registry / @deeeed/metamask-harness / 0.15.0

@deeeed/metamask-harness@0.15.0

Architecture: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 151 file(s), 977 KB of source, external domains: 127.0.0.1, metamask.github.io, nodejs.org, registry.npmjs.org, www.w3.org

Source & flagged code

5 flagged

dist/commands/fixtures.jsView file

Lines 386-426javascript

386 fs.lstatSync(canonical);

387 return usageOut(json, "fixtures", `wallet fixture already exists: ${canonical}`, "re-run with --force only when replacement is intentional");

388 } catch (error) {

389 if (error.code !== "ENOENT") throw error;

390 }

391 }

392 fs.mkdirSync(path.dirname(canonical), { recursive: true });

393 let fixtureBytes;

394 if (source) {

395 const resolvedSource = path.resolve(source);

396 try {

397 fixtureBytes = fs.readFileSync(resolvedSource);

398 } catch (error) {

399 if (error.code === "ENOENT") {

400 return usageOut(json, "fixtures", `wallet fixture source does not exist: ${resolvedSource}`, "pass an existing JSON file to --from");

401 }

402 throw error;

403 }

404 } else {

405 const fixture = {

406 password: "metamask",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L406

407 accounts: [{

408 type: "mnemonic",

409 value: "test test test test test test test test test test test junk",

410 name: "dev1",

411 count: 1,

412 names: ["dev1"]

413 }],

414 settings: { skipPerpsTutorial: true, autoLockNever: true }

415 };

416 fixtureBytes = `${JSON.stringify(fixture, null, 2)}

417`;

418 }

419 const temporary = `${canonical}.${process.pid}.${randomUUID()}.tmp`;

420 let descriptor = null;

421 try {

422 descriptor = fs.openSync(

423 temporary,

424 fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,

425 384

426 );

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150

dist/paths.jsView file

Lines 127-167javascript

127}

128async function importRecipeHarnessRuntimeReactNativeBridge() {

129 return importProtocolPackage(

130 "@farmslot/recipe-harness/runtime/react-native-bridge",

131 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

132 );

133}

134async function importRecipeHarnessCli

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

library/actions/extension/platform/cdp.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deeeed/metamask-harness@0.14.5 matchedIdentity = npm:[redacted]:0.14.5 similarity = 0.617 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/actions/extension/platform/cdp.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/commands/fixtures.jsView file

406patternName = generic_password severity = medium line = 406 matchedText = password...sk",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L406

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

162L163: async eval(client, args) { L164: const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L162

dist/paths.jsView file

147try { L148: return await import(packageName); L149: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/paths.jsView on unpkg · L147

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

library/actions/extension/platform/cdp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/actions/extension/platform/cdp.mjsView on unpkg

Findings

1 High6 Medium7 Low

HighPrevious Version Dangerous Deltalibrary/actions/extension/platform/cdp.mjs

MediumSecret Patterndist/commands/fixtures.js

MediumDynamic Requiredist/paths.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperadapters/core/inject.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaladapters/mobile/bridge-runtime/cdp-bridge.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/commands/fixtures.jsView file

Lines 386-426javascript

386 fs.lstatSync(canonical);

387 return usageOut(json, "fixtures", `wallet fixture already exists: ${canonical}`, "re-run with --force only when replacement is intentional");

388 } catch (error) {

389 if (error.code !== "ENOENT") throw error;

390 }

391 }

392 fs.mkdirSync(path.dirname(canonical), { recursive: true });

393 let fixtureBytes;

394 if (source) {

395 const resolvedSource = path.resolve(source);

396 try {

397 fixtureBytes = fs.readFileSync(resolvedSource);

398 } catch (error) {

399 if (error.code === "ENOENT") {

400 return usageOut(json, "fixtures", `wallet fixture source does not exist: ${resolvedSource}`, "pass an existing JSON file to --from");

401 }

402 throw error;

403 }

404 } else {

405 const fixture = {

406 password: "metamask",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L406

407 accounts: [{

408 type: "mnemonic",

409 value: "test test test test test test test test test test test junk",

410 name: "dev1",

411 count: 1,

412 names: ["dev1"]

413 }],

414 settings: { skipPerpsTutorial: true, autoLockNever: true }

415 };

416 fixtureBytes = `${JSON.stringify(fixture, null, 2)}

417`;

418 }

419 const temporary = `${canonical}.${process.pid}.${randomUUID()}.tmp`;

420 let descriptor = null;

421 try {

422 descriptor = fs.openSync(

423 temporary,

424 fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,

425 384

426 );

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150

dist/paths.jsView file

Lines 127-167javascript

127}

128async function importRecipeHarnessRuntimeReactNativeBridge() {

129 return importProtocolPackage(

130 "@farmslot/recipe-harness/runtime/react-native-bridge",

131 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

132 );

133}

134async function importRecipeHarnessCli

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

library/actions/extension/platform/cdp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/actions/extension/platform/cdp.mjsView on unpkg