registry / @glassnote/client / 2.4.4
@glassnote/client@2.4.4
GlassNote — cliente de escritorio de notas superpuestas. Se instala con npx, sin instaladores nativos ni firmas.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedautoStart.jsView file
12const os = require('os');
L13: const { execSync, spawn } = require('child_process');
L14:
High
12const os = require('os');
L13: const { execSync, spawn } = require('child_process');
L14:
...
L16: constructor() {
L17: this.platform = process.platform;
L18: }
...
L74: path.join(
L75: process.env.APPDATA,
L76: 'Microsoft',
...
L177: console.error('Error message:', error.message);
L178: if (error.stdout) console.error('stdout:', error.stdout.toString());
L179: if (error.stderr) console.error('stderr:', error.stderr.toString());
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
autoStart.jsView on unpkg · L12bin/glassnote.js#virtual:normalized:round1View file
71const sonda =
L72: "const http=require('http');const r=http.get('http://127.0.0.1:48984/uuid',(res)=>{res.resume();process.exit(res.statusCode===200?0:1)});r.on('error',()=>process.exit(1));r.setTime...
L73: const res = spawnSync(process.execPath, ["-e", sonda], {
L74: env: Object.assign({}, process.env, { ELECTRON_RUN_AS_NODE: "1" }),
L75: stdio: "ignore",
Findings
6 High4 Medium6 Low
HighChild ProcessautoStart.js
HighShell
HighSame File Env Network Executionbin/glassnote.js#virtual:normalized:round1
HighTrigger Reachable Persistencebin/glassnote.js
HighRuntime Package Installbin/glassnote.js
HighSemantic Analysis Limitedbin/glassnote.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall PersistenceautoStart.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @glassnote/client@2.4.4.
See all versions of @glassnote/client for other recorded verdicts.
- Review the evidence and your use of @glassnote/client@2.4.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.