L3Findings
3 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-DyFmK0Hb.mjs
CriticalReverse Shelldist/claudeHistoryWorker-DyFmK0Hb.mjs
CriticalTrojan Source Unicodedist/client/assets/utils-JaJeP1Bl.js
HighChild Processdist/claudeHistoryWorker-DyFmK0Hb.mjs
HighShelldist/claudeHistoryWorker-DyFmK0Hb.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-DyFmK0Hb.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-DyFmK0Hb.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-DyFmK0Hb.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-DyFmK0Hb.mjs
HighPackage Source Clone Identity Mismatchdist/client/assets/blade-OEdTArYC.js
Affected versions and remediation
This report applies to @adithyasak/t3@0.0.42-adi.5.
See all versions of @adithyasak/t3 for other recorded verdicts.
- Review the evidence and your use of @adithyasak/t3@0.0.42-adi.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.