Static Scan Results
scanned 7d ago · by rust-scannerStatic analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
cli.mjs9.33 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsgithub.com
reachability-analyzers-cli.mjs4.15 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsgem.cooprepo.packagist.orgrubygems.org
repos/coana-tech/jelly-private/dist/bundle/chunk-ZSJKYAXK.js10.6 MB file, sampled 256 KB
FilesystemNetworkChildProcessHighEntropyStringsUrlStringswww.apache.org
Source & flagged code
11 flagged · loading sourcerepos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjsView file
7195import assert2 from "node:assert";
L7196: import { execFile, spawn } from "node:child_process";
L7197: import { createInterface } from "node:readline";
High
Child Process
Package source references child process execution.
repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjsView on unpkg · L7195252Cross-file remote execution chain: repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs spawns repos/coana-tech/callgraph-reachability-[redacted].mjs; helper contains network access plus dynamic code execution.
L252: }
L253: if (typeof process !== "undefined" && process.platform) {
L254: return process.platform === "win32";
...
L367: const eos = () => index >= length;
L368: const peek = () => str.charCodeAt(index + 1);
L369: const advance = () => {
...
L1798: *
L1799: * @see https://www.w3.org/TR/2008/REC-xml-20081126/#sec-white-space
L1800: */
...
L4974: var nodePath = require("path");
L4975: if (!import.meta.url.startsWith("data:")) {
L4976: scriptDirectory = nodePath.dirname(require("url").fileURLToPath(import.meta.url)) + "/";
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjsView on unpkg · L2524907if (globalThis.process?.versions.node) {
L4908: const fs22 = await import("fs/promises");
L4909: bytes = fs22.readFile(input);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjsView on unpkg · L49075849var func = `(${args}) => { ${body} };`;
L5850: ASM_CONSTS[start] = eval(func);
L5851: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjsView on unpkg · L5849repos/coana-tech/cocoa/release/Mono.Cecil.Rocks.dllView file
•path = repos/coana-tech/cocoa/release/Mono.Cecil.Rocks.dll
kind = native_binary
sizeBytes = 27136
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
repos/coana-tech/cocoa/release/Mono.Cecil.Rocks.dllView on unpkgrepos/tree-sitter/tree-sitter-java/tree-sitter-java.wasmView file
•path = repos/tree-sitter/tree-sitter-java/tree-sitter-java.wasm
kind = wasm_module
sizeBytes = 414722
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
repos/tree-sitter/tree-sitter-java/tree-sitter-java.wasmView on unpkgrepos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gzView file
•path = repos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gz
kind = high_entropy_blob
sizeBytes = 5493049
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
repos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gzView on unpkg•path = repos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gz
kind = compressed_blob
sizeBytes = 5493049
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
repos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gzView on unpkgrepos/coana-tech/jelly-private/dist/bundle/chunk-ZSJKYAXK.jsView file
•path = repos/coana-tech/jelly-private/dist/bundle/chunk-ZSJKYAXK.js
kind = oversized_source_file
sizeBytes = 11080727
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
repos/coana-tech/jelly-private/dist/bundle/chunk-ZSJKYAXK.jsView on unpkgrepos/coana-tech/spar-jvm/jdk-classes.jarView file
•path = repos/coana-tech/spar-jvm/jdk-classes.jar
kind = nested_archive_needs_inspection
sizeBytes = 68064938
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
repos/coana-tech/spar-jvm/jdk-classes.jarView on unpkgreachability-analyzers-cli.mjsView file
•path = reachability-analyzers-cli.mjs
kind = oversized_cli_entrypoint
sizeBytes = 4351416
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
reachability-analyzers-cli.mjsView on unpkgFindings
5 High8 Medium6 Low
HighChild Processrepos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs
HighShell
HighCross File Remote Execution Contextrepos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs
HighShips High Entropy Blobrepos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gz
HighOversized Source Filerepos/coana-tech/jelly-private/dist/bundle/chunk-ZSJKYAXK.js
MediumDynamic Requirerepos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryrepos/coana-tech/cocoa/release/Mono.Cecil.Rocks.dll
MediumShips Wasm Modulerepos/tree-sitter/tree-sitter-java/tree-sitter-java.wasm
MediumShips Compressed Blobrepos/coana-tech/spar-jvm/spar-jvm-x86_64-apple-darwin.gz
MediumOversized Cli Entrypointreachability-analyzers-cli.mjs
MediumStructural Risk Force Deep Review
LowEvalrepos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionrepos/coana-tech/spar-jvm/jdk-classes.jar
LowNo License