registry  /  @decentnetwork/peer  /  0.1.89

@decentnetwork/peer@0.1.89

Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
CryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStrings
Manifest
CopyleftLicense
scanned 45 file(s), 542 KB of source

Source & flagged code

2 flagged · loading source
dist/peer.jsView file
30patternName = generic_password severity = medium line = 30 matchedText = { host: ...s" }
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/peer.jsView on unpkg · L30
dist/stun.jsView file
123const hmacInput = concatBytes([headerForHmac, body]); L124: const hmac = createHmac("sha1", Buffer.from(opts.integrityKey)).update(hmacInput).digest(); L125: body = concatBytes([
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/stun.jsView on unpkg · L123

Findings

3 Medium6 Low
MediumSecret Patterndist/peer.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/stun.js
LowFilesystem
LowHigh Entropy Strings
LowCopyleft License