registry / @ecency/sdk / 2.3.30

@ecency/sdk@2.3.30

⚠ Under review

Ecency SDK

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 883 KB of source, external domains: api.c0ff33a.uk, api.coingecko.com, api.deathwing.me, api.hive.blog, api.openhive.network, api.syncad.com, ecency.com, hapi.ecency.com, hiveapi.actifit.io, hiveposh.com, i.ecency.com, pl.ecency.com, poll.ecency.com, raw.githubusercontent.com, rpc.mahdiyari.info, spk.good-karma.xyz, studio.3speak.tv, techcoderx.com

Source & flagged code

2 flagged

dist/browser/index.jsView file

Lines 1-10javascript

1import {QueryClient,useQuery,useInfiniteQuery,useMutation,queryOptions,infiniteQueryOptions,useQueryClient}from'@tanstack/react-query';import {hexToBytes,bytesToHex}from'@noble/hashes/utils.js';import {ripemd160}from'@noble/hashes/legacy.js';import Hr from'bs58';import {secp256k1}from'@noble/curves/secp256k1.js';import {sha256,sha512}from'@noble/hashes/sha2.js';import {cbc}from'@noble/ciphers/aes.js';import qn from'hivesigner';var Kr=Object.defineProperty;var oi=(e,t,r)=>t in e?Kr(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var ot=(e,t)=>{for(var r in t)Kr(e,r,{get:t[ ...

2`).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var LI=1.1,Xl=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(Xl||{});function WI(e){return e?e.map((t,r)=>({choice_num:r+1,choice_text:t,votes:{total_votes:0,hive_hp:0,hive_proxied_hp:0,hive_hp_incl_proxied:0}})):[]}function ed(e){let t=e.poll_choices??[],r=e.poll_voters??[],n=e.poll_stats,o=t.map(a=>{let u=a.votes;return {choice_num:a.choice_num??0,choice_text:a.choice_text??"",votes:u?{total_votes:u.total_votes??0,hive_hp:u.hive_hp,hive_proxied_hp:u.hive_proxied_hp,hive_hp_incl_proxied:u.hive_hp_incl_proxied??null}:void ...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

4 * Backing buffer: ArrayBuffer, Accessor: DataView

5 * Released under the Apache License, Version 2.0

6 * see: https://github.com/dcodeIO/bytebuffer.ts for details

7 * modified by @xmcl/bytebuffer

8 * And customized for hive-tx

9 */export{Vn as ACCOUNT_OPERATION_GROUPS,ta as ALL_ACCOUNT_OPERATIONS,Ok as ALL_NOTIFY_TYPES,Al as AssetOperation,Qf as BROADCAST_INCLUSION_DELAY_MS,po as BuySellTransactionType,d as CONFIG,B as ConfigManager,He as EcencyAnalytics,Kn as EcencyQueriesManager,ve as EntriesCacheManagement,Rn as ErrorType,Rr as HIVE_ACCOUNT_OPERATION_GROUPS,BS as HIVE_OPERATION_LIST,HS as HIVE_OPERATION_NAME_BY_ID,QS as HIVE_OPERATION_ORDERS,Tt as HiveEngineToken,To as HiveSignerIntegration,Ee as HiveTxTransaction,me as INTERNAL_API_TIMEOUT_MS,En as Memo,gt as NaiMap,sp as NotificationFilter,cp as NotificationView ...

10//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/node/index.cjsView file

Lines 1-10javascript

1'use strict';var reactQuery=require('@tanstack/react-query'),utils_js=require('@noble/hashes/utils.js'),legacy_js=require('@noble/hashes/legacy.js'),Nr=require('bs58'),secp256k1_js=require('@noble/curves/secp256k1.js'),sha2_js=require('@noble/hashes/sha2.js'),aes_js=require('@noble/ciphers/aes.js'),Cn

Source & flagged code

2 flagged · loading source

dist/browser/index.jsView file

1import {QueryClient,useQuery,useInfiniteQuery,useMutation,queryOptions,infiniteQueryOptions,useQueryClient}from'@tanstack/react-query';import {hexToBytes,bytesToHex}from'@noble/has... L2: `).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var LI=1.1,Xl=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(Xl||{});function WI(e){return e?e.map((t,r)=>({...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

dist/node/index.cjsView file

1Trigger-reachable chain: manifest.main -> dist/node/index.cjs L1: 'use strict';var reactQuery=require('@tanstack/react-query'),utils_js=require('@noble/hashes/utils.js'),legacy_js=require('@noble/hashes/legacy.js'),Nr=require('bs58'),secp256k1_js... L2: `).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var FI=1.1,zl=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(zl||{});function KI(e){return e?e.map((t,r)=>({...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/node/index.cjsView on unpkg · L1

Findings

2 Critical3 Medium4 Low

CriticalCredential Exfiltrationdist/browser/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/node/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/browser/index.jsView file

Lines 1-10javascript

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

4 * Backing buffer: ArrayBuffer, Accessor: DataView

5 * Released under the Apache License, Version 2.0

6 * see: https://github.com/dcodeIO/bytebuffer.ts for details

7 * modified by @xmcl/bytebuffer

8 * And customized for hive-tx

10//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/node/index.cjsView file

Lines 1-10javascript