registry / @alienplatform/sdk / 2.1.1

@alienplatform/sdk@2.1.1

TypeScript SDK for Alien Worker apps — handler APIs and re-exported binding factories

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 1.40 MB of source, external domains: github.com, grpc.io, json-schema.org, otel-collector.example.com

Source & flagged code

2 flagged

dist/dist.jsView file

Lines 286-326javascript

286function mergeDefs(...defs) {

287 const mergedDescriptors = {};

288 for (const def of defs) {

289 const descriptors = Object.getOwnPropertyDescriptors(def);

290 Object.assign(mergedDescriptors, descriptors);

291 }

292 return Object.defineProperties({}, mergedDescriptors);

293}

294function esc(str) {

295 return JSON.stringify(str);

296}

297function slugify(input) {

298 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$

299}

300const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

301function isObject(data) {

302 return typeof data === "object" && data !== null && !Array.isArray(data);

303}

304const allowsEval = cached(() => {

305 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

306 try {

307 new Function("");

308 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist.jsView on unpkg · L306

309 } catch (_) {

310 return false;

311 }

312});

313function isPlainObject(o) {

314 if (isObject(o) === false) return false;

315 const ctor = o.constructor;

316 if (ctor === void 0) return true;

317 if (typeof ctor !== "function") return true;

318 const prot = ctor.prototype;

319 if (isObject(prot) === false) return false;

320 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

321 return true;

322}

323function shallowClone(o) {

324 if (isPlainObject(o)) return { ...o };

325 if (Array.isArray(o)) return [...o];

326 return o;

dist/worker-runtime/index.jsView file

525//#endregion L526: //#region ../../node_modules/.pnpm/@grpc+grpc-js@1.14.4/node_modules/@grpc/grpc-js/package.json L527: var require_package = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L531: "description": "gRPC Library for Node - pure JS implementation", L532: "homepage": "https://grpc.io/", L533: "repository": "https://github.com/grpc/grpc-node/tree/master/packages/grpc-js", ... L557: "eslint-plugin-prettier": "^4.2.1", L558: "execa": "^2.0.3", L559: "gulp": "^4.0.2", ... L635: let _logVerbosity = constants_1.LogVerbosity.ERROR; L636: switch (((_b = (_a = process.env.GRPC_NODE_VERBOSITY) !== null && _a !== void 0 ? _a : process.env.GRPC_VERBOSITY) !== null && _b !== void 0 ? _b : "").toUpperCase()) { L637: case "DEBUG":

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/worker-runtime/index.jsView on unpkg · L525

Source & flagged code

2 flagged · loading source

dist/dist.jsView file

306try { L307: new Function(""); L308: return true;

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code