registry / @feedmepos/mf-inventory-portal / 1.7.9-dev.1
@feedmepos/mf-inventory-portal@1.7.9-dev.1
⚠ Under review## Description
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
dist/app-DCSH6Br7.js4.76 MB file, sampled 256 KB
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcedist/app-DCSH6Br7.jsView file
6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f);
L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L116: usage: {
L117: body: "Cannot delete {subject} because it is linked in these items:",
L118: module: {
...
L7753: else {
L7754: if (n.charCodeAt(0) === 36)
L7755: throw new Error("Unknown operation " + n);
...
L8035: if (O && typeof O != "string")
L8036: throw new Error("Ability.can expects 3rd
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/app-DCSH6Br7.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-DCSH6Br7.js
L6: var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f);
L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst...
L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,...
...
L116: usage: {
L117: body: "Cannot delete {subject} because it is linked in these items:",
L118: module: {
...
L7753: else {
L7754: if (n.charCodeAt(0) === 36)
L7755: throw new Error("Unknown operation " + n);
...
L8035:
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-DCSH6Br7.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-DCSH6Br7.js
HighTrigger Reachable Credential Exfiltrationdist/app-DCSH6Br7.js
MediumNetwork
MediumOversized Source Filedist/app-DCSH6Br7.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.7.9-dev.1.
See all versions of @feedmepos/mf-inventory-portal for other recorded verdicts.
- Review the evidence and your use of @feedmepos/mf-inventory-portal@1.7.9-dev.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.