registry / @arcforge/axon / 2.0.57

@arcforge/axon@2.0.57

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 7 file(s), 540 KB of source, external domains: axon.arclabs.it, www.apache.org

Oversized source lightweight scan

app.js21.8 MB file, sampled 256 KB

ChildProcessDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsProtestwareaxon.arclabs.it

declare-worker.js3.50 MB file, sampled 256 KB

FilesystemChildProcessHighEntropyStringsMinifiedUrlStrings

Source & flagged code

5 flagged

declare-worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arcforge/axon@2.0.47 matchedIdentity = npm:QGFyY2ZvcmdlL2F4b24:2.0.47 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

declare-worker.jsView on unpkg

1// @bun L2: var z6J=Object.create;var{getPrototypeOf:W6J,defineProperty:OM0,getOwnPropertyNames:Q6J}=Object;var E6J=Object.prototype.hasOwnProperty;var D6J=(e0,o0,kJ)=>{kJ=e0!=null?z6J(W6J(e0)... L3: at `+lM0(o0[FX],y1)),y1.nextPosition=y1.curPosition;return y1.curPosition=y1.nextPosition=null,b1+XY.reverse().join("")}function pM0(e0){var o0=/\n at [^(]+ $(.*):(\d+):(\d+)$...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

declare-worker.jsView on unpkg · L1

update-helper.jsView file

Lines 1-13javascript

1// @bun

2import{mkdir as X,rename as Y,writeFile as Z}from"fs/promises";import{dirname as $}from"path";var V=4;async function w(j,q={}){let

3Updating Axon ${j.from} \u2192 ${j.to}\u2026

4`);let J={code:1,stdout:""};for(let G=1;G<=V;G++){if(J=await z([j.bun,"add","-g",

5`),await D(Q)}}if(J.code===0){let G=await z([j.axon,"--version"]);if(G.code===0&&G.stdout.trim()===j.to)

7`),0}process.stderr.write(`Axon update failed verification; restoring the previous version\u2026

8`);let B=await z([j.bun,"add","-g",`@arcforge/axon@${j.from}`]),O=B.code===0?`update to ${j.to} failed verification; restored ${j.from}`:

10`),1}function C(j){let q=new Map;for(let K=0;K<j.length;K+=2){let G=j[

11`,"utf-8"),await Y(z,j)}function W(j){return/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(j)}async function U(j,q={}){let z=q.apply??w,D=q.exit??((B)=>process.exit(B)),J=q.report??((B)=>process.stderr.write(B));try{D(await z(C(j)))}catch(B){J(`Axon updater failed: ${B instanceof Error?B.message:String(B)}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

update-helper.jsView on unpkg · L1

12`),D(1)}}if(import.meta.main)U(process.argv.slice(2));export{U as runHelper,C as parseHelperArgs,w as applyUpdate};

Long lines were clipped for display.

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 22853482 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 22853482 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

5 flagged · loading source

declare-worker.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

declare-worker.jsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

declare-worker.jsView on unpkg · L1

update-helper.jsView file

1// @bun L2: import{mkdir as X,rename as Y,writeFile as Z}from"fs/promises";import{dirname as $}from"path";var V=4;async function w(j,q={}){let z=q.run??F,D=q.sleep??Bun.sleep;await R(j.state,{... L3: Updating Axon ${j.from} \u2192 ${j.to}\u2026 ... L7: `),0}process.stderr.write(`Axon update failed verification; restoring the previous version\u2026 L8: `);let B=await z([j.bun,"add","-g",`@arcforge/axon@${j.from}`]),O=B.code===0?`update to ${j.to} failed verification; restored ${j.from}`:`update to ${j.to} failed and rollback to $... L9: L10: `),1}function C(j){let q=new Map;for(let K=0;K<j.length;K+=2){let G=j[K],Q=j[K+1];if(!G?.startsWith("--")||Q===void 0)throw Error("UPDATE_HELPER_ARGS_INVALID");q.set(G.slice(2),Q)}... L11: `,"utf-8"),await Y(z,j)}function W(j){return/^\d+\.\d+\.\d+

Findings

2 High6 Medium5 Low

HighSandbox Evasion Gated Capabilityupdate-helper.js

HighPrevious Version Dangerous Deltadeclare-worker.js

MediumDynamic Requiredeclare-worker.js

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Fileapp.js

MediumOversized Cli Entrypointapp.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License