@byh3071/vhk@2.8.0: Clean npm security report (Allow)

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 754 KB of source, external domains: cli.github.com, git-scm.com, github.com, search.google.com, searchadvisor.naver.com, www.bing.com, www.google.com

Source & flagged code

1 flagged

dist/index.jsView file

880async function gate() { L881: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L882: console.log(chalk.bold(` ... L1265: // VHK-006: 생성 프로젝트엔 docs/spec.md 가 없음 → vhk 저장소의 규격 문서를 외부 링크로 참조. L1266: "\uC804\uCCB4 \uADDC\uACA9\uC740 [vhk \uADDC\uACA9 \uBB38\uC11C](https://github.com/byh3071-cpu/vhk/blob/main/docs/spec.md) (spec_version 1.1) \uCC38\uC870.", L1267: "", ... L1486: function loadCoreRuleset() { L1487: const brainRoot = process.env.YOHAN_BRAIN_ROOT; L1488: if (brainRoot) { ... L1497: return { L1498: data: CORE_RULESET_SNAPSHOT, L1499: source: "bundled",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L880

Source & flagged code

1 flagged · loading source

dist/index.jsView file

880async function gate() { L881: if (!ensureInteractive("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uC740 \uB300\uD654\uD615 \uC9C8\uBB38\uC774 \uD544\uC694\uD569\uB2C8\uB2E4. \uD130\uBBF8\uB110(PowerShell \uB4F1)\uC5D... L882: console.log(chalk.bold(` ... L1265: // VHK-006: 생성 프로젝트엔 docs/spec.md 가 없음 → vhk 저장소의 규격 문서를 외부 링크로 참조. L1266: "\uC804\uCCB4 \uADDC\uACA9\uC740 [vhk \uADDC\uACA9 \uBB38\uC11C](https://github.com/byh3071-cpu/vhk/blob/main/docs/spec.md) (spec_version 1.1) \uCC38\uC870.", L1267: "", ... L1486: function loadCoreRuleset() { L1487: const brainRoot = process.env.YOHAN_BRAIN_ROOT; L1488: if (brainRoot) { ... L1497: return { L1498: data: CORE_RULESET_SNAPSHOT, L1499: source: "bundled",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L880

Findings

2 Medium5 Low

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings