registry / @anatolijlaptev1991/hermes-ru / 0.17.2

@anatolijlaptev1991/hermes-ru@0.17.2

⚠ Under review

Русская локализация Hermes Agent Desktop для Windows. Self-healing патч.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 770 KB of source, external domains: 127.0.0.1, api.github.com, gateway.example.com, git-scm.com, github.com, hermes.local, marketplace.visualstudio.com, portal.nousresearch.com, raw.githubusercontent.com, react.dev, www.google.com, www.youtube.com

Oversized source lightweight scan

dist/assets/index-Dx2gzjVx.js26.7 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsgateway.example.comportal.nousresearch.comreact.dev

Source & flagged code

3 flagged

dist/electron-main.mjsView file

Lines 167-207javascript

167// ../../node_modules/debug/src/common.js

168var require_common = __commonJS({

169 "../../node_modules/debug/src/common.js"(exports, module) {

170 function setup(env2) {

171 createDebug.debug = createDebug;

172 createDebug.default = createDebug;

173 createDebug.coerce = coerce;

174 createDebug.disable = disable;

175 createDebug.enable = enable;

176 createDebug.enabled = enabled;

177 createDebug.humanize = require_ms();

178 createDebug.destroy = destroy;

179 Object.keys(env2).forEach((key) => {

180 createDebug[key] = env2[key];

181 });

182 createDebug.names = [];

183 createDebug.skips = [];

184 createDebug.formatters = {};

185 function selectColor(namespace) {

186 let hash = 0;

187 for (let i2 = 0; i2 < namespace.length; i2++) {

188 hash = (hash << 5) - hash + namespace.charCodeAt(i2);

189 hash |= 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/electron-main.mjsView on unpkg · L187

190 }

191 return createDebug.colors[Math.abs(hash) % createDebug.colors.length];

192 }

193 createDebug.selectColor = selectColor;

194 function createDebug(namespace) {

195 let prevTime;

196 let enableOverride = null;

197 let namespacesCache;

198 let enabledCache;

199 function debug2(...args) {

200 if (!debug2.enabled) {

201 return;

202 }

203 const self = debug2;

204 const curr = Number(/* @__PURE__ */ new Date());

205 const ms = curr - (prevTime || curr);

206 self.diff = ms;

207 self.prev = prevTime;

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/index-Dx2gzjVx.jsView file

•path = dist/assets/index-Dx2gzjVx.js kind = oversized_source_file sizeBytes = 27953810 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/index-Dx2gzjVx.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/electron-main.mjsView file

187for (let i2 = 0; i2 < namespace.length; i2++) { L188: hash = (hash << 5) - hash + namespace.charCodeAt(i2); L189: hash |= 0; ... L446: let m; L447: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L448: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L491: if (!r2 && typeof process !== "undefined" && "env" in process) { L492: r2 = process.env.DEBUG; L493: } ... L593: if ("CI" in env) { L594: if (["GITHUB_ACTIONS", "GITEA_ACTIONS", "CIRCLECI"].some((key) => key in env)) { L595: return 3;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/electron-main.mjsView on unpkg · L187

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/index-Dx2gzjVx.jsView file

•path = dist/assets/index-Dx2gzjVx.js kind = oversized_source_file sizeBytes = 27953810 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/index-Dx2gzjVx.jsView on unpkg

Findings

1 Critical2 High3 Medium3 Low

CriticalCredential Exfiltrationdist/electron-main.mjs

HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/assets/index-Dx2gzjVx.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/electron-main.mjsView file

Lines 167-207javascript

167// ../../node_modules/debug/src/common.js

168var require_common = __commonJS({

169 "../../node_modules/debug/src/common.js"(exports, module) {

170 function setup(env2) {

171 createDebug.debug = createDebug;

172 createDebug.default = createDebug;

173 createDebug.coerce = coerce;

174 createDebug.disable = disable;

175 createDebug.enable = enable;

176 createDebug.enabled = enabled;

177 createDebug.humanize = require_ms();

178 createDebug.destroy = destroy;

179 Object.keys(env2).forEach((key) => {

180 createDebug[key] = env2[key];

181 });

182 createDebug.names = [];

183 createDebug.skips = [];

184 createDebug.formatters = {};

185 function selectColor(namespace) {

186 let hash = 0;

187 for (let i2 = 0; i2 < namespace.length; i2++) {

188 hash = (hash << 5) - hash + namespace.charCodeAt(i2);

189 hash |= 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/electron-main.mjsView on unpkg · L187

190 }

191 return createDebug.colors[Math.abs(hash) % createDebug.colors.length];

192 }

193 createDebug.selectColor = selectColor;

194 function createDebug(namespace) {

195 let prevTime;

196 let enableOverride = null;

197 let namespacesCache;

198 let enabledCache;

199 function debug2(...args) {

200 if (!debug2.enabled) {

201 return;

202 }

203 const self = debug2;

204 const curr = Number(/* @__PURE__ */ new Date());

205 const ms = curr - (prevTime || curr);

206 self.diff = ms;

207 self.prev = prevTime;

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/assets/index-Dx2gzjVx.jsView file

•path = dist/assets/index-Dx2gzjVx.js kind = oversized_source_file sizeBytes = 27953810 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/index-Dx2gzjVx.jsView on unpkg