registry  /  @aztec/txe  /  5.0.1

@aztec/txe@5.0.1

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 81 file(s), 5.22 MB of source, external domains: docs.aztec.network, github.com, json-schema.org

Source & flagged code

6 flagged · loading source
dest/HandshakeRegistry-D2W3AOPD.jsView file
3patternName = google_api_key severity = high line = 3 matchedText = import"....ed};
High
High Secret

Package contains a high-severity secret pattern.

dest/HandshakeRegistry-D2W3AOPD.jsView on unpkg · L3
3patternName = google_api_key severity = high line = 3 matchedText = import"....ed};
High
Secret Pattern

Google API key in dest/HandshakeRegistry-D2W3AOPD.js

dest/HandshakeRegistry-D2W3AOPD.jsView on unpkg · L3
dest/state_machine/synchronizer.jsView file
32} L33: /** Forks the world state at the given block number, defaulting to the latest one. */ fork(block) { L34: return this.nativeWorldStateService.fork(block ? BlockNumber(block) : undefined);
High
Child Process

Package source references child process execution.

dest/state_machine/synchronizer.jsView on unpkg · L32
dest/chunk-RELAEYUE.jsView file
15})`);return deprecatedfn}__name(wrapfunction,"wrapfunction");function wrapproperty(obj,prop,message2){if(!obj||typeof obj!="object"&&typeof obj!="function")throw new TypeError("arg... L16: at `+callSiteToString(stack2[i]);return str}__name(createStackString,"createStackString");function depd(namespace){if(!namespace)throw new TypeError("argument namespace is required... L17: `,"utf8")}}}__name(log,"log");function callSiteLocation(callSite){var file=callSite.getFileName()||"<anonymous>",line=callSite.getLineNumber(),colm=callSite.getColumnNumber();callS... L18: at `+callSiteToString(stack2[i]);return formatted}return caller&&(formatted+=" at "+formatLocation(caller)),formatted}__name(formatPlain,"formatPlain");function formatColor(msg,cal... L19: \x1B[36mat `+callSiteToString(stack2[i])+"\x1B[39m";return formatted}return caller&&(formatted+=" \x1B[36m"+formatLocation(caller)+"\x1B[39m"),formatted}__name(formatColor,"formatC... L20: "use strict" ... L29: return fn.apply(this, arguments) L30: }`)(fn2,log3,this,message2,site2);return deprecatedfn2}__name(wrapfunction2,"wrapfunction");function wrapproperty2(obj,prop,message2){if(!obj||typeof obj!="object"&&typeof obj!="fu... L31: $
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dest/chunk-RELAEYUE.jsView on unpkg · L15
10at `+callSiteToString(stack2[i]);return formatted}return caller&&(formatted+=" at "+formatLocation(caller)),formatted}__name(formatPlain,"formatPlain");function formatColor(msg,cal... L11: \x1B[36mat `+callSiteToString(stack2[i])+"\x1B[39m";return formatted}return caller&&(formatted+=" \x1B[36m"+formatLocation(caller)+"\x1B[39m"),formatted}__name(formatColor,"formatC... L12: "use strict"
Low
Eval

Package source references a known benign dynamic code generation pattern.

dest/chunk-RELAEYUE.jsView on unpkg · L10
dest/utils/txe_artifact_resolver.jsView file
127this.#logger.debug(`Loading compiled artifact ${artifactPath}`); L128: const artifactJSON = JSON.parse(await readFile(artifactPath, 'utf-8')); L129: const artifactWithoutHash = loadContractArtifact(artifactJSON); ... L154: fd.on('end', function() { L155: hash.end(); L156: resolve(hash.read());
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dest/utils/txe_artifact_resolver.jsView on unpkg · L127

Findings

4 High2 Medium8 Low
HighHigh Secretdest/HandshakeRegistry-D2W3AOPD.js
HighChild Processdest/state_machine/synchronizer.js
HighSame File Env Network Executiondest/chunk-RELAEYUE.js
HighSecret Patterndest/HandshakeRegistry-D2W3AOPD.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldest/chunk-RELAEYUE.js
LowWeak Cryptodest/utils/txe_artifact_resolver.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License