registry / @flotic/minitok / 1.1.3

@flotic/minitok@1.1.3

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 215 KB of source, external domains: api.anthropic.com, api.minitok.dev, api.openai.com, cognitiveservices.azure.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, login.microsoftonline.com, oauth2.googleapis.com, openrouter.ai, www.googleapis.com

Source & flagged code

2 flagged

src/evidence/collector.jsView file

4const path = require("path"); L5: const { execSync } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

src/evidence/collector.jsView on unpkg · L4

27if (fs.existsSync(path.join(repoRoot, "package.json"))) { L28: execSync("npx eslint . --quiet 2>&1", { cwd: repoRoot, encoding: "utf-8", timeout: 60000 }); L29: evidence.lint = { status: "clean" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/evidence/collector.jsView on unpkg · L27

Source & flagged code

2 flagged · loading source

src/evidence/collector.jsView file

4const path = require("path"); L5: const { execSync } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

src/evidence/collector.jsView on unpkg · L4

27if (fs.existsSync(path.join(repoRoot, "package.json"))) { L28: execSync("npx eslint . --quiet 2>&1", { cwd: repoRoot, encoding: "utf-8", timeout: 60000 }); L29: evidence.lint = { status: "clean" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/evidence/collector.jsView on unpkg · L27

Findings

3 High3 Medium4 Low

HighChild Processsrc/evidence/collector.js

HighShell

HighRuntime Package Installsrc/evidence/collector.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @flotic/minitok@1.1.3.

See version security history for other recorded verdicts.

Review the evidence and your use of @flotic/minitok@1.1.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 14:03:06.202Z (UTC).