registry / @easbot/utils / 0.2.49

@easbot/utils@0.2.49

Shared utilities library for EASBOT ecosystem

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 491 KB of source, external domains: nodejs.org, yarnpkg.com

Source & flagged code

6 flagged

dist/chunks/main-ZMRSNK7G.mjsView file

Lines 42-66javascript

42you could consider using yarn instead of npm which has built-in support for

43installing a package on multiple platforms simultaneously.

45If you are installing with yarn, you can try listing both "arm64" and "x64"

46in your ".yarnrc.yml" file using the "supportedArchitectures" feature:

47https://yarnpkg.com/configuration/yarnrc/#supportedArchitectures

48Keep in mind that this means multiple copies of esbuild will be present.

49`),new Error(`

50You installed esbuild for another platform than the one you're currently using.

51This won't work because esbuild is written with native code and needs to

52install a platform-specific binary executable.

53${a}

54Another alternative is to use the "esbuild-wasm" package instead, which works

55the same way on all platforms. But it comes with a heavy performance cost and

56can sometimes be 10x slower than the "esbuild" package, so you may also not

57want to do that.

58`)}throw new Error(`The package "${e}" could not be found, and is needed by esbuild.

60If you are installing esbuild with npm, make sure that you don't specify the

61"--no-optional" or "--omit=optional" flags. The "optionalDependencies" feature

62of "package.json" is used by esbuild to install the correct binary executable

63for your current platform.`)}throw o}}if(/\.zip\//.test(n)){let o;try{o=a("pnpapi");}catch{}if(o){let s=o.getPackageInformation(o.topLevel).packageLocation,a=ne.join(s,"node_modules",".cache","esbuild",`pnpapi-${e.replace("/","-")}-0.28.0-${ne.basename(t)}`);return de.existsSync(a)||(de.mkdirSync(ne.dirname(a),{recursive:true}),de.copyFileSync(n,a),de.chmodSync(a,493)),{binPath:a,isWASM:r}}}return {binPath:n,isWASM:r}}var pt=a("child_process"),Ht=a("crypto"),ze=a("path"),pe=a("fs"),Kt=a("os"),Qt=a("tty"),H;if(process.env.ESBUILD_WORKER_THREADS!=="0"){try{H=a("worker_threads");}catch{}let[e,t]= ...

High

Child Process

Package source references child process execution.

dist/chunks/main-ZMRSNK7G.mjsView on unpkg · L62

65More information: The file containing the code for esbuild's JavaScript API (${j}) does not appear to be inside the esbuild package on the file system, which usually means that the esbuild package was bundled into another file. This is problematic because the API needs to run a binary executable inside the esbuild package which is located using a relative path from the API code to the executable. If the esbuild package is bundled, the relative path will be incorrect and the executable won't be found.`);{let{binPath:e,isWASM:t}=Yt();return t?["node",[e]]:[e,[]]}},Ae=()=>Qt.isatty(2),Gt={readFil ...

66error: ${c}`),y=[{id:"",pluginName:"",text:c,location:null,notes:[],detail:void 0}];return u.errors=y,u.warnings=[],u},a=c=>{if(!c)return;let u=c.plugins;if(u&&u.length>0)throw s("Cannot use plugins in synchronous API calls")},d=(c,u)=>{for(let y in u)c[y]=u[y];},i=(c,u)=>{let y=o++,N=new SharedArrayBuffer(8),B=new Int32Array(N),_={sharedBuffer:N,id:y,command:c,args:u};n.postMessage(_);let I=Atomics.wait(B,0,0);if(I!=="ok"&&I!=="not-equal")throw new Error("Internal error: Atomics.wait() failed: "+I);let{message:{id:L,resolve:W,reject:z,properties:k}}=e.receiveMessageOnPort(t);if(y!==L)throw ne ...

Long lines were clipped for display.

dist/index.cjsView file

Lines 1-21javascript

1'use strict';var chunkYPKMFQLR_cjs=require('./chunks/chunk-YPKMFQLR.cjs'),chunkPYCQUF3V_cjs=require('./chunks/chunk-PYCQUF3V.cjs'),chunkWWPI6PC4_cjs=require('./chunks/chunk-WWPI6PC4.cjs'),chunkAHO55TRS_cjs=require('./chunks/chunk-AHO55TRS.cjs'),chunkYC4AEMOP_cjs=require('./chunks/chunk-YC4AEMOP.cjs'),chunkVRQQ33YH_cjs=require('./chunks/chunk-VRQQ33YH.cjs'),oe=require('fs/promises'

Source & flagged code

6 flagged · loading source

dist/chunks/main-ZMRSNK7G.mjsView file

62of "package.json" is used by esbuild to install the correct binary executable L63: for your current platform.`)}throw o}}if(/\.zip\//.test(n)){let o;try{o=a("pnpapi");}catch{}if(o){let s=o.getPackageInformation(o.topLevel).packageLocation,a=ne.join(s,"node_module... L64:

High

Child Process

Package source references child process execution.

dist/chunks/main-ZMRSNK7G.mjsView on unpkg · L62

dist/index.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1Cross-file remote execution chain: dist/index.cjs spawns dist/chunks/chunk-AHO55TRS.cjs; helper contains network access plus dynamic code execution. L1: 'use strict';var chunkYPKMFQLR_cjs=require('./chunks/chunk-YPKMFQLR.cjs'),chunkPYCQUF3V_cjs=require('./chunks/chunk-PYCQUF3V.cjs'),chunkWWPI6PC4_cjs=require('./chunks/chunk-WWPI6PC... L2: Full ${u} saved to: ${l} ... L11: L12: ${se}`,truncated:true,outputPath:G,originalLength:l.length,removedLength:de,label:E}}p.truncate=a;function i(l){return l.truncated?s(l.outputPath,l.label):""}p.formatHint=i;async f... L13: ${s.stderr}`),{stdout:a.stdout,stderr:a.stderr,exitCode:a.exitCode});return a},o=r();return Object.defineProperty(o,"stdin",{get(){throw new Error("stdin is not yet supported in Ea... L14: `),A=F.length>0?F[0]?.trim():null;if(A){X.set(h,A),T(A);return}}X.set(h,null),T(null);}),setTimeout(()=>{I.kill(),X.set(h,null),T(null);},5e3);})}catch{return X.set(h,null),null}}_... L15: `),I=T.length>0?T[0]?.trim():null;if(I)return X.set(h,I),I}}catch{}return X.set(h,null),null}_.whichSync=r;function o(){X.clear();}_.clearWhichCache=o;let s=module$1.createRequire(... L16: `).filter(d=>d.trim()&&!d.startsWith("#")))):["/bin/bash","/bi…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1'use strict';var chunkYPKMFQLR_cjs=require('./chunks/chunk-YPKMFQLR.cjs'),chunkPYCQUF3V_cjs=require('./chunks/chunk-PYCQUF3V.cjs'),chunkWWPI6PC4_cjs=require('./chunks/chunk-WWPI6PC... L2: Full ${u} saved to: ${l} ... L11: L12: ${se}`,truncated:true,outputPath:G,originalLength:l.length,removedLength:de,label:E}}p.truncate=a;function i(l){return l.truncated?s(l.outputPath,l.label):""}p.formatHint=i;async f... L13: ${s.stderr}`),{stdout:a.stdout,stderr:a.stderr,exitCode:a.exitCode});return a},o=r();return Object.defineProperty(o,"stdin",{get(){throw new Error("stdin is not yet supported in Ea... L14: `),A=F.length>0?F[0]?.trim():null;if(A){X.set(h,A),T(A);return}}X.set(h,null),T(null);}),setTimeout(()=>{I.kill(),X.set(h,null),T(null);},5e3);})}catch{return X.set(h,null),null}}_... L15: `),I=T.length>0?T[0]?.trim():null;if(I)return X.set(h,I),I}}catch{}return X.set(h,null),null}_.whichSync=r;function o(){X.clear();}_.clearWhichCache=o;let s=module$1.createRequire(... L16: `).filter(d=>d.trim()&&!d.startsWith("#")))):["/bin/bash","/bin/zsh","/bin/sh"]}function p(f,d){if(f&&(!d?.acceptable||o(f))){let y=a(f);if(y)return y}return process.platform==="wi... L17: [[ -f ~/.zshenv ]] && s

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.cjsView on unpkg · L1

1'use strict';var chunkYPKMFQLR_cjs=require('./chunks/chunk-YPKMFQLR.cjs'),chunkPYCQUF3V_cjs=require('./chunks/chunk-PYCQUF3V.cjs'),chunkWWPI6PC4_cjs=require('./chunks/chunk-WWPI6PC... L2: Full ${u} saved to: ${l} ... L11: L12: ${se}`,truncated:true,outputPath:G,originalLength:l.length,removedLength:de,label:E}}p.truncate=a;function i(l){return l.truncated?s(l.outputPath,l.label):""}p.formatHint=i;async f... L13: ${s.stderr}`),{stdout:a.stdout,stderr:a.stderr,exitCode:a.exitCode});return a},o=r();return Object.defineProperty(o,"stdin",{get(){throw new Error("stdin is not yet supported in Ea... L14: `),A=F.length>0?F[0]?.trim():null;if(A){X.set(h,A),T(A);return}}X.set(h,null),T(null);}),setTimeout(()=>{I.kill(),X.set(h,null),T(null);},5e3);})}catch{return X.set(h,null),null}}_... L15: `),I=T.length>0?T[0]?.trim():null;if(I)return X.set(h,I),I}}catch{}return X.set(h,null),null}_.whichSync=r;function o(){X.clear();}_.clearWhichCache=o;let s=module$1.createRequire(... L16: `).filter(d=>d.trim()&&!d.startsWith("#")))):["/bin/bash","/bin/zsh","/bin/sh"]}function p(f,d){if(f&&(!d?.acceptable||o(f))){let y=a(f);if(y)return y}return process.platform==="wi... L17: [[ -f ~/.zshenv ]] && s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.cjsView on unpkg · L1

Findings

4 High4 Medium6 Low

HighChild Processdist/chunks/main-ZMRSNK7G.mjs

HighSame File Env Network Executiondist/index.cjs

HighCommand Output Exfiltrationdist/index.cjs

HighCross File Remote Execution Contextdist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/chunks/main-ZMRSNK7G.mjsView file

Lines 42-66javascript

42you could consider using yarn instead of npm which has built-in support for

43installing a package on multiple platforms simultaneously.

45If you are installing with yarn, you can try listing both "arm64" and "x64"

46in your ".yarnrc.yml" file using the "supportedArchitectures" feature:

47https://yarnpkg.com/configuration/yarnrc/#supportedArchitectures

48Keep in mind that this means multiple copies of esbuild will be present.

49`),new Error(`

50You installed esbuild for another platform than the one you're currently using.

51This won't work because esbuild is written with native code and needs to

52install a platform-specific binary executable.

53${a}

54Another alternative is to use the "esbuild-wasm" package instead, which works

55the same way on all platforms. But it comes with a heavy performance cost and

56can sometimes be 10x slower than the "esbuild" package, so you may also not

57want to do that.

58`)}throw new Error(`The package "${e}" could not be found, and is needed by esbuild.

60If you are installing esbuild with npm, make sure that you don't specify the

61"--no-optional" or "--omit=optional" flags. The "optionalDependencies" feature

62of "package.json" is used by esbuild to install the correct binary executable

High

Child Process

Package source references child process execution.

dist/chunks/main-ZMRSNK7G.mjsView on unpkg · L62

Long lines were clipped for display.

dist/index.cjsView file

Lines 1-21javascript

1'use strict';var chunkYPKMFQLR_cjs=require('./chunks/chunk-YPKMFQLR.cjs'),chunkPYCQUF3V_cjs=require('./chunks/chunk-PYCQUF3V.cjs'),chunkWWPI6PC4_cjs=require('./chunks/chunk-WWPI6PC4.cjs'),chunkAHO55TRS_cjs=require('./chunks/chunk-AHO55TRS.cjs'),chunkYC4AEMOP_cjs=require('./chunks/chunk-YC4AEMOP.cjs'),chunkVRQQ33YH_cjs=require('./chunks/chunk-VRQQ33YH.cjs'),oe=require('fs/promises'