@dcrays/dcgchat@0.6.8: Suspicious npm security report (Warn)

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.38 MB of source, external domains: fengmk2.com, github.com, goo.gl, registry.npmjs.org, sts.aliyuncs.com, www.w3.org

Source & flagged code

4 flagged

index.jsView file

37`+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.prev}function $l(e,t){var r=eg(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=En(e,i)?t(e[i],e):""}var s=typeof Xm=="function"?Xm(e):[],o;if(co){o={};for(var a... L39: `}return s}});var WO=_((Gue,HO)=>{"use strict";var st=z("util").debuglog("formstream"),vz=z("stream"),bz=z("crypto"),xz=AO(),wz=z("util"),yp=pc(),zO=z("path"),_z=z("fs"),Sz=LO(),si...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(xm)});var Kr=_((q1,Xn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var u,l,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(w=b.dontPrettyTextNodes)!=null?w:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(I=b.spaceBeforeSlash)!=null?I:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var w=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,V-1)}j==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=w.OPEN_WAKA,x.startTagPosition=x.position):(!g(j)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,V-1),j==="]"&&(x.state=w.CDATA_ENDING);continue;case w.CDATA_ENDING:j==="]"?x.state=w.CDATA_ENDING_2:(x.cdata+="]"+j,x.s... L33: GFS4: `),console.error(e)});Ye[Pt]||(GE=global[Pt]||[],XE(Ye,GE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||VE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:u.res.headers.etag,res:u.res}}});var K8=_((Dfe,W8)=>{W8.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var i4=_((Ffe,n4)=>{"use strict";var bv=z("os"),QX=z("fs"),ZX=z("child_process"),eJ="/etc/resolv.conf";function r4(){var e="eth",t=bv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=Z8.exec(s)||e4.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,u=null,l=t4.exec(s);for(l&&(u=l[1]),i++;;){if(s=n[i],!s||Z8.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=iJ.exec(a);c&&i.push(c[1])}t(null,i)})};n4.exports=nr});var a4=_((jfe,o4)=>{var s4=Y8(),sJ=z("util"),oJ=vv(),aJ=br(),cJ=i4().ip(),uJ="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=ru.checkPathsSync(e,t,"copy",r);if(ru.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Source & flagged code

4 flagged · loading source

index.jsView file

37`+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.prev}function $l(e,t){var r=eg(e),n=[];if(r){n.length=e.length;for(var i=0;i<e.length;i++)n[i]=En(e,i)?t(e[i],e):""}var s=typeof Xm=="function"?Xm(e):[],o;if(co){o={};for(var a... L39: `}return s}});var WO=_((Gue,HO)=>{"use strict";var st=z("util").debuglog("formstream"),vz=z("stream"),bz=z("crypto"),xz=AO(),wz=z("util"),yp=pc(),zO=z("path"),_z=z("fs"),Sz=LO(),si...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L37

22`},headless:!1,chunkSize:1e4,emptyTag:"",cdata:!1}}}).call(xm)});var Kr=_((q1,Xn)=>{(function(){var e,t,r,n,i,s,o,a=[].slice,c={}.hasOwnProperty;e=function(){var u,l,f,p,d,h;if(h=a... L23: `,g.offset=(q=b.offset)!=null?q:0,g.dontPrettyTextNodes=(T=(w=b.dontPrettyTextNodes)!=null?w:b.dontprettytextnodes)!=null?T:0,g.spaceBeforeSlash=(O=(I=b.spaceBeforeSlash)!=null?I:b... L24: `||C==="\r"||C===" "}function y(C){return C==='"'||C==="'"}function k(C){return C===">"||g(C)}function q(C,x){return C.test(x)}function T(C,x){return!q(C,x)}var w=0;e.STATE={BEGIN:... ... L31: `?(x.line++,x.column=0):x.column++);x.textNode+=C.substring(ce,V-1)}j==="<"&&!(x.sawRoot&&x.closedRoot&&!x.strict)?(x.state=w.OPEN_WAKA,x.startTagPosition=x.position):(!g(j)&&(!x.s... L32: `?(x.line++,x.column=0):x.column++);x.cdata+=C.substring(ce,V-1),j==="]"&&(x.state=w.CDATA_ENDING);continue;case w.CDATA_ENDING:j==="]"?x.state=w.CDATA_ENDING_2:(x.cdata+="]"+j,x.s... L33: GFS4: `),console.error(e)});Ye[Pt]||(GE=global[Pt]||[],XE(Ye,GE),Ye.close=(function(e){function t(r,n){return e.call(Ye,r,function(i){i||VE(),typeof n=="function"&&n.apply(this,arg... ... L37: `+t.prev+t.base;return r+Jr.call(e,","+r)+` L38: `+t.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L22

93https://help.aliyun.com/document_detail/32069.html`);return i.stream&&(i.stream=null,a.stream=null),{name:t,etag:u.res.headers.etag,res:u.res}}});var K8=_((Dfe,W8)=>{W8.exports=fun... L94: <Style><Content>${i}</Content></Style>`;let a=await this.ossClient.request(o);return a=await this._parseResponse(a),{res:a.res,data:a.data}},t.prototype.getStyle=async function(n,i... L95: [%s][pid: %s][%s][%s] %s: %s ... L98: %s`,t.join(` L99: `)),console.error()}}});var i4=_((Ffe,n4)=>{"use strict";var bv=z("os"),QX=z("fs"),ZX=z("child_process"),eJ="/etc/resolv.conf";function r4(){var e="eth",t=bv.platform();return t===... L100: `),i=0;i<n.length;i++){var s=n[i].trimRight(),o=Z8.exec(s)||e4.exec(s);if(o){var a=o[1];if(a.indexOf(t)===0){var c=null,u=null,l=t4.exec(s);for(l&&(u=l[1]),i++;;){if(s=n[i],!s||Z8.... L101: `),o=0;o<s.length;o++){var a=s[o].trim(),c=iJ.exec(a);c&&i.push(c[1])}t(null,i)})};n4.exports=nr});var a4=_((jfe,o4)=>{var s4=Y8(),sJ=z("util"),oJ=vv(),aJ=br(),cJ=i4().ip(),uJ="rou... L102: raw xml: ${i}`,a.status=t.status,a.requestId=t.headers&&t.headers["x-oss-request-id"],a}let o=s.Message||`unknow request error, status: ${t.status}`;return s.Condition&&(o+=` (cond... ... L10

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L93

113see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=ru.checkPathsSync(e,t,"copy",r);if(ru.checkParentPathsSync(e,... L114: `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let s=r?t:"",o=JSON.stringify(e,n,i);if(o===void 0)throw new TypeError(`Converting ${typeof e} value to JSON is not supported`);return... L115:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

Findings

5 High3 Medium4 Low

HighChild Processindex.js

HighShell

HighSame File Env Network Executionindex.js

HighCommand Output Exfiltrationindex.js

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings