registry  /  @coreframe/scripts  /  0.1.5

@coreframe/scripts@0.1.5

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 33 file(s), 62.3 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
dist/config.jsView file
1import{access as e}from"node:fs/promises";import{resolve as t}from"node:path";import{pathToFileURL as n}from"node:url";function r(e){return e}async function i({cwd:r=process.cwd()}...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L1
dist/deploy.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @coreframe/scripts@0.1.1 matchedIdentity = npm:QGNvcmVmcmFtZS9zY3JpcHRz:0.1.1 similarity = 0.414 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy.jsView on unpkg

Findings

1 High4 Medium5 Low
HighPrevious Version Dangerous Deltadist/deploy.js
MediumDynamic Requiredist/config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License