registry  /  @friskai/frisk-js  /  0.3.2

@friskai/frisk-js@0.3.2

FriskAI TypeScript SDK

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.81 MB of source, external domains: api.frisk.ai, github.com, grpc.io, json-schema.org, otel-collector.docker.localhost

Source & flagged code

4 flagged · loading source
dist/index.jsView file
6080}; L6081: Writer.prototype.fork = function fork() { L6082: this.states = new State(this);
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6080
23624var _a; L23625: const api = _global[GLOBAL_OPENTELEMETRY_API_KEY] = (_a = _global[GLOBAL_OPENTELEMETRY_API_KEY]) !== null && _a !== undefined ? _a : { L23626: version: version_1.VERSION
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L23624
276Cross-file remote execution chain: dist/index.js spawns dist/adapters/langchain/index.js; helper contains network access plus dynamic code execution. L276: for (let i = 0;i < str.length; ++i) { L277: bytes.push(str.charCodeAt(i)); L278: } ... L734: L735: // ../../node_modules/@grpc/grpc-js/package.json L736: var require_package = __commonJS((exports, module) => { ... L740: description: "gRPC Library for Node - pure JS implementation", L741: homepage: "https://grpc.io/", L742: repository: "https://github.com/grpc/grpc-node/tree/master/packages/grpc-js", ... L770: "eslint-plugin-prettier": "^4.2.1", L771: execa: "^2.0.3", L772: gulp: "^4.0.2",
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L276
5601try { L5602: var mod = eval("quire".replace(/^/, "re"))(moduleName); L5603: if (mod && (mod.length || Object.keys(mod).length))
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L5601

Findings

3 High3 Medium6 Low
HighChild Processdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings