Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/health.jsView file
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
L4: import { execFile, execSync, spawn } from "node:child_process";
L5: import { promisify } from "node:util";
...
L12: import { parse } from "smol-toml";
L13: import WebSocket from "ws";
L14: import { createConnection, createServer } from "node:net";
...
L328: }
L329: const body = await res.json();
L330: if (!res.ok) return {
...
L361: ok: true,
L362: data: result.body.data
L363: };
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/health.jsView on unpkg · L3•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/health.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/health.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @alfe.ai/gateway@0.3.0
matchedIdentity = npm:QGFsZmUuYWkvZ2F0ZXdheQ:0.3.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/health.jsView on unpkg3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
L4: import { execFile, execSync, spawn } from "node:child_process";
L5: import { promisify } from "node:util";
High
871try {
L872: new Function("");
L873: return true;
High
58}) : target, mod));
L59: var __require = /* @__PURE__ */ createRequire(import.meta.url);
L60: //#endregion
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/health.jsView on unpkg · L583import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
L4: import { execFile, execSync, spawn } from "node:child_process";
L5: import { promisify } from "node:util";
...
L12: import { parse } from "smol-toml";
L13: import WebSocket from "ws";
L14: import { createConnection, createServer } from "node:net";
...
L328: }
L329: const body = await res.json();
L330: if (!res.ok) return {
...
L361: ok: true,
L362: data: result.body.data
L363: };
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/health.jsView on unpkg · L3Findings
3 Critical3 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/health.js
CriticalTrigger Reachable Dangerous Capabilitydist/health.js
CriticalPrevious Version Dangerous Deltadist/health.js
HighChild Processdist/health.js
HighShell
HighEvaldist/health.js
MediumDynamic Requiredist/health.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/health.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License