registry  /  @fugood/buttress-server  /  2.24.12

@fugood/buttress-server@2.24.12

A high-performance RPC server for managing GGML LLM generators with configurable defaults and runtime management.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 190 KB of source, external domains: huggingface.co, registry.npmjs.org

Source & flagged code

4 flagged · loading source
lib/index.mjsView file
1#!/usr/bin/env node L2: import{t as e}from"./chunk-C8PTHxhX.mjs";import{node as t}from"@elysiajs/node";import{Elysia as n,file as r,sse as i,t as a}from"elysia";import o,{createHash as s,randomUUID as c}f... L3: `);this.buffer=t.pop();for(let e of t)if(e.trim())try{this.handleMessage(JSON.parse(e))}catch(t){console.error(`[mlx-llm] Failed to parse bridge message:`,e,t)}}),this.readyPromise...
High
Child Process

Package source references child process execution.

lib/index.mjsView on unpkg · L1
1#!/usr/bin/env node L2: import{t as e}from"./chunk-C8PTHxhX.mjs";import{node as t}from"@elysiajs/node";import{Elysia as n,file as r,sse as i,t as a}from"elysia";import o,{createHash as s,randomUUID as c}f... L3: `);this.buffer=t.pop();for(let e of t)if(e.trim())try{this.handleMessage(JSON.parse(e))}catch(t){console.error(`[mlx-llm] Failed to parse bridge message:`,e,t)}}),this.readyPromise...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.mjsView on unpkg · L1
1#!/usr/bin/env node L2: import{t as e}from"./chunk-C8PTHxhX.mjs";import{node as t}from"@elysiajs/node";import{Elysia as n,file as r,sse as i,t as a}from"elysia";import o,{createHash as s,randomUUID as c}f... L3: `);this.buffer=t.pop();for(let e of t)if(e.trim())try{this.handleMessage(JSON.parse(e))}catch(t){console.error(`[mlx-llm] Failed to parse bridge message:`,e,t)}}),this.readyPromise...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/index.mjsView on unpkg · L1
bin/bricks-buttress.cmdView file
•path = bin/bricks-buttress.cmd kind = build_helper sizeBytes = 130 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bricks-buttress.cmdView on unpkg

Findings

3 High4 Medium4 Low
HighChild Processlib/index.mjs
HighSame File Env Network Executionlib/index.mjs
HighCommand Output Exfiltrationlib/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/bricks-buttress.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings