registry  /  @helia/interop  /  11.0.2

@helia/interop@11.0.2

Interop tests for Helia

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
Minified
ManifestNo manifest risk signals triggered.
scanned 61 file(s), 138 KB of source

Source & flagged code

5 flagged · loading source
dist/src/bin.jsView file
1#! /usr/bin/env node L2: import { spawn } from 'node:child_process'; L3: import { dirname, resolve } from 'path';
High
Child Process

Package source references child process execution.

dist/src/bin.jsView on unpkg · L1
6const cwd = resolve(dirname(fileURLToPath(import.meta.url)), '../../'); L7: const test = spawn('npx', ['aegir', 'test'], { L8: cwd
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/bin.jsView on unpkg · L6
dist/src/car.spec.jsView file
43const buf = await toBuffer(c.export(cid)); L44: await drain(kubo.api.dag.import([buf])); L45: const output = [];
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/src/car.spec.jsView on unpkg · L43
src/fixtures/data/QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.carView file
•path = [redacted]-xkcd-Barrel-part-1.car kind = high_entropy_blob sizeBytes = 25500 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/fixtures/data/QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.carView on unpkg
•path = [redacted]-xkcd-Barrel-part-1.car kind = payload_in_excluded_dir sizeBytes = 25500 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/fixtures/data/QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.carView on unpkg

Findings

5 High4 Medium2 Low
HighChild Processdist/src/bin.js
HighShell
HighRuntime Package Installdist/src/bin.js
HighShips High Entropy Blobsrc/fixtures/data/QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.car
HighPayload In Excluded Dirsrc/fixtures/data/QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.car
MediumDynamic Requiredist/src/car.spec.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem