Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcedist/index.jsView file
64package = @hivelore/cli; repositoryIdentity = hivelore; dependency = @hivelore/core
L64: writeBriefingMarker
L65: } from "@hivelore/core";
L66:
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L64742try {
L743: const mod = await import("@hivelore/embeddings");
L744: const cold = !existsSync2(mod.codeIndexPath(paths));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L742dist/chunk-FXDGOBPT.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @hivelore/cli@0.42.1
matchedIdentity = npm:QGhpdmVsb3JlL2NsaQ:0.42.1
similarity = 0.923
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-FXDGOBPT.jsView on unpkgFindings
2 High4 Medium4 Low
HighCopied Package Dependency Bridgedist/index.js
HighPrevious Version Dangerous Deltadist/chunk-FXDGOBPT.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings