Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourceincrementalBuilder.proc.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @akanjs/cli@2.3.8
matchedIdentity = npm:QGFrYW5qcy9jbGk:2.3.8
similarity = 0.991
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
incrementalBuilder.proc.jsView on unpkg664spawn as spawn2
L665: } from "child_process";
L666: import { readFileSync as readFileSync3 } from "fs";
High
Child Process
Package source references child process execution.
incrementalBuilder.proc.jsView on unpkg · L66439Cross-file remote execution chain: incrementalBuilder.proc.js spawns index.js; helper contains network access plus dynamic code execution.
L39: static async readText(path) {
L40: return await Bun.file(path).text();
L41: }
...
L53: static async writeText(path, content) {
L54: return await Bun.file(path).write(content);
L55: }
...
L73: class GlobalConfig {
L74: static akanCloudHost = process.env.USE_AKANJS_PKGS === "true" ? `http://localhost:${process.env.CLOUD_HOST_PORT ?? 8283}` : "https://cloud.akanjs.com";
L75: static async#getAkanGlobalConfig() {
...
L664: spawn as spawn2
L665: } from "child_process";
L666: import { readFileSync as readFileSync3 } from "fs";
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
incrementalBuilder.proc.jsView on unpkg · L39985const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
L986: import(`${app.cwdPath}/akan.config.ts`).then((mod) => mod.default),
L987: WorkspaceExecutor.getBaseDevEnv(path.join(app.workspace.workspaceRoot, ".env")),
Medium
Dynamic Require
Package source references dynamic require/import behavior.
incrementalBuilder.proc.jsView on unpkg · L985Findings
1 Critical3 High3 Medium3 Low
CriticalPrevious Version Dangerous DeltaincrementalBuilder.proc.js
HighChild ProcessincrementalBuilder.proc.js
HighShell
HighCross File Remote Execution ContextincrementalBuilder.proc.js
MediumDynamic RequireincrementalBuilder.proc.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings