registry / @bbuilders/djeon402-contracts / 3.0.0

@bbuilders/djeon402-contracts@3.0.0

DONGJEON402 (DJEON402) - Enterprise-grade gasless payment token contracts with EIP-3009 (x402) support

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 177 file(s), 455 KB of source, external domains: api.etherscan.io, developer.mozilla.org, docs.soliditylang.org, en.cppreference.com, en.wikipedia.org, github.com, prover.certora.com, registry.npmjs.com, solidity.readthedocs.io

Source & flagged code

5 flagged

package.jsonView file

Lines 12-52json

12 "payment",

13 "erc20",

14 "erc2612",

15 "kyc",

16 "upgradeable",

17 "uups",

18 "diamond"

19 ],

20 "license": "MIT",

21 "author": "bbuilders <dev@bbuilders.xyz>",

22 "files": [

23 "src/**/*.sol",

24 "lib",

25 "foundry.toml",

26 "remappings.txt",

27 "README.md",

28 "LICENSE"

29 ],

30 "scripts": {

31 "prepare": "bun run setup:submodules && simple-git-hooks",

32 "postinstall": "bun run setup:submodules",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "setup:submodules": "git submodule update --init --recursive || echo 'Submodules not available, using npm dependencies'",

34 "build": "forge build",

35 "test": "forge test",

36 "clean": "forge clean",

37 "fmt": "forge fmt",

38 "fmt:check": "forge fmt --check",

39 "lint": "solhint 'src/**/*.sol'",

40 "lint:fix": "solhint 'src/**/*.sol' --fix"

41 },

42 "publishConfig": {

43 "registry": "https://registry.npmjs.org",

44 "access": "public"

45 },

46 "devDependencies": {

47 "lint-staged": "^16.2.7",

48 "simple-git-hooks": "^2.13.1",

49 "solhint": "^6.0.3"

50 },

51 "simple-git-hooks": {

52 "pre-commit": "bunx lint-staged"

lib/openzeppelin-contracts-upgradeable/solhint.config.jsView file

Lines 1-21javascript

1const customRules = require('solhint-plugin-openzeppelin');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/openzeppelin-contracts-upgradeable/solhint.config.jsView on unpkg · L1

3const rules = [

lib/forge-std/scripts/vm.pyView file

•path = lib/forge-std/scripts/vm.py kind = build_helper sizeBytes = 17709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/forge-std/scripts/vm.pyView on unpkg

lib/openzeppelin-contracts-upgradeable/audits/2024-12-v5.2.pdfView file

•path = lib/openzeppelin-contracts-upgradeable/audits/2024-12-v5.2.pdf kind = high_entropy_blob sizeBytes = 242253 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/openzeppelin-contracts-upgradeable/audits/2024-12-v5.2.pdfView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code