Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/LoomStore-DMf2PkfP.js4.24 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsShellHighEntropyStringsUrlStringsgithub.com
Source & flagged code
9 flagged · loading sourcedist/volar-service-markdown-ZE1pdvJT.jsView file
16296patternName = generic_password
severity = medium
line = 16296
matchedText = password...d]",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/volar-service-markdown-ZE1pdvJT.jsView on unpkg · L16296dist/LoomServer-D8I04Chj.jsView file
1855var fs$2 = __require("fs");
L1856: var child_process_1 = __require("child_process");
L1857: /**
High
Child Process
Package source references child process execution.
dist/LoomServer-D8I04Chj.jsView on unpkg · L1855461deleteCount,
L462: data: newData
L463: }];
...
L1855: var fs$2 = __require("fs");
L1856: var child_process_1 = __require("child_process");
L1857: /**
...
L1865: for (var i = 0, len = segments.length; i < len; i++) segments[i] = decodeURIComponent(segments[i]);
L1866: if (process.platform === "win32" && segments.length > 1) {
L1867: let first = segments[0];
...
L1896: return new Promise((resolve, reject) => {
L1897: let env = process.env;
L1898: let newEnv = Object.create(null);
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/LoomServer-D8I04Chj.jsView on unpkg · L4611852exports.resolveModulePath = exports.FileSystem = exports.resolveGlobalYarnPath = exports.resolveGlobalNodePath = exports.resolve = exports.uriToFilePath = void 0;
L1853: var url = __require("url");
L1854: var path$1 = __require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/LoomServer-D8I04Chj.jsView on unpkg · L18528103locale = locale?.toLowerCase();
L8104: const _require = eval("require");
L8105: return {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/LoomServer-D8I04Chj.jsView on unpkg · L8103dist/main.jsView file
2Cross-file remote execution chain: dist/main.js spawns dist/rolldown-runtime-yvBN9yY6.js; helper contains network access plus dynamic code execution.
L2: import { t as __commonJSMin } from "./rolldown-runtime-yvBN9yY6.js";
L3: import { $ as get, $n as filter, $t as ignore, A as Boolean, An as mergeAll, Ar as identity, At as makeUnsafe, B as make$8, Bn as fail$2, Bt as catchTag, C as errorReported, Cn as ...
L4: import * as NodeChildProcess from "node:child_process";
L5: import "node:stream";
...
L474: /* istanbul ignore next */
L475: opt.platform = opt.platform || typeof process !== "undefined" && process.platform;
L476: opt.bracketedArray = opt.bracketedArray !== false;
...
L552: const valueRaw = match[3] ? unsafe(match[4]) : true;
L553: const value = valueRaw === "true" || valueRaw === "false" || valueRaw === "null" ? JSON.parse(valueRaw) : valueRaw;
L554: if (isArray) {
...
L4950: * const filePrimitive = Primitive.path("file", true)
L4951: * const filePath = yield* filePrimitive.parse("./package.json")
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/main.jsView on unpkg · L22import { t as __commonJSMin } from "./rolldown-runtime-yvBN9yY6.js";
L3: import { $ as get, $n as filter, $t as ignore, A as Boolean, An as mergeAll, Ar as identity, At as makeUnsafe, B as make$8, Bn as fail$2, Bt as catchTag, C as errorReported, Cn as ...
L4: import * as NodeChildProcess from "node:child_process";
L5: import "node:stream";
...
L474: /* istanbul ignore next */
L475: opt.platform = opt.platform || typeof process !== "undefined" && process.platform;
L476: opt.bracketedArray = opt.bracketedArray !== false;
...
L552: const valueRaw = match[3] ? unsafe(match[4]) : true;
L553: const value = valueRaw === "true" || valueRaw === "false" || valueRaw === "null" ? JSON.parse(valueRaw) : valueRaw;
L554: if (isArray) {
...
L4950: * const filePrimitive = Primitive.path("file", true)
L4951: * const filePath = yield* filePrimitive.parse("./package.json")
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/main.jsView on unpkg · L2dist/LoomStore-DMf2PkfP.jsView file
•path = dist/LoomStore-DMf2PkfP.js
kind = oversized_source_file
sizeBytes = 4443446
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/LoomStore-DMf2PkfP.jsView on unpkg•path = dist/LoomStore-DMf2PkfP.js
kind = oversized_cli_entrypoint
sizeBytes = 4443446
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/LoomStore-DMf2PkfP.jsView on unpkgFindings
5 High7 Medium5 Low
HighChild Processdist/LoomServer-D8I04Chj.js
HighShell
HighObfuscated Payload Loaderdist/LoomServer-D8I04Chj.js
HighCross File Remote Execution Contextdist/main.js
HighOversized Source Filedist/LoomStore-DMf2PkfP.js
MediumSecret Patterndist/volar-service-markdown-ZE1pdvJT.js
MediumDynamic Requiredist/LoomServer-D8I04Chj.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/main.js
MediumOversized Cli Entrypointdist/LoomStore-DMf2PkfP.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/LoomServer-D8I04Chj.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings