registry / @axtools/cv-switch-web / 1.0.4

@axtools/cv-switch-web@1.0.4

Web-based AI tool config manager - like CC Switch for cloud servers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 17 file(s), 352 KB of source, external domains: 0.0.0.0, 127.0.0.1, vuejs.org, www.w3.org

Source & flagged code

3 flagged

bin/server.mjsView file

Lines 352-392javascript

352}

353

354// ---- restart 命令 ----

355async function cmdRestart(port) {

356 const wasRunning = await tryStop()

357 if (wasRunning) {

358 console.log(' \u2713 已停止旧服务')

359 }

360 await cmdStart(port)

361}

362

363// ---- serve 命令：前台运行，交给 systemd / supervisor 管理生命周期 ----

364async function cmdServe(port) {

365 await ensureServerScript()

366 Object.assign(process.env, getServerEnv(port))

367 printServerInfo({

368 port,

369 pid: process.pid,

370 status: '前台运行中',

371 stopHint: 'Ctrl+C',

372 })

373 await import(pathToFileURL(SERVER_SCRIPT).href)

374}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/server.mjsView on unpkg · L372

375

376// ---- kill 命令 ----

377async function cmdKill() {

378 const ports = await readPorts()

379 if (ports.length === 0) {

380 console.log('\n \u2717 没有记录任何端口\n')

381 process.exit(1)

382 }

383

384 console.log(`\n 检测到 ${ports.length} 个记录端口: ${ports.join(', ')}`)

385 console.log(' 正在并发探测 /info 并终止 cv-switch-web 进程...\n')

386

387 const results = await Promise.all(ports.map(p => killPort(p)))

388

389 let killedCount = 0

390 for (const r of results) {

391 if (r.killed) {

392 console.log(` \u2713 端口 ${r.port} \u2014 已终止`)

backend/dist/db.jsView file

Lines 1-1javascript

1const a1_0xc2f162=a1_0x512e;(function(_0x505471,_0xd26756){const _0xc18f0c=a1_0x512e,_0x342fc9=_0x505471();while(!![]){try{const _0x497251=-parseInt(_0xc18f0c(0x1b4))/0x1+parseInt(

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg

Source & flagged code

3 flagged · loading source

bin/server.mjsView file

372}) L373: await import(pathToFileURL(SERVER_SCRIPT).href) L374: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/server.mjsView on unpkg · L372

backend/dist/db.jsView file

1const a1_0xc2f162=a1_0x512e;(function(_0x505471,_0xd26756){const _0xc18f0c=a1_0x512e,_0x342fc9=_0x505471();while(!![]){try{const _0x497251=-parseInt(_0xc18f0c(0x1b4))/0x1+parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

backend/dist/db.jsView on unpkg · L1

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg

Findings

3 High4 Medium5 Low

HighObfuscated Payload Loaderbackend/dist/db.js

HighObfuscated

HighShips High Entropy Blobfrontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2

MediumDynamic Requirebin/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/server.mjsView file

Lines 352-392javascript

352}

353

354// ---- restart 命令 ----

355async function cmdRestart(port) {

356 const wasRunning = await tryStop()

357 if (wasRunning) {

358 console.log(' \u2713 已停止旧服务')

359 }

360 await cmdStart(port)

361}

362

363// ---- serve 命令：前台运行，交给 systemd / supervisor 管理生命周期 ----

364async function cmdServe(port) {

365 await ensureServerScript()

366 Object.assign(process.env, getServerEnv(port))

367 printServerInfo({

368 port,

369 pid: process.pid,

370 status: '前台运行中',

371 stopHint: 'Ctrl+C',

372 })

373 await import(pathToFileURL(SERVER_SCRIPT).href)

374}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/server.mjsView on unpkg · L372

375

376// ---- kill 命令 ----

377async function cmdKill() {

378 const ports = await readPorts()

379 if (ports.length === 0) {

380 console.log('\n \u2717 没有记录任何端口\n')

381 process.exit(1)

382 }

383

384 console.log(`\n 检测到 ${ports.length} 个记录端口: ${ports.join(', ')}`)

385 console.log(' 正在并发探测 /info 并终止 cv-switch-web 进程...\n')

386

387 const results = await Promise.all(ports.map(p => killPort(p)))

388

389 let killedCount = 0

390 for (const r of results) {

391 if (r.killed) {

392 console.log(` \u2713 端口 ${r.port} \u2014 已终止`)

backend/dist/db.jsView file

Lines 1-1javascript

1const a1_0xc2f162=a1_0x512e;(function(_0x505471,_0xd26756){const _0xc18f0c=a1_0x512e,_0x342fc9=_0x505471();while(!![]){try{const _0x497251=-parseInt(_0xc18f0c(0x1b4))/0x1+parseInt(

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg