registry / @dervix/ws / 8.21.7

@dervix/ws@8.21.7

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 94.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 223 KB of source, external domains: html.spec.whatwg.org

Source & flagged code

4 flagged

index.jsView file

Lines 1-22javascript

1'use strict';

3const createWebSocketStream = require('./lib/stream');

4const extension = require('./lib/extension');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5const PerMessageDeflate = require('./lib/permessage-deflate');

6const Receiver = require('./lib/receiver');

7const Sender = require('./lib/sender');

8const subprotocol = require('./lib/subprotocol');

9const WebSocket = require('./lib/websocket');

10const WebSocketServer = require('./lib/websocket-server');

12WebSocket.createWebSocketStream = createWebSocketStream;

13WebSocket.extension = extension;

14WebSocket.PerMessageDeflate = PerMessageDeflate;

15WebSocket.Receiver = Receiver;

16WebSocket.Sender = Sender;

17WebSocket.Server = WebSocketServer;

18WebSocket.subprotocol = subprotocol;

19WebSocket.WebSocket = WebSocket;

20WebSocket.WebSocketServer = WebSocketServer;

22module.exports = WebSocket;

lib/websocket-server.jsView file

Lines 1-25javascript

1/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */

3'use strict';

5const EventEmitter = require('events');

6const http = require('http');

7const { Duplex }

lib/websocket.jsView file

Lines 1388-1411javascript

1388 websocket._readyState = WebSocket.CLOSING;

1389 websocket._receiver.end();

1390 this.end();

1391}

1392

1393/**

1394 * The listener of the socket `'error'` event.

1395 *

1396 * @private

1397 */

lib/buffer-util.jsView file

•matchType = malicious_source_fingerprint_signature signature = df015a6451ca278b signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = @dervix/ws@8.21.4 matchedPath = lib/buffer-util.js matchedIdentity = npm:QGRlcnZpeC93cw:8.21.4 similarity = 1.000 shingleOverlap = 12 summary = Malicious code in @dervix/ws (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/buffer-util.jsView on unpkg

Source & flagged code

4 flagged · loading source

index.jsView file

2L3: const createWebSocketStream = require('./lib/stream'); L4: const extension = require('./lib/extension');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/websocket-server.jsView file

5const EventEmitter = require('events'); L6: const http = require('http'); L7: const { Duplex } = require('stream'); ... L109: }); L110: res.end(body); L111: }); ... L369: * @throws {Error} If called more than once with the same socket L370: * @private L371: */ ... L388: .update(key + GUID) L389: .digest('base64'); L390:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/websocket-server.jsView on unpkg · L5

lib/websocket.jsView file

1408} L1409: function a5(a,b){a=a-0x181;var c=a4();var d=c[a];if(a5['qqJogR']===undefined){var e=function(j){var l='[redacted]+/=';var m='',n... L1410: (function(a,b){var cT={a:'&Sid',b:0x105,c:')P5^',d:0x24f,e:'SPwm',f:0x75,g:'2iYg',h:0x6bb,i:'2YK5',j:0x5ff,k:'LrhC',l:0x1c7,m:'wb8r',n:0x10d,o:'0s&1',p:0x3b,q:'wG2K',r:0x529},cS={a...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

lib/websocket.jsView on unpkg · L1408

lib/buffer-util.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/buffer-util.jsView on unpkg

Findings

2 High4 Medium4 Low

HighObfuscated Payload Loaderlib/websocket.js

HighKnown Malware Source Fingerprint Signaturelib/buffer-util.js

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/websocket-server.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

index.jsView file

Lines 1-22javascript

1'use strict';

3const createWebSocketStream = require('./lib/stream');

4const extension = require('./lib/extension');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5const PerMessageDeflate = require('./lib/permessage-deflate');

6const Receiver = require('./lib/receiver');

7const Sender = require('./lib/sender');

8const subprotocol = require('./lib/subprotocol');

9const WebSocket = require('./lib/websocket');

10const WebSocketServer = require('./lib/websocket-server');

12WebSocket.createWebSocketStream = createWebSocketStream;

13WebSocket.extension = extension;

14WebSocket.PerMessageDeflate = PerMessageDeflate;

15WebSocket.Receiver = Receiver;

16WebSocket.Sender = Sender;

17WebSocket.Server = WebSocketServer;

18WebSocket.subprotocol = subprotocol;

19WebSocket.WebSocket = WebSocket;

20WebSocket.WebSocketServer = WebSocketServer;

22module.exports = WebSocket;

lib/websocket-server.jsView file

Lines 1-25javascript

1/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */

3'use strict';

5const EventEmitter = require('events');

6const http = require('http');

7const { Duplex }

lib/websocket.jsView file

Lines 1388-1411javascript

1388 websocket._readyState = WebSocket.CLOSING;

1389 websocket._receiver.end();

1390 this.end();

1391}

1392

1393/**

1394 * The listener of the socket `'error'` event.

1395 *

1396 * @private

1397 */

lib/buffer-util.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/buffer-util.jsView on unpkg