@byh3071/vhk: Suspicious npm security report (Warn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 829 KB of source, external domains: api.telegram.org, cli.github.com, example.com, git-scm.com, github.com, search.google.com, searchadvisor.naver.com, www.bing.com, www.google.com

Source & flagged code

3 flagged

dist/index.jsView file

910async function gate() { L911: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L912: console.log(chalk.bold(` ... L1283: "try {", L1284: " const vhk = join(process.cwd(), '.vhk')", L1285: " const needs = existsSync(join(vhk, 'NEEDS_CUSTOMIZATION'))", ... L1485: async function importNotionPrd(pageUrl) { L1486: const token = process.env.NOTION_TOKEN; L1487: if (!token) { ... L1584: try { L1585: pkg = readJsonFile(join(cwd, "package.json")); L1586: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L910

910async function gate() { L911: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L912: console.log(chalk.bold(` ... L1283: "try {", L1284: " const vhk = join(process.cwd(), '.vhk')", L1285: " const needs = existsSync(join(vhk, 'NEEDS_CUSTOMIZATION'))", ... L1485: async function importNotionPrd(pageUrl) { L1486: const token = process.env.NOTION_TOKEN; L1487: if (!token) { ... L1584: try { L1585: pkg = readJsonFile(join(cwd, "package.json")); L1586: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L910

dist/chunk-IAGZVVOB.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @byh3071/vhk@2.9.0 matchedIdentity = npm:QGJ5aDMwNzEvdmhr:2.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-IAGZVVOB.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

910async function gate() { L911: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L912: console.log(chalk.bold(` ... L1283: "try {", L1284: " const vhk = join(process.cwd(), '.vhk')", L1285: " const needs = existsSync(join(vhk, 'NEEDS_CUSTOMIZATION'))", ... L1485: async function importNotionPrd(pageUrl) { L1486: const token = process.env.NOTION_TOKEN; L1487: if (!token) { ... L1584: try { L1585: pkg = readJsonFile(join(cwd, "package.json")); L1586: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L910

910async function gate() { L911: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L912: console.log(chalk.bold(` ... L1283: "try {", L1284: " const vhk = join(process.cwd(), '.vhk')", L1285: " const needs = existsSync(join(vhk, 'NEEDS_CUSTOMIZATION'))", ... L1485: async function importNotionPrd(pageUrl) { L1486: const token = process.env.NOTION_TOKEN; L1487: if (!token) { ... L1584: try { L1585: pkg = readJsonFile(join(cwd, "package.json")); L1586: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L910

dist/chunk-IAGZVVOB.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @byh3071/vhk@2.9.0 matchedIdentity = npm:QGJ5aDMwNzEvdmhr:2.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-IAGZVVOB.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/chunk-IAGZVVOB.js

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings