registry / @ecency/sdk / 2.3.31

@ecency/sdk@2.3.31

⚠ Under review

Ecency SDK

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 863 KB of source, external domains: api.c0ff33a.uk, api.coingecko.com, api.deathwing.me, api.hive.blog, api.openhive.network, api.syncad.com, ecency.com, hapi.ecency.com, hiveapi.actifit.io, hiveposh.com, i.ecency.com, pl.ecency.com, poll.ecency.com, raw.githubusercontent.com, rpc.mahdiyari.info, studio.3speak.tv, techcoderx.com

Source & flagged code

2 flagged

dist/browser/index.jsView file

Lines 1-10javascript

1import {QueryClient,useQuery,useInfiniteQuery,useMutation,queryOptions,infiniteQueryOptions,useQueryClient}from'@tanstack/react-query';import {hexToBytes,bytesToHex}from'@noble/hashes/utils.js';import {ripemd160}from'@noble/hashes/legacy.js';import Dr from'bs58';import {secp256k1}from'@noble/curves/secp256k1.js';import {sha256,sha512}from'@noble/hashes/sha2.js';import {cbc}from'@noble/ciphers/aes.js';import Sn from'hivesigner';var Cr=Object.defineProperty;var Wo=(e,t,r)=>t in e?Cr(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var tt=(e,t)=>{for(var r in t)Cr(e,r,{get:t[ ...

2`).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var IK=1.1,Il=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(Il||{});function DK(e){return e?e.map((t,r)=>({choice_num:r+1,choice_text:t,votes:{total_votes:0,hive_hp:0,hive_proxied_hp:0,hive_hp_incl_proxied:0}})):[]}function Bl(e){let t=e.poll_choices??[],r=e.poll_voters??[],n=e.poll_stats,o=t.map(a=>{let u=a.votes;return {choice_num:a.choice_num??0,choice_text:a.choice_text??"",votes:u?{total_votes:u.total_votes??0,hive_hp:u.hive_hp,hive_proxied_hp:u.hive_proxied_hp,hive_hp_incl_proxied:u.hive_hp_incl_proxied??null}:void ...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

4 * Backing buffer: ArrayBuffer, Accessor: DataView

5 * Released under the Apache License, Version 2.0

6 * see: https://github.com/dcodeIO/bytebuffer.ts for details

7 * modified by @xmcl/bytebuffer

8 * And customized for hive-tx

9 */export{Nn as ACCOUNT_OPERATION_GROUPS,Vs as ALL_ACCOUNT_OPERATIONS,aE as ALL_NOTIFY_TYPES,il as AssetOperation,Af as BROADCAST_INCLUSION_DELAY_MS,io as BuySellTransactionType,f as CONFIG,D as ConfigManager,Ne as EcencyAnalytics,Cn as EcencyQueriesManager,_e as EntriesCacheManagement,En as ErrorType,Er as HIVE_ACCOUNT_OPERATION_GROUPS,bk as HIVE_OPERATION_LIST,Ok as HIVE_OPERATION_NAME_BY_ID,Ak as HIVE_OPERATION_ORDERS,St as HiveEngineToken,xo as HiveSignerIntegration,Oe as HiveTxTransaction,fe as INTERNAL_API_TIMEOUT_MS,Pn as Memo,dt as NaiMap,Gu as NotificationFilter,Ju as NotificationView ...

10//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/node/index.cjsView file

Lines 1-10javascript

1'use strict';var reactQuery=require('@tanstack/react-query'),utils_js=require('@noble/hashes/utils.js'),legacy_js=require('@noble/hashes/legacy.js'),Fr=require('bs58'),secp256k1_js=require('@noble/curves/secp256k1.js'),sha2_js=require('@noble/hashes/sha2.js'),aes_js=require('@noble/ciphers/aes.js'),On

Source & flagged code

2 flagged · loading source

dist/browser/index.jsView file

1import {QueryClient,useQuery,useInfiniteQuery,useMutation,queryOptions,infiniteQueryOptions,useQueryClient}from'@tanstack/react-query';import {hexToBytes,bytesToHex}from'@noble/has... L2: `).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var IK=1.1,Il=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(Il||{});function DK(e){return e?e.map((t,r)=>({...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

dist/node/index.cjsView file

1Trigger-reachable chain: manifest.main -> dist/node/index.cjs L1: 'use strict';var reactQuery=require('@tanstack/react-query'),utils_js=require('@noble/hashes/utils.js'),legacy_js=require('@noble/hashes/legacy.js'),Fr=require('bs58'),secp256k1_js... L2: `).filter(Boolean))},staleTime:1440*60*1e3,gcTime:1/0})}var AK=1.1,ql=(r=>(r.NUMBER_OF_VOTES="number_of_votes",r.TOKENS="tokens",r))(ql||{});function OK(e){return e?e.map((t,r)=>({...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/node/index.cjsView on unpkg · L1

Findings

2 Critical3 Medium4 Low

CriticalCredential Exfiltrationdist/browser/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/node/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/browser/index.jsView file

Lines 1-10javascript

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/browser/index.jsView on unpkg · L1

4 * Backing buffer: ArrayBuffer, Accessor: DataView

5 * Released under the Apache License, Version 2.0

6 * see: https://github.com/dcodeIO/bytebuffer.ts for details

7 * modified by @xmcl/bytebuffer

8 * And customized for hive-tx

10//# sourceMappingURL=index.js.map

Long lines were clipped for display.

dist/node/index.cjsView file

Lines 1-10javascript