registry  /  @botiverse/raft-daemon  /  0.65.0

@botiverse/raft-daemon@0.65.0

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsObfuscatedUrlStrings
Manifest
NoLicense
scanned 9 file(s), 4.70 MB of source, external domains: fetch.spec.whatwg.org, github.com, json-schema.org, mimesniff.spec.whatwg.org, opencode.ai, slock.example.com, webidl.spec.whatwg.org, www.ietf.org

Source & flagged code

4 flagged · loading source
dist/chunk-53ZFBLI4.jsView file
11955patternName = generic_password severity = medium line = 11955 matchedText = if (url....D]";
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/chunk-53ZFBLI4.jsView on unpkg · L11955
dist/dist-OGRAMTIO.jsView file
12import path3 from "path"; L13: import { spawn } from "child_process"; L14: import { mkdir, readFile, stat, writeFile } from "fs/promises";
High
Child Process

Package source references child process execution.

dist/dist-OGRAMTIO.jsView on unpkg · L12
1845} L1846: const execArgv = process3.execArgv ?? []; L1847: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Shell

Package source references shell execution.

dist/dist-OGRAMTIO.jsView on unpkg · L1845
12Cross-file remote execution chain: dist/dist-OGRAMTIO.js spawns dist/cli/index.js; helper contains network access plus dynamic code execution. L12: import path3 from "path"; L13: import { spawn } from "child_process"; L14: import { mkdir, readFile, stat, writeFile } from "fs/promises"; ... L87: * Constructs the CommanderError class L88: * @param {number} exitCode suggested exit code which could be used with process.exit L89: * @param {string} code an id string representing the error ... L1062: this._outputConfiguration = { L1063: writeOut: (str) => process3.stdout.write(str), L1064: writeErr: (str) => process3.stderr.write(str), ... L1098: * @returns {Command[]} L1099: * @private L1100: */
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/dist-OGRAMTIO.jsView on unpkg · L12

Findings

3 High4 Medium7 Low
HighChild Processdist/dist-OGRAMTIO.js
HighShelldist/dist-OGRAMTIO.js
HighCross File Remote Execution Contextdist/dist-OGRAMTIO.js
MediumSecret Patterndist/chunk-53ZFBLI4.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License