registry / @decentnetwork/lan / 0.1.148
@decentnetwork/lan@0.1.148
⚠ Under reviewPrivate virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
CopyleftLicense
Source & flagged code
6 flaggeddist/tun/route-manager.jsView file
4*/
L5: import { execSync } from "child_process";
L6: import { Logger } from "../utils/logger.js";
High
Child Process
Package source references child process execution.
dist/tun/route-manager.jsView on unpkg · L4dist/ui/desktop/vendor/react-dom.production.min.jsView file
12*/
L13: 'use strict';(function(Q,zb){"object"===typeof exports&&"undefined"!==typeof module?zb(exports,require("react")):"function"===typeof define&&define.amd?define(["exports","react"],z...
L14: function mb(a,b){Ab(a,b);Ab(a+"Capture",b)}function Ab(a,b){$b[a]=b;for(a=0;a<b.length;a++)cg.add(b[a])}function bj(a){if(Zd.call(dg,a))return!0;if(Zd.call(eg,a))return!1;if(cj.tes...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/ui/desktop/vendor/react-dom.production.min.jsView on unpkg · L12Findings
1 Critical3 High6 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/daemon/server.js
HighChild Processdist/tun/route-manager.js
HighShell
HighCross File Remote Execution Contextdist/cli/commands.js
MediumDynamic Requiredist/ui/desktop/vendor/react-dom.production.min.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/commands.js
MediumShips Native Binarybin/tun-helper-linux-arm64
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @decentnetwork/lan@0.1.148.
See all versions of @decentnetwork/lan for other recorded verdicts.
- Review the evidence and your use of @decentnetwork/lan@0.1.148 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.