Static Scan Results
scanned 13d ago · by rust-scannerStatic analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/cli/index.js2.71 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStrings
dist/server/index.js2.99 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStrings127.0.0.1
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/registry.jsView file
2301import { resolve } from "path";
L2302: import { spawnSync } from "child_process";
L2303: function parseMetadata(value) {
High
Child Process
Package source references child process execution.
dist/registry.jsView on unpkg · L23012211commands TEXT DEFAULT '[]',
L2212: stdout_summary TEXT,
L2213: stderr_summary TEXT,
...
L2282: try {
L2283: tags = JSON.parse(row.tags);
L2284: } catch {
...
L2301: import { resolve } from "path";
L2302: import { spawnSync } from "child_process";
L2303: function parseMetadata(value) {
...
L2316: is_primary: !!row.is_primary,
L2317: metadata: parseMetadata(row.metadata)
L2318: };
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/registry.jsView on unpkg · L2211dist/index.jsView file
2211Cross-file remote execution chain: dist/index.js spawns dist/mcp/index.js; helper contains network access plus dynamic code execution.
L2211: commands TEXT DEFAULT '[]',
L2212: stdout_summary TEXT,
L2213: stderr_summary TEXT,
...
L2282: try {
L2283: tags = JSON.parse(row.tags);
L2284: } catch {
...
L2301: import { resolve } from "path";
L2302: import { spawnSync } from "child_process";
L2303: function parseMetadata(value) {
...
L2316: is_primary: !!row.is_primary,
L2317: metadata: parseMetadata(row.metadata)
L2318: };
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L22112211commands TEXT DEFAULT '[]',
L2212: stdout_summary TEXT,
L2213: stderr_summary TEXT,
...
L2282: try {
L2283: tags = JSON.parse(row.tags);
L2284: } catch {
...
L2301: import { resolve } from "path";
L2302: import { spawnSync } from "child_process";
L2303: function parseMetadata(value) {
...
L2316: is_primary: !!row.is_primary,
L2317: metadata: parseMetadata(row.metadata)
L2318: };
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L2211dist/cli/index.jsView file
•context = "] || process.env["USERPROFILE"] || "~";\n}\nfunction getTodosGlobalDir() {\n return join3(getHomeDir(), ".hasna", "todos");\n}\nfunction ensureDir2(dir) {\n if (!existsSync4(dir))\n mkdirSync2(dir, { recursive: true });\n}\nfunction listJsonFiles(dir) {\n if (!existsSync4(dir))\n return [];\n return readdirSync(dir).filter((f) => f.endsWith(".json"));\n}\nfunction readJsonFile(path) {\n try {\n return JSON.parse(readFileSync2(path, "utf-8"));\n } catch {\n return null;\n }\n}\nfunction writeJsonFile(path, data) {\n writeFileSync(path, JSON.stringify(data, null, 2) + `\n`);\n}\nfunction readHighWaterMark(dir) {\n const path = join3(dir, ".highwatermark");\n if (!existsSync4(path))\n return 1;\n const val = parseInt(readFileSync2(path, "utf-8").trim(), 10);\n return isNaN(val) ? 1 : val;\n}\nfunction writeHighWaterMark(dir, value) {\n writeFileSync(join3(dir, ".highwatermark"), String(value));\n}\nfunction getFileMtimeMs(path) {\n try {\n return statSync(path).mtimeMs;\n } catch {\n return null;\n }\n}\nfunction parseTimestamp(val
Critical
Encrypted Payload Temp Execution
Source decrypts an embedded payload, writes it to disk, and executes it through a child process.
dist/cli/index.jsView on unpkgdist/server/index.jsView file
•path = dist/server/index.js
kind = oversized_source_file
sizeBytes = 3136329
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/server/index.jsView on unpkg•path = dist/server/index.js
kind = oversized_cli_entrypoint
sizeBytes = 3136329
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/server/index.jsView on unpkgFindings
1 Critical6 High7 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/cli/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/registry.js
HighShell
HighCloud Metadata Accessdist/registry.js
HighCross File Remote Execution Contextdist/index.js
HighOversized Source Filedist/server/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumOversized Cli Entrypointdist/server/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings