registry / @flashcatcloud/electron-sdk / 0.4.2
@flashcatcloud/electron-sdk@0.4.2
⚠ Under reviewFlashCat SDK for Electron applications
Static Scan Results
scanned 11h ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
GitDependencyNoLicense
Source & flagged code
3 flaggeddist/instrument.cjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/instrument.cjs#virtual:normalized:round1View on unpkgpackage.jsonView file
•devDependencies changed=json-schema-to-typescript
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgdist/instrument.cjsView file
Findings
1 Critical2 High3 Medium6 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/instrument.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/instrument.cjs
MediumNetwork
MediumEnvironment Vars
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @flashcatcloud/electron-sdk@0.4.2.
See all versions of @flashcatcloud/electron-sdk for other recorded verdicts.
- Review the evidence and your use of @flashcatcloud/electron-sdk@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.