registry / @alejoamiras/aztec-benchmark / 5.0.0

@alejoamiras/aztec-benchmark@5.0.0

CLI tool and GitHub Action for Aztec contract benchmarking

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 528 KB of source, external domains: docs.github.com

Source & flagged code

5 flagged

action/dist/index.cjsView file

Lines 1-3javascript

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,get:function(){return e[t]}})}:function(A,e,t,r){if(r===undefined)r=t;A[r]=e[t]});var s=this&&this.__setModuleDefault||(Object.create?function(A,e){Object.defineProperty(A,"default",{enumerable:true,value:e})}:function(A,e){A["default"]=e});var o=this&&this.__importStar||function(A){if(A&&A.__esModule)return A;var e={};if(A!=null)for(var t in A)if(t!=="default"&&Object.hasOwnProperty.call(A,t))r(e,A,t);s(e,A);return e} ...

2/*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const normalizeLinefeeds=A=>A.replace(/\r?\n|\r

3/*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> */o[s-4]=this.maskKey[0];o[s-3]=this.maskKey[1];o[s-2]=this.maskKey[2];o[s-1]=this.maskKey[3

Long lines were clipped for display.

dist/cli.jsView file

Lines 61-101javascript

61 else {

62 console.error('Error: No benchmarks specified via --contracts flag or found in the [benchmark] section of Nargo.toml.');

63 }

64 program.outputHelp();

65 process.exit(1);

66 }

67 console.log(`Found ${contractsToRunNames.length} benchmark(s) to run: ${

Source & flagged code

5 flagged · loading source

action/dist/index.cjsView file

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,ge... L2: /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const nor...

High

Child Process

Package source references child process execution.

action/dist/index.cjsView on unpkg · L1

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,ge... L2: /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const nor...

High

Shell

Package source references shell execution.

action/dist/index.cjsView on unpkg · L1

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,ge... L2: /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const nor...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

action/dist/index.cjsView on unpkg · L1

1(()=>{var A={3472:function(A,e,t){"use strict";var r=this&&this.__createBinding||(Object.create?function(A,e,t,r){if(r===undefined)r=t;Object.defineProperty(A,r,{enumerable:true,ge... L2: /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */;const escape=A=>A.replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22");const nor...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

action/dist/index.cjsView on unpkg · L1

dist/cli.jsView file

81try { L82: const module = await import(benchmarkFilePath); L83: const BenchmarkClass = module.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L81

Findings

5 High5 Medium4 Low

HighChild Processaction/dist/index.cjs

HighShellaction/dist/index.cjs

HighSame File Env Network Executionaction/dist/index.cjs

HighCommand Output Exfiltrationaction/dist/index.cjs

HighObfuscated

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

action/dist/index.cjsView file

Lines 1-3javascript

3/*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> */o[s-4]=this.maskKey[0];o[s-3]=this.maskKey[1];o[s-2]=this.maskKey[2];o[s-1]=this.maskKey[3

Long lines were clipped for display.

dist/cli.jsView file

Lines 61-101javascript

61 else {

62 console.error('Error: No benchmarks specified via --contracts flag or found in the [benchmark] section of Nargo.toml.');

63 }

64 program.outputHelp();

65 process.exit(1);

66 }

67 console.log(`Found ${contractsToRunNames.length} benchmark(s) to run: ${