Static Scan Results
scanned 3h ago · by rust-scannerStatic analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcedist/index.jsView file
3// src/cli/login.ts
L4: import { spawn } from "child_process";
L5:
...
L14: var VERSION = "0.2.0";
L15: var DEFAULT_API_URL = "https://api.getfokus.com";
L16: function normalizeApiUrl(url) {
...
L38: function configDir() {
L39: if (process.platform === "win32") {
L40: const base2 = process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
L41: return path.join(base2, "fokus-mcp");
...
L53: const raw = fs.readFileSync(credentialsPath(), "utf8");
L54: const parsed = JSON.parse(raw);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L3Findings
1 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings