Loading npm security reports…
@aladas-org/cryptocalc@0.5.31: Manual Review npm security report | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 33 low-signal pattern(s) reviewed.
scanned 15d ago · by lpm-firewall-ai The inspected source does not establish an attack, but the required clean citation coverage exceeds the eight-citation limit. Manual review is needed to resolve the remaining required paths.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The application starts through its Electron entry point; wallet example methods run when called.
Impact
No concrete harmful effect was established from the inspected behavior.
Mechanism
The inspected runtime opens an output folder and the Ethereum example connects to a public Sepolia test RPC.
AI rationale
The inspected source does not establish an attack, but the required clean citation coverage exceeds the eight-citation limit. Manual review is needed to resolve the remaining required paths.
Evidence
package.json www/js/_main/electron_main.js www/js/crypto/SimpleWallet/ethereum_api.js
public snapshot AI called this Manual Review at 67.0% confidence as Unknown with medium false-positive risk.
AI review observations
The manifest defines application and development scripts but no preinstall, install, or postinstall hook. The Electron runtime invokes xdg-open on a derived output folder path; the inspected code shows no unrelated command or network behavior there. The Ethereum API connects to the Sepolia test RPC and uses a hard-coded test key in its example wallet flow. The flagged test and archived runner files inspected are test-related, though this does not establish behavior across all required citation paths. Evidence against
No confirmed malicious behavior was established in the inspected runtime excerpts. The required clean review needs 15 distinct source citations, while the output permits at most 8. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings
26 flagged · loading source www/js/crypto/password_strength_evaluator.js View file 449 patternName = generic_password
severity = medium
line = 449
Medium Secret Pattern
Package contains a possible secret pattern.
www/js/crypto/password_strength_evaluator.js View on unpkg · L449 452 patternName = generic_password
severity = medium
line = 452
Medium Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.js View on unpkg · L452 455 patternName = generic_password
severity = medium
line = 455
Medium Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.js View on unpkg · L455
1 Critical 13 High 13 Medium 6 Low
Critical Clipboard Crypto Hijack www/js/view/_archives/main_gui.js
High Ships High Entropy Blob _archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
High Payload In Excluded Dir tests/_run_tests.py
High Semantic Analysis Limited _archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1
High Known Malware Source Similarity www/js/_main/electron_main.js
High Known Malware Source Similarity _archives/tests-prev/api/runners/_archives/diagnostic.js
High Known Malware Source Similarity _archives/tests-prev/api/runners/diagnostic.js
High Known Malware Source Similarity _archives/tests-prev/api/utils/test-runner.js
High Known Malware Source Similarity
Affected versions and remediation This report applies to @aladas-org/cryptocalc@0.5.31 .
See all versions of @aladas-org/cryptocalc for other recorded verdicts.
Review the evidence and your use of @aladas-org/cryptocalc@0.5.31 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-08 18:35:01.703Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
67% Manual Review
AI assessment confidence
Package metadata npm Author Daniel Rodet & Michel Kern
Maintainers aladas, echopraxium
Version 0.5.31
Latest on npm 0.5.34
Published Sep 28, 2026
License BSD-3-Clause
Dependencies 61
Integrity verified
Package size 5.56 MB
Files 603
Keywords cryptocurrency wallet generator cryptography mnemonics secret phrase passphrase private key QR code
Minified
PossibleObfuscation
UrlStrings
Manifest No manifest risk signals triggered.
scanned 192 file(s), 4.80 MB of source, external domains: aladas-org.github.io, aladas.org, atomscan.com, blockchain.com, blockchair.com, bscscan.com, caniuse.com, cdn.jsdelivr.net, coinfaucet.eu, coinmarketcap.com, dl.dropboxusercontent.com, docs.cardano.org, dogechain.info, etherscan.io, explore.vechain.org, explorer.dash.org, explorer.firo.org, explorer.horizen.io, explorer.rvn.zelcore.io, explorer.solana.com, github.com, guarda.com, iancoleman.io, iplayif.com, litecointf.salmen.website, live.blockcypher.com, livenet.xrpl.org, mainnet.suivision.xyz, mumbaifaucet.com, p5js.org, playwright.bloburl, polygonscan.com, preprod.cardanoscan.io, processing.org, react.dev, rpc2.sepolia.org, sepolia.etherscan.io, snowtrace.io, sochain.com, solfaucet.com, stellar.expert, testnet-faucet.com, tonscan.org, trace.playwright.dev, tronscan.org, whatsonchain.com, www.blockchain.com, www.blockexplorer.com, www.dropbox.com, www.oklink.com
_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.js View file 112 `)}function TE(n){const e=[{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:"[\\d,.]+[bkmBKM]+"},{regex:/\b\d+[hmsp]+\b/,replacement:"\\d+[hmsp]+"},{regex:/\b[\d,.]+[hmsp]+\b/,replacement...
L113: ${n.stack}`,{e:{n:n.name,m:n.message,s:u}}}if(OA(n))return{d:n.toJSON()};if(jA(n))return{u:n.toJSON()};if(MA(n))return{r:{p:n.source,f:n.flags}};for(const[u,f]of Object.entries(Uv)...
L114: (() => {
Low Eval
Package source references a known benign dynamic code generation pattern.
_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.js View on unpkg · L112 _archives/tests-prev/unit/core/constants.test.js View file 3 L4: const { BITCOIN, ETHEREUM } = require('../../../www/js/crypto/const_blockchains.js');
L5: const { PRIVATE_KEY, ADDRESS } = require('../../../www/js/crypto/const_wallet.js');
Medium Dynamic Require
Package source references dynamic require/import behavior.
_archives/tests-prev/unit/core/constants.test.js View on unpkg · L3 tests/jest/unit/view/helpers/main_gui_sandbox.js View file 27 L28: const WWW_JS_DIR = path.join(__dirname, '../../../../../www/js');
L29:
Medium Unsafe Vm Context
Package source executes code through a VM context API.
tests/jest/unit/view/helpers/main_gui_sandbox.js View on unpkg · L27 3 // =====================================================================================================================
L4: // https://www.electronjs.org/docs/latest/tutorial/quick-start
L5:
...
L42: // * updateWIF( blockchain, wif )
L43: // * updatePrivateKey( blockchain, PRIV_KEY )
L44: // * async updateChecksum( entropy )
...
L465: // ---------- Private Key ----------
L466: let private_key = json_data[PRIVATE_KEY];
L467: this.wallet_info.setAttribute( PRIVATE_KEY, private_key );
...
L1395: if ( options_data == undefined ) {
L1396: trace2Main(" " + _RED_ + "**ERROR** options_data: " + options_data + _END_);
L1397: await window.ipcMain.QuitApp();
Critical Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
www/js/view/_archives/main_gui.js View on unpkg · L3 _archives/tests-prev/_open_cmd_window.bat View file • path = _archives/tests-prev/_open_cmd_window.bat
kind = build_helper
sizeBytes = 13
magicHex = 737461727420636d642e657865
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
_archives/tests-prev/_open_cmd_window.bat View on unpkg _archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View file • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = high_entropy_blob
sizeBytes = 5025
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View on unpkg • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = compressed_blob
sizeBytes = 5025
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View on unpkg • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = nested_archive_needs_inspection
sizeBytes = 5025
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View on unpkg • path = tests/_run_tests.py
kind = payload_in_excluded_dir
sizeBytes = 6295
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/_run_tests.py View on unpkg _archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
_archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/electron_main.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/electron_main.js View on unpkg _archives/tests-prev/api/runners/_archives/diagnostic.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/runners/_archives/diagnostic.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/runners/_archives/diagnostic.js View on unpkg _archives/tests-prev/api/runners/diagnostic.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/runners/diagnostic.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/runners/diagnostic.js View on unpkg _archives/tests-prev/api/utils/test-runner.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/utils/test-runner.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/utils/test-runner.js View on unpkg www/js/_main/db/previous/sqlite_utils previous.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/db/previous/sqlite_utils previous.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/db/previous/sqlite_utils previous.js View on unpkg 199 patternName = generic_password
severity = medium
line = 199
Medium Secret Pattern
Hardcoded password in www/js/_main/db/previous/sqlite_utils previous.js
www/js/_main/db/previous/sqlite_utils previous.js View on unpkg · L199 • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/db/sqlite_utils.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/db/sqlite_utils.js View on unpkg 343 patternName = generic_password
severity = medium
line = 343
Medium Secret Pattern
Hardcoded password in www/js/_main/db/sqlite_utils.js
www/js/_main/db/sqlite_utils.js View on unpkg · L343 • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = tests/jest/setup.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
tests/jest/setup.js View on unpkg tests/jest/unit/model/main_model.test.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = tests/jest/unit/model/main_model.test.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
tests/jest/unit/model/main_model.test.js View on unpkg www/js/crypto/SimpleWallet/ethereum_api.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/crypto/SimpleWallet/ethereum_api.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/crypto/SimpleWallet/ethereum_api.js View on unpkg tests/jest/unit/model/wallet_info_bip85.test.js View file • matchType = previous_version_dangerous_delta
matchedPackage = @aladas-org/cryptocalc@0.5.28
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.28
similarity = 0.892
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
tests/jest/unit/model/wallet_info_bip85.test.js View on unpkg www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js View file 204 patternName = generic_password
severity = medium
line = 204
Medium Secret Pattern
Hardcoded password in www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js
www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js View on unpkg · L204 www/js/_main/db/previous/sqlite_utils previous.js
High Known Malware Source Similarity www/js/_main/db/sqlite_utils.js
High Known Malware Source Similarity tests/jest/setup.js
High Known Malware Source Similarity tests/jest/unit/model/main_model.test.js
High Known Malware Source Similarity www/js/crypto/SimpleWallet/ethereum_api.js
High Previous Version Dangerous Delta tests/jest/unit/model/wallet_info_bip85.test.js
Medium Secret Pattern www/js/crypto/password_strength_evaluator.js
Medium Dynamic Require _archives/tests-prev/unit/core/constants.test.js
Medium Unsafe Vm Context tests/jest/unit/view/helpers/main_gui_sandbox.js
Medium Ships Build Helper _archives/tests-prev/_open_cmd_window.bat
Medium Ships Compressed Blob _archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
Medium Structural Risk Force Deep Review
Medium Secret Pattern www/js/crypto/password_strength_evaluator.js
Medium Secret Pattern www/js/crypto/password_strength_evaluator.js
Medium Secret Pattern www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js
Medium Secret Pattern www/js/_main/db/previous/sqlite_utils previous.js
Medium Secret Pattern www/js/_main/db/sqlite_utils.js
Low Eval _archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.js
Low Nested Archive Needs Inspection _archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
Runtime surface package.json Entrypoints main → ./www/js/_main/electron_main.js
Runtime No engine / OS / CPU constraints
Artifact 15.2 MB · 603 files 2 signature(s)
Install lifecycle No install hooks · other: build, rebuild, start, test +8
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation UrlStrings Manifest: clean
26 flagged www/js/crypto/password_strength_evaluator.js View file Lines 429-467 javascript
429 get_both_results ( 'AAAAAAAAAA' );
431 get_both_results ( 'Tr0ub4dour&3' );
433 get_both_results ( 'Base58ttmrze8BVniavN7wEjRWeJq83vASNFZ4mrze8' );
435 // ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8= 43 coding digits
436 get_both_results ( 'Base64+0OIl/mrze8BVniavN7wEjRWeJqSNFZ4mrze8' );
437 get_both_results ( 'Base64+0OIl/mrze8BVniavN7wEjRWeJq83vASNrze8=' );
439 get_both_results ( '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' );
440 get_both_results ( '0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' );
442 get_both_results ( '0101010100000000010101010000000001010101000000000101010100000000'
443 + '0101010100000000010101010000000001010101000000000101010100000000' );
445 get_both_results ( 'ttttttttttt134555' );
447 get_both_results ( '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' );
449 let password = 'display brand regular service above price middle someone someone fall beach daughter sock provide cabbage border hero science inject local regular strategy category castle' ;
Medium Secret Pattern
Package contains a possible secret pattern.
www/js/crypto/password_strength_evaluator.js View on unpkg · L449 450 get_both_results ( password );
452 password = 'display brand regular service above price middle someone someone fall beach daughter' ;
Medium Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.js View on unpkg · L452 453 get_both_results ( password );
455 password = 'DispBranReguServAbovPricMiddSomeSomeFallBeacDaugSockProvCabbBordHeroScieInjeLocaReguStraCateCast' ;
Medium Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.js View on unpkg · L455 456 get_both_results ( password );
458 get_both_results ( 'ab345436986' );
460 get_both_results ( '*WP5W5v3i' );
461 } // test_GetDisplayPasswordStrength()
463 // test_GetDisplayPasswordStrength();
465 if ( typeof exports === 'object' ) {
466 exports .PasswordStrengthEvaluator = PasswordStrengthEvaluator
467 } // exports of 'password_strength_evaluator.js'
_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.js View file 112 `)}function TE(n){const e=[{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:"[\\d,.]+[bkmBKM]+"},{regex:/\b\d+[hmsp]+\b/,replacement:"\\d+[hmsp]+"},{regex:/\b[\d,.]+[hmsp]+\b/,replacement...
L113: ${n.stack}`,{e:{n:n.name,m:n.message,s:u}}}if(OA(n))return{d:n.toJSON()};if(jA(n))return{u:n.toJSON()};if(MA(n))return{r:{p:n.source,f:n.flags}};for(const[u,f]of Object.entries(Uv)...
L114: (() => {
Low Eval
Package source references a known benign dynamic code generation pattern.
_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.js View on unpkg · L112 _archives/tests-prev/unit/core/constants.test.js View file Lines 1-17 javascript
1 // tests/unit/core/constants.test.js
2 // Teste seulement les constantes (pas de dépendances)
4 const { BITCOIN , ETHEREUM } = require ( '../../../www/js/crypto/const_blockchains.js' );
5 const { PRIVATE_KEY , ADDRESS }
tests/jest/unit/view/helpers/main_gui_sandbox.js View file Lines 7-47 javascript
7 * and instantiates its Singleton at load time.
9 * This helper evaluates the real source files in a 'vm' context where :
10 * - const_keywords.js and const_gui.js provide the REAL constants
Lines 1-23 javascript
1 // =====================================================================================================================
2 // ================================================== main_gui.js ==================================================
3 // =====================================================================================================================
4 // https://www.electronjs.org/docs/latest/tutorial/quick-start
5
Critical Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
www/js/view/_archives/main_gui.js View on unpkg · L3 6 // password in HD wallet:
7 // https://help.blockstream.com/hc/en-us/articles/8712301763737-What-is-a-BIP39-passphrase
_archives/tests-prev/_open_cmd_window.bat View file • path = _archives/tests-prev/_open_cmd_window.bat
kind = build_helper
sizeBytes = 13
magicHex = 737461727420636d642e657865
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
_archives/tests-prev/_open_cmd_window.bat View on unpkg _archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View file • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = high_entropy_blob
sizeBytes = 5025
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View on unpkg • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = compressed_blob
sizeBytes = 5025
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip View on unpkg • path = _archives/tests-prev/playwright/playwright-[redacted].zip
kind = nested_archive_needs_inspection
sizeBytes = 5025
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
• path = tests/_run_tests.py
kind = payload_in_excluded_dir
sizeBytes = 6295
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
tests/_run_tests.py View on unpkg _archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
_archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/electron_main.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/electron_main.js View on unpkg _archives/tests-prev/api/runners/_archives/diagnostic.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/runners/_archives/diagnostic.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/runners/_archives/diagnostic.js View on unpkg _archives/tests-prev/api/runners/diagnostic.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/runners/diagnostic.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/runners/diagnostic.js View on unpkg _archives/tests-prev/api/utils/test-runner.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = _archives/tests-prev/api/utils/test-runner.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
_archives/tests-prev/api/utils/test-runner.js View on unpkg www/js/_main/db/previous/sqlite_utils previous.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/db/previous/sqlite_utils previous.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/db/previous/sqlite_utils previous.js View on unpkg 199 patternName = generic_password
severity = medium
line = 199
Medium Secret Pattern
Hardcoded password in www/js/_main/db/previous/sqlite_utils previous.js
www/js/_main/db/previous/sqlite_utils previous.js View on unpkg · L199 • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/_main/db/sqlite_utils.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/_main/db/sqlite_utils.js View on unpkg 343 patternName = generic_password
severity = medium
line = 343
Medium Secret Pattern
Hardcoded password in www/js/_main/db/sqlite_utils.js
www/js/_main/db/sqlite_utils.js View on unpkg · L343 • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = tests/jest/setup.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
tests/jest/setup.js View on unpkg tests/jest/unit/model/main_model.test.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = tests/jest/unit/model/main_model.test.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
tests/jest/unit/model/main_model.test.js View on unpkg www/js/crypto/SimpleWallet/ethereum_api.js View file • matchType = normalized_sha256
matchedPackage = @aladas-org/cryptocalc@0.5.29
matchedPath = www/js/crypto/SimpleWallet/ethereum_api.js
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
www/js/crypto/SimpleWallet/ethereum_api.js View on unpkg tests/jest/unit/model/wallet_info_bip85.test.js View file • matchType = previous_version_dangerous_delta
matchedPackage = @aladas-org/cryptocalc@0.5.28
matchedIdentity = npm:QGFsYWRhcy1vcmcvY3J5cHRvY2FsYw:0.5.28
similarity = 0.892
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
tests/jest/unit/model/wallet_info_bip85.test.js View on unpkg www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js View file Lines 184-224 javascript
184 + "email TEXT UNIQUE NOT NULL,"
185 + "password_hash TEXT NOT NULL,"
186 + "is_admin BOOLEAN DEFAULT 0,"
187 + "is_active BOOLEAN DEFAULT 1,"
188 + "can_manage_users BOOLEAN DEFAULT 0,"
=
require
(
'../../../www/js/crypto/const_wallet.js'
);
Medium Dynamic Require
Package source references dynamic require/import behavior.
_archives/tests-prev/unit/core/constants.test.js View on unpkg · L3 7 describe ( 'Constantes CryptoCalc' , () => {
8 test ( 'const_blockchains devrait exister' , () => {
9 expect ( BITCOIN ). toBe ( 'Bitcoin' );
10 expect ( ETHEREUM ). toBe ( 'Ethereum' );
13 test ( 'const_wallet devrait exister' , () => {
14 expect ( PRIVATE_KEY ). toBe ( 'Private Key' );
15 expect ( ADDRESS ). toBe ( 'Wallet Address' );
11
* - DOM elements are simple in- memory objects (see 'el()' )
12 * - HtmlUtils is a minimal fake backed by those elements
13 * - window.ipcMain.Bip85DeriveBip39 calls the REAL Bip85Utils
14 * (same code as the Main process IPC handler in electron_main . js )
15 * - any other unknown global resolves to an inert "stub" proxy
17 * A NEW sandbox (fresh Singleton) is created for each call : no shared state
18 * between tests (no fragile 'beforeAll' ).
19 * ============================================================================
22 const vm = require ( 'vm' );
23 const fs = require ( 'fs' );
24 const path = require ( 'path' );
26 const { Bip85Utils } = require ( '@crypto/bip85_utils.js' );
28 const WWW_JS_DIR = path. join (__dirname, '../../../../../www/js' );
29
Medium Unsafe Vm Context
Package source executes code through a VM context API.
tests/jest/unit/view/helpers/main_gui_sandbox.js View on unpkg · L27 31 path. join ( WWW_JS_DIR , 'const_keywords.js' ),
32 path. join ( WWW_JS_DIR , 'view/const_gui.js' ),
33 path. join ( WWW_JS_DIR , 'view/main_gui.js' ),
36 // Inert proxy: callable, any property is another stub, converts to its name
37 const makeStub = ( name ) => new Proxy ( function () {}, {
39 if (prop === Symbol.toPrimitive || prop === 'toString' ) return () => name;
40 if (prop === 'then' ) return undefined ; // not a Promise
41 return makeStub (name + '.' + String (prop));
43 apply () { return makeStub (name + '()' ); },
44 construct () { return makeStub ( 'new ' + name); },
47 // Top-level 'const' => 'var' so all files share the sandbox global scope
10 // =============================== MainGUI class ===============================
11 // NB: "Singleton" class
12 // * static GetInstance()
13 // ------------------------------------------------------
14 // * async newWallet( json_data )
15 // * async openWallet( json_data )
17 // * async generateHDWalletAddress( blockchain, entropy )
18 // * async generateSimpleWalletAddress( blockchain, entropy )
20 // * async getSaltedEntropySource()
21 // * async didFinishLoadInit()
22 // * async localizeHtmlNodes()
_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
189 + "can_manage_content BOOLEAN DEFAULT 0,"
190 + "can_view_logs BOOLEAN DEFAULT 0,"
192 + "last_login DATETIME,"
193 + "created_at DATETIME DEFAULT CURRENT_TIMESTAMP,"
194 + "updated_at DATETIME DEFAULT CURRENT_TIMESTAMP"
199 console. error ( 'Erreur création table USERS:' , err);
204 const hashed_password = '$2b$10$viyvP9YIQs0E4.sZN0feIeBrPbHTpCnLLc.ldWgCHDg4BCoHgm2Fi' ;
Medium Secret Pattern
Hardcoded password in www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js
www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js View on unpkg · L204 208 + " username, email, password_hash, is_admin, can_manage_users, can_manage_content,"
209 + " can_view_logs, full_name, is_active )"
210 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)" ,
212 [ 'admin' , 'admin@example.com' , hashed_password, 1 , 1 , 1 , 1 , 'Super Administrator' , 1 ],
215 console. error ( 'Erreur insertion admin:' , err);
217 console. log ( '✅ Utilisateur admin créé' );