Static Scan Results
scanned 6d ago · by rust-scannerStatic analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgclis/douyin/_shared/tos-upload-short-read.test.jsView file
47patternName = aws_access_key
severity = critical
line = 47
matchedText = access_k...LE',
Critical
Critical Secret
Package contains a critical-looking secret pattern.
clis/douyin/_shared/tos-upload-short-read.test.jsView on unpkg · L4747patternName = aws_access_key
severity = critical
line = 47
matchedText = access_k...LE',
Critical
Secret Pattern
AWS access key ID in clis/douyin/_shared/tos-upload-short-read.test.js
clis/douyin/_shared/tos-upload-short-read.test.jsView on unpkg · L4767patternName = aws_access_key
severity = critical
line = 67
matchedText = access_k...LE',
Critical
Secret Pattern
AWS access key ID in clis/douyin/_shared/tos-upload-short-read.test.js
clis/douyin/_shared/tos-upload-short-read.test.jsView on unpkg · L67dist/src/external.jsView file
4import { fileURLToPath } from 'node:url';
L5: import { spawnSync, execFileSync } from 'node:child_process';
L6: import yaml from 'js-yaml';
High
Child Process
Package source references child process execution.
dist/src/external.jsView on unpkg · L4dist/src/plugin.jsView file
491stdio: ['pipe', 'pipe', 'pipe'],
L492: ...(isWindows && { shell: true }),
L493: });
High
dist/src/weixin-download.test.jsView file
22const mod = await loadModule();
L23: const extractInPage = eval(mod.buildExtractWechatPublishTimeJs());
L24: expect(extractInPage('', 'var create_time = "1711291080";')).toBe('2024-03-24 22:38:00');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/src/weixin-download.test.jsView on unpkg · L22dist/src/discovery.jsView file
256return;
L257: await import(pathToFileURL(filePath).href).catch((err) => {
L258: log.warn(`Failed to load module ${filePath}: ${getErrorMessage(err)}`);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/discovery.jsView on unpkg · L256clis/douban/utils.test.jsView file
109location: {
L110: href: 'https://search.douban.com/movie/subject_search?search_text=%E5%B0%84%E9%9B%95%E8%8B%B1%E9%9B%84%E4%BC%A0',
L111: origin: 'https://search.douban.com',
...
L134: it('rejects non-http photo urls during promotion', () => {
L135: expect(promoteDoubanPhotoUrl('data:image/gif;base64,abc')).toBe('');
L136: });
...
L449: // eslint-disable-next-line no-new-func
L450: return new Function(`return (${fn.toString()})`)();
L451: }
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
clis/douban/utils.test.jsView on unpkg · L109clis/flomo/memos.jsView file
76params.sign = createHash('md5').update(signBase + '[redacted]').digest('hex');
L77: return 'https://flomoapp.com/api/v1/memo/updated/?' + new URLSearchParams(params).toString();
L78: }
...
L85: if (!raw) return null;
L86: const me = JSON.parse(raw);
L87: const token = me?.access_token || me?.data?.access_token || '';
Low
Weak Crypto
Package source references weak cryptographic algorithms.
clis/flomo/memos.jsView on unpkg · L76scripts/postinstall.jsView file
7* standard completion directory. For zsh and bash, the script prints manual
L8: * instructions instead of modifying rc files (~/.zshrc, ~/.bashrc) — this
L9: * avoids breaking multi-line shell commands and other fragile rc structures.
...
L60: function detectShell() {
L61: const shell = process.env.SHELL || '';
L62: if (shell.includes('zsh')) return 'zsh';
...
L77: // Skip in CI environments
L78: if (process.env.CI || process.env.CONTINUOUS_INTEGRATION) {
L79: return;
...
L93:
L94: const home = homedir();
L95:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
scripts/postinstall.jsView on unpkg · L7dist/src/cli.jsView file
100Cross-file remote execution chain: dist/src/cli.js spawns dist/src/browser/network-interceptor.js; helper contains network access plus dynamic code execution.
L100: try {
L101: body = JSON.parse(preview);
L102: }
...
L130: catch {
L131: if (process.env.WEBCMD_VERBOSE)
L132: log.warn(`[network] Failed to parse interceptor buffer: ${typeof raw === 'string' ? raw.slice(0, 200) : String(raw)}`);
...
L144: }
L145: /** Exit codes by network error code — usage errors vs runtime failures. */
L146: const NETWORK_ERROR_EXIT = {
...
L148: invalid_filter: EXIT_CODES.USAGE_ERROR,
L149: invalid_max_body: EXIT_CODES.USAGE_ERROR,
L150: };
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/src/cli.jsView on unpkg · L100dist/src/observation/redaction.test.jsView file
28patternName = generic_password
severity = medium
line = 28
matchedText = password...D]',
Medium
Secret Pattern
Hardcoded password in dist/src/observation/redaction.test.js
dist/src/observation/redaction.test.jsView on unpkg · L28clis/douyin/_shared/tos-upload.test.jsView file
149patternName = aws_access_key
severity = critical
line = 149
matchedText = access_k...LE',
Critical
Secret Pattern
AWS access key ID in clis/douyin/_shared/tos-upload.test.js
clis/douyin/_shared/tos-upload.test.jsView on unpkg · L149166patternName = aws_access_key
severity = critical
line = 166
matchedText = expect(h...t');
Critical
Secret Pattern
AWS access key ID in clis/douyin/_shared/tos-upload.test.js
clis/douyin/_shared/tos-upload.test.jsView on unpkg · L166Findings
5 Critical4 High8 Medium8 Low
CriticalCritical Secretclis/douyin/_shared/tos-upload-short-read.test.js
CriticalSecret Patternclis/douyin/_shared/tos-upload-short-read.test.js
CriticalSecret Patternclis/douyin/_shared/tos-upload-short-read.test.js
CriticalSecret Patternclis/douyin/_shared/tos-upload.test.js
CriticalSecret Patternclis/douyin/_shared/tos-upload.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/external.js
HighShelldist/src/plugin.js
HighCross File Remote Execution Contextdist/src/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/discovery.js
MediumUnsafe Vm Contextclis/douban/utils.test.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencescripts/postinstall.js
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/src/observation/redaction.test.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/src/weixin-download.test.js
LowWeak Cryptoclis/flomo/memos.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings