registry / @gkd-kit/inspect / 0.0.1786456238136
@gkd-kit/inspect@0.0.1786456238136
⚠ Under reviewStatic Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = simple-git-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = simple-git-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/ActionCard-C3CVutCf.jsView file
16contains invisible/control Unicode U+FEFF (zero width no-break space)
`,[f(`&:not(:first-child)`,`margin-top: 8px`),x(`button`,[f(`&:not(:last-child)`,`margin-right: 8px;`)])])]),Ue=q({name:`Popconfirm`,props:Object.assign(Object.assign(Object.assign({},S.props),O),{positiveText:String,negativeText:String,sh
Critical
Findings
1 Critical1 High4 Medium4 Low
CriticalTrojan Source Unicodedist/assets/ActionCard-C3CVutCf.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Wasm Moduledist/assets/sql-wasm-UFUCzYNW.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1786456238136.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1786456238136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.