@dcrays/dcgchat-test@0.5.50: Suspicious npm security report

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.38 MB of source, external domains: fengmk2.com, github.com, goo.gl, registry.npmjs.org, sts.aliyuncs.com, www.w3.org

Source & flagged code

4 flagged

index.jsView file

37`+t.prev+t.base;return r+Xr.call(e,","+r)+` L38: `+t.prev}function Il(e,t){var r=Bm(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=bn(e,i)?t(e[i],e):""}var s=typeof Nm=="function"?Nm(e):[],o;if(to){o={};for(var a... L39: `}return s}});var nO=_((_ce,rO)=>{"use strict";var st=W("util").debuglog("formstream"),w$=W("stream"),_$=W("crypto"),S$=UC(),E$=W("util"),sp=Va(),tO=W("path"),k$=W("fs"),T$=YC(),ri...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(om)});var Wr=_((H_,Kn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var u,l,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(w=b.dontPrettyTextNodes)!=null?w:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(R=b.spaceBeforeSlash)!=null?R:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var w=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,V-1)}M==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=w.OPEN_WAKA,x.startTagPosition=x.position):(!g(M)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,V-1),M==="]"&&(x.state=w.CDATA_ENDING);continue;case w.CDATA_ENDING:M==="]"?x.state=w.CDATA_ENDING_2:(x.cdata+="]"+M,x.s... L33: GFS4: `),console.error(e)});Ye[qt]||(sE=global[qt]||[],aE(Ye,sE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||oE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Xr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:u.res.headers.etag,res:u.res}}});var iR=_((upe,nR)=>{nR.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var gR=_((fpe,mR)=>{"use strict";var sv=W("os"),tX=W("fs"),rX=W("child_process"),nX="/etc/resolv.conf";function hR(){var e="eth",t=sv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=pR.exec(s)||fR.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,u=null,l=dR.exec(s);for(l&&(u=l[1]),i++;;){if(s=n[i],!s||pR.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=aX.exec(a);c&&i.push(c[1])}t(null,i)})};mR.exports=nr});var bR=_((dpe,vR)=>{var yR=uR(),cX=W("util"),uX=iv(),lX=br(),pX=gR().ip(),fX="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=Bc.checkPathsSync(e,t,"copy",r);if(Bc.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Source & flagged code

4 flagged · loading source

index.jsView file

37`+t.prev+t.base;return r+Xr.call(e,","+r)+` L38: `+t.prev}function Il(e,t){var r=Bm(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=bn(e,i)?t(e[i],e):""}var s=typeof Nm=="function"?Nm(e):[],o;if(to){o={};for(var a... L39: `}return s}});var nO=_((_ce,rO)=>{"use strict";var st=W("util").debuglog("formstream"),w$=W("stream"),_$=W("crypto"),S$=UC(),E$=W("util"),sp=Va(),tO=W("path"),k$=W("fs"),T$=YC(),ri...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(om)});var Wr=_((H_,Kn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var u,l,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(w=b.dontPrettyTextNodes)!=null?w:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(R=b.spaceBeforeSlash)!=null?R:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var w=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,V-1)}M==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=w.OPEN_WAKA,x.startTagPosition=x.position):(!g(M)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,V-1),M==="]"&&(x.state=w.CDATA_ENDING);continue;case w.CDATA_ENDING:M==="]"?x.state=w.CDATA_ENDING_2:(x.cdata+="]"+M,x.s... L33: GFS4: `),console.error(e)});Ye[qt]||(sE=global[qt]||[],aE(Ye,sE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||oE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Xr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:u.res.headers.etag,res:u.res}}});var iR=_((upe,nR)=>{nR.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var gR=_((fpe,mR)=>{"use strict";var sv=W("os"),tX=W("fs"),rX=W("child_process"),nX="/etc/resolv.conf";function hR(){var e="eth",t=sv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=pR.exec(s)||fR.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,u=null,l=dR.exec(s);for(l&&(u=l[1]),i++;;){if(s=n[i],!s||pR.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=aX.exec(a);c&&i.push(c[1])}t(null,i)})};mR.exports=nr});var bR=_((dpe,vR)=>{var yR=uR(),cX=W("util"),uX=iv(),lX=br(),pX=gR().ip(),fX="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=Bc.checkPathsSync(e,t,"copy",r);if(Bc.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Findings

5 High3 Medium4 Low

HighChild Processindex.js

HighShell

HighSame File Env Network Executionindex.js

HighCommand Output Exfiltrationindex.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings