@aseity/lyra@0.3.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.46 MB of source, external domains: 192.168.8.88, ai-chat.hep.com.cn, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, dashscope.aliyuncs.com, json-schema.org, storage.googleapis.com

Source & flagged code

5 flagged

dist/index.jsView file

1649L1650: `)}});return p.length===0&&!e.hasExplicitToolConfig()&&(m._toolsExplicitlyConfigured=!1),m.runtimeManifest=u,m}function jL(e,t){let n,o;KL(t)?(n=t.model,o=t.modelInstance):(n=t,o=t... L1651:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1649

1649L1650: `)}});return p.length===0&&!e.hasExplicitToolConfig()&&(m._toolsExplicitlyConfigured=!1),m.runtimeManifest=u,m}function jL(e,t){let n,o;KL(t)?(n=t.model,o=t.modelInstance):(n=t,o=t... L1651:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1649

1814${r}${o} L1815: `}function s$(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1816: `).replace(/\r/gu,` ... L1820: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=Hm(t,e.headLimit,e.offset),u=a.ma... L1821: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=Hm(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1822: import pty

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1814

1/*! Author: Ty <ty29022@gmail.com> */ L2: var AR=Object.defineProperty;var y=(e,t)=>()=>(e&&(t=e(e=0)),t);var RR=(e,t)=>{for(var n in t)AR(e,n,{get:t[n],enumerable:!0})};var Ee,d,Pn,On,nn,Ot,Dt,To,wo,Io,Vr,D,Ms,qr,E=y(()=>... L3: `)),n.length>0?n.join(` ... L14: `)}}function Nn(e,t,n){if(n.length===0)return;let o=e[e.length-1];if(o?.role===t){o.content.push(...n);return}e.push({role:t,content:[...n]})}function oC(e,t,n){return typeof e=="s... L15: `):e.type==="text"?e.text:JSON.stringify(e)}function AC(e){return typeof e=="string"?e:Array.isArray(e)?e.map(t=>t.type==="input_text"?{type:"text",text:t.text}:t.type==="input_ima... L16: `),imageContent:o}}if(an(e)&&e.type==="text"&&typeof e.text=="string")return{toolContent:e.text,imageContent:[]};if(an(e)&&e.type==="image"){let n=eM(e),o=

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/index.cjsView file

1814Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1814: ${r}${o} L1815: `}function NN(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1816: `).replace(/\r/gu,` ... L1820: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=hf(t,e.headLimit,e.offset),u=a.ma... L1821: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=hf(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1822: import pty

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1814

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1649L1650: `)}});return p.length===0&&!e.hasExplicitToolConfig()&&(m._toolsExplicitlyConfigured=!1),m.runtimeManifest=u,m}function jL(e,t){let n,o;KL(t)?(n=t.model,o=t.modelInstance):(n=t,o=t... L1651:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1649

1649L1650: `)}});return p.length===0&&!e.hasExplicitToolConfig()&&(m._toolsExplicitlyConfigured=!1),m.runtimeManifest=u,m}function jL(e,t){let n,o;KL(t)?(n=t.model,o=t.modelInstance):(n=t,o=t... L1651:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1649

1814${r}${o} L1815: `}function s$(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1816: `).replace(/\r/gu,` ... L1820: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=Hm(t,e.headLimit,e.offset),u=a.ma... L1821: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=Hm(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1822: import pty

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1814

1/*! Author: Ty <ty29022@gmail.com> */ L2: var AR=Object.defineProperty;var y=(e,t)=>()=>(e&&(t=e(e=0)),t);var RR=(e,t)=>{for(var n in t)AR(e,n,{get:t[n],enumerable:!0})};var Ee,d,Pn,On,nn,Ot,Dt,To,wo,Io,Vr,D,Ms,qr,E=y(()=>... L3: `)),n.length>0?n.join(` ... L14: `)}}function Nn(e,t,n){if(n.length===0)return;let o=e[e.length-1];if(o?.role===t){o.content.push(...n);return}e.push({role:t,content:[...n]})}function oC(e,t,n){return typeof e=="s... L15: `):e.type==="text"?e.text:JSON.stringify(e)}function AC(e){return typeof e=="string"?e:Array.isArray(e)?e.map(t=>t.type==="input_text"?{type:"text",text:t.text}:t.type==="input_ima... L16: `),imageContent:o}}if(an(e)&&e.type==="text"&&typeof e.text=="string")return{toolContent:e.text,imageContent:[]};if(an(e)&&e.type==="image"){let n=eM(e),o=

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/index.cjsView file

1814Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1814: ${r}${o} L1815: `}function NN(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1816: `).replace(/\r/gu,` ... L1820: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=hf(t,e.headLimit,e.offset),u=a.ma... L1821: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=hf(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1822: import pty

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1814

Findings

4 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code