@dcrays/dcgchat-test@0.6.3: Suspicious npm security report (Warn)

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.38 MB of source, external domains: fengmk2.com, github.com, goo.gl, registry.npmjs.org, sts.aliyuncs.com, www.w3.org

Source & flagged code

4 flagged

index.jsView file

37`+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.prev}function jl(e,t){var r=Km(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=_n(e,i)?t(e[i],e):""}var s=typeof Um=="function"?Um(e):[],o;if(oo){o={};for(var a... L39: `}return s}});var CO=w((nue,TO)=>{"use strict";var st=H("util").debuglog("formstream"),N$=H("stream"),M$=H("crypto"),F$=pO(),j$=H("util"),dp=uc(),kO=H("path"),L$=H("fs"),B$=wO(),ni...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(fm)});var Kr=w((h1,Gn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var l,u,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(_=b.dontPrettyTextNodes)!=null?_:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(R=b.spaceBeforeSlash)!=null?R:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var _=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,X-1)}M==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=_.OPEN_WAKA,x.startTagPosition=x.position):(!g(M)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,X-1),M==="]"&&(x.state=_.CDATA_ENDING);continue;case _.CDATA_ENDING:M==="]"?x.state=_.CDATA_ENDING_2:(x.cdata+="]"+M,x.s... L33: GFS4: `),console.error(e)});Ye[Dt]||(AE=global[Dt]||[],RE(Ye,AE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||IE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:l.res.headers.etag,res:l.res}}});var OR=w((Hpe,CR)=>{CR.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var BR=w((Gpe,LR)=>{"use strict";var pv=H("os"),mX=H("fs"),gX=H("child_process"),yX="/etc/resolv.conf";function jR(){var e="eth",t=pv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=NR.exec(s)||MR.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,l=null,u=FR.exec(s);for(u&&(l=u[1]),i++;;){if(s=n[i],!s||NR.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=wX.exec(a);c&&i.push(c[1])}t(null,i)})};LR.exports=nr});var zR=w((Vpe,$R)=>{var UR=DR(),_X=H("util"),SX=lv(),EX=br(),kX=BR().ip(),TX="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=eu.checkPathsSync(e,t,"copy",r);if(eu.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Source & flagged code

4 flagged · loading source

index.jsView file

37`+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.prev}function jl(e,t){var r=Km(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=_n(e,i)?t(e[i],e):""}var s=typeof Um=="function"?Um(e):[],o;if(oo){o={};for(var a... L39: `}return s}});var CO=w((nue,TO)=>{"use strict";var st=H("util").debuglog("formstream"),N$=H("stream"),M$=H("crypto"),F$=pO(),j$=H("util"),dp=uc(),kO=H("path"),L$=H("fs"),B$=wO(),ni...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(fm)});var Kr=w((h1,Gn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var l,u,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(_=b.dontPrettyTextNodes)!=null?_:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(R=b.spaceBeforeSlash)!=null?R:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var _=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,X-1)}M==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=_.OPEN_WAKA,x.startTagPosition=x.position):(!g(M)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,X-1),M==="]"&&(x.state=_.CDATA_ENDING);continue;case _.CDATA_ENDING:M==="]"?x.state=_.CDATA_ENDING_2:(x.cdata+="]"+M,x.s... L33: GFS4: `),console.error(e)});Ye[Dt]||(AE=global[Dt]||[],RE(Ye,AE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||IE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:l.res.headers.etag,res:l.res}}});var OR=w((Hpe,CR)=>{CR.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var BR=w((Gpe,LR)=>{"use strict";var pv=H("os"),mX=H("fs"),gX=H("child_process"),yX="/etc/resolv.conf";function jR(){var e="eth",t=pv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=NR.exec(s)||MR.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,l=null,u=FR.exec(s);for(u&&(l=u[1]),i++;;){if(s=n[i],!s||NR.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=wX.exec(a);c&&i.push(c[1])}t(null,i)})};LR.exports=nr});var zR=w((Vpe,$R)=>{var UR=DR(),_X=H("util"),SX=lv(),EX=br(),kX=BR().ip(),TX="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=eu.checkPathsSync(e,t,"copy",r);if(eu.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Findings

5 High3 Medium4 Low

HighChild Processindex.js

HighShell

HighSame File Env Network Executionindex.js

HighCommand Output Exfiltrationindex.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings