registry / @flotic/minitok / 1.3.3

@flotic/minitok@1.3.3

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 78 file(s), 349 KB of source, external domains: api.anthropic.com, api.minitok.dev, api.openai.com, cognitiveservices.azure.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, login.microsoftonline.com, oauth2.googleapis.com, openrouter.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

2 flagged

src/llm/provider.jsView file

5L6: const dns = require("dns").promises; L7: const net = require("net"); ... L115: pinned.hostname = address.includes(":") ? `[${address}]` : address; L116: return { dispatcher: require("undici").ProxyAgent ? new (require("undici").ProxyAgent)({ uri: process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || proces... L117: } ... L143: } L144: chunks.push(Buffer.from(value)); L145: } ... L332: const headers = { "Content-Type": "application/json", "x-api-key": apiKey, "anthropic-version": "2023-06-01" }; L333: const res = await fetchWithTimeout(`${endpointTransport.url}/v1/messages`, { method: "POST", headers, body: JSON.stringify(body), ...(endpointTransport.dispatcher ? { dispatcher: e... L334: if (!res.ok) throw providerError("Anthropic", res.status);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/llm/provider.jsView on unpkg · L5

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

src/llm/provider.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/llm/provider.jsView on unpkg · L5

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Findings

2 High3 Medium5 Low

HighCloud Metadata Accesssrc/llm/provider.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @flotic/minitok@1.3.3.

See version security history for other recorded verdicts.

Review the evidence and your use of @flotic/minitok@1.3.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 05:05:25.354Z (UTC).